Home › Resources › Password Spraying

Executive Summary

Password spraying flips the usual guessing attack around. Instead of trying many passwords against one account, an attacker tries one or a few very common passwords against a large list of accounts. By using only a handful of attempts per account, the attacker stays below lockout thresholds and can quietly find the few users who chose a weak, popular password.

What It Is

Password spraying is a low and slow account takeover technique. Traditional guessing hammers a single account with many passwords, which quickly triggers lockout. Spraying inverts this. The attacker selects a small set of the most common passwords, then tries each one against a broad list of usernames, waiting between rounds so no single account accumulates enough failures to lock. The attacker only needs a small percentage of users to have chosen a weak password for the campaign to succeed. Corporate directories, cloud email portals, and single sign on gateways are frequent targets because their usernames are often predictable from public information.

Why It Matters

Spraying is dangerous precisely because it is quiet and evades the classic defense of account lockout. It exploits the reality that in any large population of users, some will choose a password from the tiny set of extremely common ones. A single compromised corporate account can open email, internal systems, and a path to deeper intrusion. Because the attack spreads thinly across many accounts, it can slip past controls tuned to catch repeated failures on one account. For a professional, understanding spraying is key to configuring detection that watches across accounts, not just per account, and to justifying MFA and breached password screening.

How It Works

The attacker first gathers or guesses a list of valid usernames, often derived from a predictable email format and public directories. They then choose a few passwords that are statistically common or seasonally likely, and attempt each password once across the whole username list before moving to the next password and pausing between rounds. Because each account sees only one or two failures at a time, lockout thresholds tuned to single account behavior do not trigger. Detection therefore has to correlate failures across many accounts from the same source or the same password, look for a low steady rate of failures organization wide, and require MFA so even a correct guess does not grant access.

Architecture Diagram

Visual Workflow

Common Attacks

• Spraying seasonal or company themed passwords against corporate directories
• Targeting cloud email and single sign on portals with predictable usernames
• Timing attempts to stay under per account lockout thresholds
• Using distributed sources so the traffic does not cluster on one address
• Combining a captured password with real time phishing of the second factor

Common Mistakes

• Tuning detection only per account and missing the cross account pattern
• Allowing users to set extremely common or seasonal passwords
• Relying on lockout alone, which spraying is specifically designed to evade
• Leaving legacy protocols enabled that bypass modern MFA on portals
• Publishing predictable username formats without compensating controls

Best Practices

• Require MFA so a correctly sprayed password still cannot complete login
• Screen and block common and breached passwords at the point of creation
• Monitor for a low steady rate of failures spread across many accounts
• Correlate failures by source and by password, not just per account
• Disable legacy authentication protocols that bypass MFA
• Alert on any successful login that follows a spray pattern

Quick Checklist

• MFA enforced on all externally reachable logins
• Common and breached passwords blocked at creation
• Cross account failure correlation and alerting configured
• Legacy authentication protocols disabled
• Detection tuned for low, distributed failure rates
• Playbook to force resets after a detected spray

Recommended Tools

Industry Standards

Career Relevance

Password spraying is a staple of security operations and identity defense. SOC analysts build detections that correlate failures across the whole directory; IAM and security engineers enforce MFA, block weak passwords, and disable legacy protocols; and GRC analysts assess whether authentication controls meet framework expectations. The ability to explain why per account lockout is not enough, and how cross account detection works, is a valuable skill for the roles AI-Governance-Jobs.com serves.

Interview Questions

• How does password spraying differ from a brute force attack on one account?
• Why does password spraying evade traditional account lockout?
• What detection strategy catches spraying that per account monitoring misses?
• Why does disabling legacy authentication protocols matter against spraying?
• How does MFA defend against a successfully sprayed password?

Related Certifications

Further Reading

• NIST SP 800-63B Digital Identity Guidelines
• CISA: More Than a Password
• OWASP Authentication Cheat Sheet

FAQ