The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess