Despite increasing attention to cybersecurity and a seemingly constant stream of high-profile data breaches, the primary security method used in businesses worldwide remains the simple password. According to a recent study, the average person now has 19 passwords to remember, so it is not surprising that the vast majority of passwords are, from a security perspective, irrefutably bad, including sequential numbers, dictionary words or a pet’s name.

A new report by software firm Software Advice found that 44% of employees are not confident about the strength of their passwords. While many felt their usage was either extremely or very secure, the group reported, “our findings suggest that users either remain unaware of the rules despite the hype, do not believe them to be good advice or simply find them too burdensome, and thus opt for less secure passwords.

”

Among the biggest password sins employees commit:

But company culture and IT leadership may be partly to blame. “If management is lax about enforcing best practices, then leadership must share the blame when workers take shortcuts—and perhaps even accept the lion’s share of it,” the report reads.

Only 54% of businesses require complex passwords, and other shortcomings in best practice enforcement include:

White House Cybersecurity Coordinator Michael Daniel has previously said that he “would love to kill the password dead as a primary security method,” and 14% of companies are leading the charge, using biometric identification instead. Clearly, however, there is plenty that IT departments can implement now to boost cybersecurity without adopting advanced and costly measures like retina scans or fingerprints.