Say research is needed on using inline validation for password creation

src/patterns/passwords/index.md.njk

@@ -108,6 +108,10 @@ You shouldn’t use password reminders because they:
 
 ## Research on this pattern
 
-If you’ve used this pattern, get in touch to share your user research findings.
-
 [Read the National Cyber Security Centre’s guidance on passwords](https://www.ncsc.gov.uk/index/guidance?f%5B0%5D=field_topics%253Aname%3AIdentity%20and%20passwords).
+
+### Next steps
+
+More research is needed into whether using inline validation is a good way of helping users create secure passwords. 
+
+If you’ve used this pattern, get in touch to share your user research findings.