Without going into specifics obviously, generally, how are passwords handled in your workplace?

Asking because a while back my business started handling IT for some local businesses and we noticed it was so poorly handled that some of their clients would get emails from their official gmail account asking for money to be transferred to certain accounts. They suffered other types of attacks such as phishing attempts as well and for the most part, client and suppliers would be savvy enough to call in first when they got peculiar emails.

Just wondering whether this is an unexploited business opportunity or whether someone is already handling this using software; more so for the millions of small businesses that have staff of more than 10 people and it becomes unmanageable for them.