IT teams frequently fail to retire temporary onboarding passwords, leaving organisations exposed to account compromise and lateral movement attacks. New employees typically receive initial credentials via email or SMS during their first day, but many organisations never enforce password changes once workers access systems.
This creates a persistent security gap. Temporary passwords shared over unencrypted channels like email remain visible in message histories indefinitely. If an attacker gains access to employee email accounts, they inherit valid credentials for multiple systems. Reused passwords across accounts amplify the risk. A compromised temporary credential grants access not just to the primary system, but potentially to email, file storage, and other services tied to the same password.
The onboarding process itself compounds the problem. IT staff juggle device provisioning, account creation, and permission assignments under time pressure. Password management falls to ad-hoc methods rather than structured workflows. Nobody explicitly owns the task of forcing password changes after initial login, so it simply doesn't happen.
Attackers exploit this predictable weakness. Employee directories and leaked credential lists frequently circulate on dark web marketplaces. Temporary onboarding passwords that follow common patterns (often company name plus numbers) become prime targets. One successful breach of an employee email account yields credentials for additional systems.
Organisations should enforce mandatory password changes on first login. Passwords should never be sent via email or SMS. Instead, use secure password delivery methods like single-use temporary links or in-person credential handoff. Multi-factor authentication on critical accounts reduces risk even if temporary passwords are compromised.
IT teams should also audit existing accounts to identify passwords never changed since onboarding. Quarterly reviews of employee access ensure credentials stay current and unnecessary accounts get removed.
The onboarding password problem reflects a broader truth about security: convenience and security often conflict. Tight timelines drive bad decisions. Building structured processes and automated enforcement transforms onboarding from a vulnerability window