People are no longer advised to change their computer password every 90 days, a cybersecurity specialist has revealed.

Speaking at the Cybermuda Conference, Richard Connor, president of LockStock Security, said: “The only time you should change your password is when there is reason to believe that you have been compromised.”

He told an audience at Paradise Mobile on Reid Street in Hamilton that password rotation was not as secure as expected because of human nature.

People tended to reuse the same password over and over again by changing one character or wrote it down somewhere so they would not forget it. They also often used ridiculously easy passwords like “Fall2026” or “password”.

Mr Connor said artificial intelligence has been a force multiplier for cybercriminals helping them speed up their nefarious deeds.

He explained that criminals could use publicly available information to create convincing e-mails appearing to come from company executives, suppliers or other trusted individuals.

“Reconnaissance is a big part of doing penetration testing,” he said.

AI helps bad actors absorb profiles and reports in seconds.

“I’m sure all of you in here have been loading all of your company data into Claude,” he said. “Who knows what type of new threat surface that is creating.”

Mr Connor talked about different types of scams including a business e-mail compromise — a targeted phishing scam where someone impersonates a trusted contact, such as a supplier or lending broker. The aim is to trick a business into changing payment details or sending money to a fraudulent bank account.

He illustrated it with an e-mail claiming an invoice was owed and providing “new bank account details”.

His recommendation was to verify payment changes by calling a known number already on file, rather than relying on the email request.

“Map every way that money leaves your organisation and start thinking about what that process look like,” he said. “Where do you see vulnerabilities?”

The discussion raised concerns over whether businesses adequately understood how employees were using artificial intelligence.

Fernando de Deus, chief executive and founder of Ingine, a managed services provider and technical solutions company, advised firms to establish a proper workflow when introducing AI.

“You lay down the baseline,” he said. “Learn it and identify what you use and how you use it. It is that involvement, that maturity that is still occurring today.”

Conference attendee Anthony Francis, the Bermuda Government’s chief information security officer, said organisations need to assess AI risks as part of governance, not treat risk assessment as optional.

“If you have not assessed the risk of allowing this in your organisation, then you are not performing your governance correctly,” Mr Francis said. “If you are not doing risk assessment, then you are exposing your organisation. That is not on the people who are using it; that is on the governance of that.”

Cybermuda was co-hosted by Cybersecurity Executives of Bermuda and the Information Systems Audit and Control Association Bermuda Chapter.

It brought together cybersecurity professionals to discuss AI-related threats, incident response, cyber insurance and the mental health challenges associated with cybersecurity responsibilities.