Ethical hacker Rachel Tobac said weak passwords remain a primary cybersecurity risk that exposes users to significant account compromise.

This vulnerability matters because traditional authentication methods are failing to keep pace with modern hacking techniques, leaving personal and financial data exposed to global threats.

Tobac, the CEO of SocialProof Security, said the reliance on simple passwords is a critical flaw in digital safety. The scale of the problem is evidenced by reports that 19 billion passwords have leaked online [1]. These leaks allow attackers to use credential stuffing and other automated methods to access multiple accounts using a single set of stolen credentials.

To combat these risks, Tobac said a shift toward more robust security practices is necessary. While some guidelines suggest a strong password is at least seven characters long [2], the increasing power of computing means that length alone is often insufficient. She said users should use unique passwords for every account to prevent a single breach from compromising a user's entire digital identity.

Beyond password complexity, Tobac said passkeys are a transformative technology. Passkeys replace traditional passwords with cryptographic keys stored on a user's device, which are unlocked via biometrics or a device PIN. This method removes the risk of password theft through phishing because there is no shared secret for a hacker to steal.

Security threats continue to evolve, and some specific methods remain a priority for defenders. For example, Kerberoasting attacks were expected to remain a concern through 2025 [3]. This highlights the ongoing battle between security professionals and malicious actors who target service accounts to escalate privileges within a network.

Tobac said the goal of educating the public is to encourage the adoption of stronger authentication methods before a breach occurs. By moving away from easily guessable strings of text, users can significantly reduce their attack surface.

“19 billion passwords have leaked online”

The transition from passwords to passkeys represents a fundamental shift in the identity layer of the internet. By removing the human element of creating and remembering passwords, the industry aims to eliminate the primary vector for credential-based attacks, though widespread adoption depends on user education and platform compatibility.