You might think IT administrators would know better, but a new study shows that the password “admin” is still popular.

While it’s important to properly secure IT portals, security researchers at Outpost24 have still discovered many weak, predictable passwords. A survey of 1.8 million IT portal accounts shows that more than 40,000 use the password “admin”. The rest of the top 20 is just as dramatic.

Researchers analyzed data from January to September within Threat Compass, a threat intelligence platform from Outpost24, about malware that steals information such as usernames and passwords. Fortunately, the data collected was not plain text, but researchers say many of the items on the list were easy to crack using a simple password guessing attack.

An admin portal often includes access to configurations, accounts, and security settings. You can also track potential customers and orders, or read, create, or delete items in databases.

It goes without saying that a long, strong and unique password is always the best option. Other tips they offer include staying away from cracked software, double-checking domain routings, saving passwords, and disabling autofill in web browsers. And install an EDR solution.