Yubikeys (both two-factor and very long static passwords, with pins) go a long way. And a handful of Yubikeys handed out to your staff is cheaper than a data br

Yubikeys (both two-factor and very long static passwords, with pins) go a long way. And a handful of Yubikeys handed out to your staff is cheaper than a data breach. It's not protection from idiocy, but if you're a Microsoft shop, default long passwords avoid stuff that Microsoft is rather coy about (e.g., LANMAN hash attacks against passwords < 14 characters long are still a thing, sigh).