A company undergoes a security audit and finds that their password policies are lax, with most employees using easily guessable passwords. As a security auditor, what would be your primary recommendation?

Enforcing a strong password policy would be the primary recommendation, as it directly addresses the core issue of weak passwords. This policy would mandate criteria like password length, complexity, and change frequency. While MFA and regular audits are beneficial, addressing the root cause is essential.