You are auditing the security of a client company. You find that their password policy only requires a minimum of 5 characters with letters and numbers. What, if anything, is wrong with this policy?

NIST SP 800-63B recommends a minimum of 8 characters, and many modern standards require 12 or more - a 5-character minimum is trivially brute-forced. Additionally, restricting character sets to only letters and numbers dramatically reduces the total number of possible combinations compared to including special characters, compounding the weakness and leaving accounts highly vulnerable.

A 5-character alphanumeric minimum provides far too little entropy to resist modern brute-force or dictionary attacks and fails basic industry security standards.

Increasing the minimum to 6 characters still falls well short of the 8-character recommended baseline and still lacks special character requirements, so it does not resolve all of the policy's flaws.

While requiring symbols would improve complexity, the critically short 5-character minimum length is an equally serious independent flaw, meaning the policy has more than one problem that must be corrected.