Change your password every 90 days. Plenty of organisations still enforce it. The NCSC has advised against forced expiry since 2018. People nudge the old password by a character, and predictable swaps like zero-for-o are the first thing attackers try. What works is duller: a minimum length, a deny list of common passwords, throttling, password managers and MFA on internet-facing accounts. After that, change on suspicion of compromise, not because a timer fired. https://www.ncsc.gov.uk/collection/passwords/updating-your-approach #CyberSecurity #InfoSec #PasswordSecurity