At my job, we have to update passwords every three months. I notice people pick easy to guess passwords because of this. Why do companies still use this method if it causes issues?