260
Largest Study of its Kind Shows Outdated Password Practices are Widespread
(www.cc.gatech.edu)
This is a most excellent place for technology news and articles.
It is possible that you have a bad infosec team; however, it is more likely that they need to meet outdated compliance goals (SOC 2 comes to mind here).
Infosec is unfortunately a tricky balancing act of compliance, security, and usability.