When I was promoted to the head of cybersecurity for a particular finance company, I enforced a lot of quite unpopular changes to improve security. One of the most unpopular changes I made was force-updating the password to nationally-sensitive financial systems from "Password1".