A new study recently published by the digital identity firm Beyond Identity contains a number of surprises relating to passwords and password security. This is information that IT professionals and small or medium-sized business owners should be aware of.

While it is not a rigorous and scientific study the results of the company’s survey are beyond surprising.

Here’s a quick overview:

First fully one in ten people surveyed felt confident that they could guess a co-worker’s password by browsing through their social media accounts. Second and nearly as surprising is the fact that just over half of those surveyed (50.1 percent) share at least some of their passwords with others with video streaming accounts leading the pack here.

Nearly as many people (44.9 percent) share passwords to their music streaming platforms. The thing that is somewhat disturbing about this is that more than one in four of those surveyed (25.7 percent) share their banking passwords.

A surprising percentage of people (22 percent) try at least occasionally to guess a co-worker’s password. Nearly as many people (19.9 percent) try to guess their boss’ password.

When these attempts are made 39.2 percent of the time the person attempting the guess uses personal information they know about the person. In addition 18.4 percent of the time the person attempting to guess will check the other person’s social media pages and use the information there to inform their password guesses.

43.7 percent of these attempts are made to try and get into the target’s email system while 32.6 percent are attempts to guess phone passwords.

We find these statistics to be as stunning as they are illuminating and they serve to highlight areas of weaknesses that likely exist in your own organization.

The good news is that there are a number of easy things you can do to better secure your passwords including the use of two-factor authentication and strong password generation apps. You should absolutely take steps like these because as this report shows your passwords probably aren’t nearly as secure as you imagine them to be.