CIS Controls CIS-5.2

Unique passwords and minimum password lengths, which directly reduce the effectiveness of brute-force attacks by increasing the number of possible password combinations and limiting the reuse of compromised credentials across systems. This makes online password guessing and offline password cracking more difficult and reduces the success of credential-stuffing attacks.

Enforced minimum password length increases the search space and reduces the effectiveness of password guessing.

Longer passwords materially increase the effort required to recover plaintext passwords from captured hashes or related material.

Unique, non-common passwords reduce success of spraying common passwords across many accounts.

Unique passwords reduce adversary use of default or vendor-provided account credentials.

Domain accounts can span users, admins, and services; unique passwords reduce domain credential reuse and lateral reuse risk.

Unique local passwords reduce reuse of one compromised local account credential across multiple endpoints or servers.

Unique passwords reduce credential reuse across systems and accounts, limiting adversary use of one compromised password to pivot through valid accounts.

This directly counters password overlap from breached credentials reused across personal, third-party, and enterprise accounts.

Unique passwords reduce cloud/SaaS credential overlap and lateral reuse risk