Get in touch with us
We at accompio will be happy to help you.
19.08.2026
Password security is one of the fundamentals of IT security – and yet it is frequently underestimated. People still use simple passwords like „123456“, personal information or the same login credentials for multiple services. For attackers, precisely this can become the decisive gateway.
Timur Yilmaz, Service Owner for Security Validation at accompio, regularly experiences in practice how insecure passwords endanger companies. During security audits and password checks, passwords are deliberately tested for security – with results that are sometimes sobering. In the expert interview, he explains how attackers obtain passwords, which mistakes are particularly common, and how secure passwords can actually be implemented in everyday life.
What actually makes a secure password? Which tools can help you with password creation and management? And what are the consequences of weak or recurring passwords at an enterprise level? Timur Yilmaz provides all the answers in the full video interview.
00:06 | Claudia van Veen: Password security. That is what everything revolves around now in our accompio focus topic for you. A warm welcome! I am Claudia van Veen, presenter and journalist from Hanover. With me is Timur Yilmaz. A warm welcome.
00:19 | Claudia van Veen: What is your job and how do you get the passwords?
00:22 | Timur Yilmaz: At accompio, I am Service Owner for Security Validation and conduct security audits and security assessments with our clients. This includes regular password checks. We try to crack the passwords used within the company and in the process see just how many passwords are insecure.
00:43 | Claudia van Veen: What is the most absurd password you've ever come across professionally or personally?
00:49 | Timur Yilmaz: There are many nonsensical passwords. We often find combinations like „SummerPlant2025!“ or a season with a year and an exclamation mark. Dates of birth or „123456“ are also still frequently used.
01:11 | Claudia van Veen: How on earth do attackers get hold of our passwords?
01:16 | Timur Yilmaz: On the one hand, through phishing. You receive an email, click on a link and enter your password on a fake page. On the other hand, passwords circulate via data leaks following attacks on other services. These access credentials are collected in databases and compared with one another. If a password has been used multiple times, an older data leak can also become a problem for a company.
01:43 | Claudia van Veen: This issue has been around for a long time, yet it is still underestimated.
01:49 | Timur Yilmaz: Definitely. Week after week, I see a lot of bad passwords and talk to customers about changing their passwords and rolling out new ones.
02:05 | Claudia van Veen: What do we typically do wrong? I often use the same password. Is that a typical mistake?
02:16 | Timur Yilmaz: Yes, password reuse is a major mistake. If another service is hacked, the passwords stolen from there can also be tried on other accounts. Anyone who uses the same password for personal and business purposes creates a vulnerability as a result. Passwords with a personal connection, such as family names, pets, places or other easily researched information, are also problematic.
02:59 | Claudia van Veen: How would you define a secure password?
03:04 | Timur Yilmaz: Length is crucial. Passwords should be as long as possible. Passphrases are a good option because people find them easier to remember. Password security often fails because we already have a great many passwords and cannot remember them.
03:28 | Claudia van Veen: What shall we do then?
03:29 | Timur Yilmaz: I use a password manager both privately and for business. Then you only have to remember a single, very long master password. All other passwords are saved there and can be generated automatically. I therefore do not know my individual passwords. They are long, random character strings. Of course, it is also important that the master password is long and secure.
04:11 | Claudia van Veen: Do we need multi-factor authentication as well?
04:14 | Timur Yilmaz: Definitely. Multi-factor authentication secures the final step. Even if someone cracks my password, they still need my smartphone and, on top of that, biometrics or a code to confirm access.
04:33 | Claudia van Veen: Where should a company begin to critically review password security? With training or policies?
04:41 | Timur Yilmaz: Training is particularly important. Guidelines have their place, but they can be bypassed. A password like „SummerPlant2025!!“ may meet formal requirements for uppercase and lowercase letters, numbers, and special characters, yet still remain predictable. Employees should learn concretely how secure passwords are created. That is crucial.
05:16 | Claudia van Veen: Can we not just get rid of passwords?
05:20 | Timur Yilmaz: Alternatives such as biometric methods already exist. However, the fallback is frequently still a password. If Face ID does not work, people resort to it again. Biometrics makes usage more convenient because we can use very long passwords without having to type them in every time.
05:59 | Claudia van Veen: We have established that a password should be as long as possible. How long is your password for the password manager?
06:12 | Timur Yilmaz: My password is 24 characters long. I can't tell you it, of course.
06:18 | Claudia van Veen: That is also quite right. Thank you very much, Timur Yilmaz. Check your passwords, use a password manager if necessary, and train employees in the company. Thanks for watching and see you soon.
„SummerPlant2025!“ or „123456“ – passwords of this kind are still regularly encountered by security experts. Passwords with a personal reference, such as family names, pets, dates of birth or well-known places, are also problematic.
