Largest Study of its Kind Shows Outdated Password Practices are Widespread

It is possible that you have a bad infosec team; however, it is more likely that they need to meet outdated compliance goals (SOC 2 comes to mind here).

Infosec is unfortunately a tricky balancing act of compliance, security, and usability.