Does account lockout stop password spraying?

Per-user lockout helps against brute force on one account, but password spraying spreads one or two guesses across thousands of users. No single account hits the lockout threshold, so the attack continues quietly. Pair lockout with MFA, impossible-travel alerts, and detection on many failed logins across the tenant.

What passwords do sprayers try first?

Attackers favor common seasonal phrases, keyboard walks like qwerty123, and the company name plus digits or exclamation marks. Breached password lists from other sites are also sprayed because people reuse credentials. Blocking known compromised passwords closes a large share of successful sprays.

What is the best control against password spraying?

Phishing-resistant multifactor authentication on human and shared accounts is the strongest single step. Disable legacy authentication protocols where your identity provider allows it. Complement MFA with unified logging, geo anomalies, and rate limits on authentication endpoints exposed to the internet.

How is spraying different from credential stuffing?

Credential stuffing replays username and password pairs stolen from other breaches at scale. Password spraying tries a small set of common passwords against many accounts to avoid lockouts. Both target reused passwords, but spraying spreads attempts thinly while stuffing hits each account with known leaked pairs.

What is Password Spraying?

Abisola | Feb 13, 2026

Password spraying is a password-guessing tactic where the attacker tries one or a few common passwords against many accounts. They stay under per-account lockout thresholds by not hammering the same username repeatedly. It is a horizontal attack: one weak password, thousands of users.

How spraying differs from other attacks

Classic brute force throws many passwords at one account. Credential stuffing reuses leaked pairs from other sites. Spraying picks likely passwords (“SeasonYear”, company name plus digit, default onboarding passwords) and walks the user list once per password, often slowly and from many IPs.

Cloud identity (email, SSO, remote access) is a frequent target because one success yields mailboxes, file shares, and downstream SaaS resets.

Execution pattern

Attackers harvest usernames from directories, prior leaks, or predictable formats. They run automated login attempts with pauses and distributed infrastructure so alarms stay quiet. After hours or days they rotate to the next password in a short list.

Why operations and marketing security teams care

A single compromised mailbox can authorize fraudulent payments, reset ad accounts, or exfiltrate CRM exports. That can increase ad fraud risk through changed billing contacts or malicious tracking. MFA and modern auth policies block most spray successes, but legacy protocols and shared mailboxes still slip through.

Monitoring should correlate many light failures across users. Pair identity hardening with awareness of remote access abuse paths described in VPN and perimeter guides, and with bot-driven login noise. Small businesses are common victims because spray tools scan the whole internet. Brands should inventory which SaaS apps allow legacy IMAP or SMTP logins and disable them where possible.

For related reading on volume attacks, see how to stop bot attacks and tools that centralize auth logging.

Frequently Asked Questions

Does account lockout stop password spraying?
Per-user lockout helps against brute force on one account, but password spraying spreads one or two guesses across thousands of users. No single account hits the lockout threshold, so the attack continues quietly. Pair lockout with MFA, impossible-travel alerts, and detection on many failed logins across the tenant.
What passwords do sprayers try first?
Attackers favor common seasonal phrases, keyboard walks like qwerty123, and the company name plus digits or exclamation marks. Breached password lists from other sites are also sprayed because people reuse credentials. Blocking known compromised passwords closes a large share of successful sprays.
What is the best control against password spraying?
Phishing-resistant multifactor authentication on human and shared accounts is the strongest single step. Disable legacy authentication protocols where your identity provider allows it. Complement MFA with unified logging, geo anomalies, and rate limits on authentication endpoints exposed to the internet.
How is spraying different from credential stuffing?
Credential stuffing replays username and password pairs stolen from other breaches at scale. Password spraying tries a small set of common passwords against many accounts to avoid lockouts. Both target reused passwords, but spraying spreads attempts thinly while stuffing hits each account with known leaked pairs.

Abisola

Abisola handles content and support at ClickPatrol. She helps customers get more value from cleaner traffic data and writes practical resources about ad fraud, fake traffic, and smarter PPC decisions.