Even corporate IT security still refuses to stop the frequent password change policies even when NIST now says it’s safer to not change as often and just change passwords if it was compromised or shared somewhere else.