During a penetration test for ABC Corp, you identified that the password policy allows users to set extremely common passwords and does not enforce password complexity. As part of your report to the company's management, which of the following recommendations would be MOST appropriate to address this vulnerability?
Advise the company to eliminate passwords entirely in favor of a physical token-based system.
Implement an account expiration policy that forces users to re-register every 90 days.
Limit the number of login attempts to three before locking out the user account.
Enforce password complexity requirements within the organization's password policy.
Increase the frequency of security monitoring to catch potential breaches.
Encourage the use of biometric authentication for all users to replace passwords.