A Thousand Seats and a New Password Policy. Where the Money Actually Goes

The line item everybody looks at first is the one that matters least. A password manager quoted per user per month, multiplied across the workforce, produces a number that fits on a slide and gets argued about in a budget meeting. Meanwhile the helpdesk is absorbing reset calls every Monday morning, each one consuming a tech's time and a worker's, and nobody has costed that queue because it was never a line item to begin with. When an organization changes how credentials work, the money moves between categories rather than disappearing, and the categories that grow are rarely the ones on the slide.

The reset queue is the baseline you are already paying

Before comparing anything, price what the current arrangement costs. Password resets are usually among the highest-volume ticket types in an internal support desk, and the volume is not random: it spikes after holidays, after forced expirations, and in the first week of a new hire cohort. The cost is labor minutes on both sides of the call, multiplied by volume, plus the identity verification step that a serious organization imposes before unlocking an account. That verification is the expensive part. Do it carelessly and you have built a social engineering channel into your own support process. Do it properly and each reset takes real time from a trained person.

What people actually do, as against what the policy assumes, is the reason the queue exists. The guidance assumed that mandatory rotation would produce fresh, unrelated secrets every ninety days. In practice it produced incrementing digits, a season and a year, and a sticky note in a desk drawer, because a workforce asked to memorize a new string four times a year will find the cheapest way to comply. The National Institute of Standards and Technology, which is responsible for the federal digital identity guidelines that most corporate policies were quietly copied from, revised that advice years ago. Rotation without evidence of compromise was removed. Many internal policies never caught up.

Option one: keep the old rules and spend nothing new

Tightening composition requirements and keeping the expiration clock costs nothing to announce, which is exactly why it survives. The expense is distributed instead of budgeted. It shows up as reset volume, as shadow workarounds, as the shared spreadsheet of service account credentials that one team maintains because the official system cannot hold them. It also shows up in the breach scenario, where an attacker who obtains one reused password from an unrelated consumer site walks into a corporate account that was technically compliant with every rule the policy listed. Compliance with composition rules and resistance to credential stuffing turned out to be almost unrelated properties, which is the finding that drove the guidance change.

Option two: screening, length, and a managed vault

The middle path replaces rotation with two things: screening every new password against known breached credential lists, and giving people somewhere to keep long, unique secrets they were never going to memorize. Licensing is quoted per seat per month and discounts at volume, with tiers that gate the features a large organization actually needs, directory integration, provisioning, policy enforcement, and audit logging among them. The license is the predictable cost. The unpredictable cost is rollout: enrollment sessions, a migration window during which people import what was in their browser, and a support surface that spikes for roughly a quarter before settling below where it started.

Two drivers decide whether the project lands on budget. The first is directory sprawl. If identities live in one authoritative place, enrollment is mechanical; if they are scattered across an on-premises directory, a cloud tenant, a payroll system and a dozen application-local accounts, the cleanup is the project and the vault is an afterthought. The second is the exception list: the legacy application that cannot accept a sixty-character passphrase, the shared operational account that four people on a shift genuinely need, the vendor portal with its own rules. Each exception is handled by a person, once, and then documented, which is where the hours go.

Option three: phishing-resistant keys and passkeys

Hardware security keys and platform passkeys change the economics rather than reducing them. You buy devices, and you buy them twice, because a single key with no registered backup produces a lockout that costs far more than the spare would have. You pay for enrollment, which is a short in-person or verified-remote interaction per employee. You pay for the subset of applications that need federation work before they will accept the stronger authenticator. Against that, you remove the reset queue almost entirely for the covered population, and you remove the class of attack where a convincing login page harvests a credential and a one-time code in the same minute.

The honest comparison is not cost against cost but cost against which failure you are funding. Rotation funds helpdesk labor forever. A vault funds a license and a one-time cleanup. Keys fund hardware and a recovery design. Most large organizations end up layering rather than choosing, with keys for administrators and finance, a managed vault for everyone, and screening applied across the board.

The line that decides the budget is account recovery

Whatever you deploy, someone will lose the phone, the key, and the laptop in the same weekend. The recovery path is where attackers aim, because it is the documented procedure for granting access to a person who cannot prove access the normal way. Designing it well costs manager approval steps, identity verification that holds up, and a tested runbook. Skipping it costs the entire investment, since a cheap recovery route sets the real strength of every control above it.

Price the current queue first, then price the alternatives against it. The comparison usually resolves itself once the invisible cost has a number attached.