Timur Yilmaz knows these patterns from his daily work. As a Service Owner for Security Validation, he accompanies Security checks and security audits for clients. This also includes password checks, which test how secure the passwords used within the company actually are.
The result highlights a fundamental problem: no matter how extensive technical security measures may be, if access credentials are easy to guess or have already been compromised elsewhere, a significant vulnerability arises.
Passwords can fall into the hands of attackers in various ways. A particularly common scenario is phishing: for example, users receive an email with a link that leads to a fake login page. If the password is entered there, attackers can intercept the login details.
Another danger is data leaks. If an online service is compromised, stored access credentials or password data can fall into the hands of attackers. This information can then be cross-referenced with other known access credentials.
This is precisely where password reuse shows its danger: a password compromised on a private service can become a risk to corporate system access if the same password is used there as well.
When it comes to what makes a secure password, Timur Yilmaz focuses primarily on one factor: the length.
The longer a password is, the better. Instead of short, complex-looking character strings, long passphrases can therefore also be used. They have another advantage: long passwords are often easier to remember if they consist of several words.
At the same time, a password should not have any personal connection. Names, dates of birth, pets, favourite places or other information that can be found out about the person in question should not be part of a password.
„Anything with a personal connection should not be a password. I don't know my passwords. I know a single password – the one for my password manager.“
— Timur Yilmaz, Service Owner at accompio
So a good password is not necessarily the most complicated password. The crucial thing above all is that it long, unique and not derived from personal or easily predictable information is.
A Password manager solves one of the biggest practical problems in password security: nobody has to remember dozens of complex passwords anymore.
Instead, a strong master password is required. The remaining access credentials can be stored and managed within it. A password manager can also generate secure, random passwords that consist of many characters and have no personal connection.
Timur Yilmaz uses a password manager himself – both personally and in his business. As a result, he doesn't even know his individual passwords by heart. Instead, a separate, long password is used for every service.
Even a strong password should not be the only security measure. An important additional security layer is multi-factor authentication (MFA).
In this process, the login is not secured by the password alone. An additional factor must also be confirmed – for example via a smartphone, a code or a biometric method.
This significantly increases security. Even if an attacker knows a password or has managed to crack it, the password alone is not necessarily enough to gain access to a protected account.
Multi-factor authentication should therefore be an important component of a holistic identity and access security strategy for businesses.
Companies often try to enforce secure passwords through mandatory password policies. While requirements for upper and lower case letters, numbers and special characters can be useful, they do not automatically guarantee a secure password.
A real-world example illustrates the problem: a user can create a password such as „SommerPflanze2025!!“ and thereby formally meet various complexity requirements. Even so, the password remains predictable and therefore insecure.
This is why Timur Yilmaz trainings as a particularly important component of password security. Staff must understand how secure passwords are created, why password reuse is dangerous, and which behaviours attackers can exploit.
Password security is therefore not exclusively a technical task. It is also a matter of knowledge and behaviour.
accompio identifies vulnerabilities in your password and security structure before they can become gateways for real-world attacks.
The first step is to know the actual state. Password checks and security reviews can help to make vulnerabilities visible.
Building on this, companies should specifically raise awareness among their employees and provide them with concrete methods. These include in particular:
This is how an abstract password policy becomes a security concept that can also be implemented in everyday work.
Anyone wishing to improve their own password security can start with a few simple steps: Are passwords used multiple times? Do they contain personal information? Are important accounts additionally protected by multi-factor authentication? And is a password manager already being used?
The most important step is not to wait until a security incident occurs to take action. Password security should be an integral part of personal and corporate IT security.
Timur Yilmaz is an expert in password security and security solutions. He advises clients on securing their access and applications.
A secure password is above all long and individual. It should have no personal connection and not be used across multiple services. Long passphrases or randomly generated passwords are particularly suitable.
As a general rule, the longer a password, the better. In the interview, Timur Yilmaz therefore recommends passwords or passphrases that are as long as possible. When using a password manager, very long, randomly generated passwords can also be used.
Long passphrases can be a good way to create secure yet memorable login details. Length is particularly crucial. Furthermore, a passphrase should not consist of easily guessed personal information.
If a password is compromised in a data leak at one service, attackers can try using the same password on other services. If it is used both privately and for a corporate account, for instance, a private data leak can become a security risk for the company.
Password managers make it possible to use a unique and very long password for every service without users having to memorise all their access details. Instead, only one strong master password is required. The remaining passwords can be generated and stored by the password manager.
Yes. Multi-factor authentication provides an additional layer of protection. Even if an attacker knows the password, they need another factor, such as a smartphone, a code or biometric confirmation.
In addition to technical measures, companies should focus primarily on training. Password policies alone are not enough if employees use passwords that are formally complex yet easily predictable. Training should specifically teach how secure passwords are created and why password reuse is risky.
