Password spraying
An attack that tries a few common passwords against many accounts, instead of many passwords against one. That way it avoids lockouts.
Full definition
Password spraying reverses the logic of brute force: instead of trying thousands of passwords against one account, it tries a few very common passwords against thousands of accounts. Because each account receives few attempts, the attack does not trigger automatic lockouts for failed logins.
It works because in almost every organization someone uses predictable passwords: the season plus the current year, the company name plus a number, keyboard patterns. The attacker obtains the user list from public sources or leaks and lets statistics do the work.
Defense involves policies that ban the most common passwords, multi-factor authentication on every exposed login, and monitoring for distributed attempt patterns, which are the signature of these campaigns.
Related terms
Brute force attack
Systematically trying password combinations until the right one is found. Its viability depends on password length and attempt limits.
Credential stuffing
Automated testing of credentials stolen from one service against many others. It works because people reuse passwords.
Multi-factor authentication (MFA)
Identity verification with two or more independent factors. It makes a stolen password insufficient, though not invulnerable.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.