What is password spraying in cybersecurity?

Password spraying is an attack where an adversary tries a small set of common passwords across many user accounts, pausing between rounds to stay below account lockout thresholds. It is used to gain unauthorized access without triggering the alerts that a traditional brute-force attack would cause.

How do I detect a password spraying attack?

Look for a pattern where many accounts each show one or two failed login attempts within a short time window, often from the same IP address or device. Identity Threat Detection and Response (ITDR) platforms automate this correlation across authentication logs.

Does MFA stop password spraying?

MFA prevents a successfully sprayed password from being used to log in, because the attacker still needs the second factor. It does not stop the spray attempt itself, so detection controls are still needed to identify that an attack occurred.

What is the difference between password spraying and credential stuffing?

Password spraying uses guessed common passwords tried against many accounts. Credential stuffing uses real username-password pairs stolen from previous data breaches. Both target many accounts, but the source of the credentials is different.

What is Password Spraying?

Password Spraying is an attack technique where an adversary tries a small number of commonly used passwords against a large number of accounts, cycling slowly enough to avoid triggering account lockout policies. It is used to gain initial access to corporate environments without raising the alarms that repeated failed logins on a single account would trigger.

What it is

Password spraying is a credential attack. Instead of guessing many passwords against one account (brute force), the attacker picks one or two common passwords, such as "Spring2024!" or "Welcome1", and tries them against every account in an organization. The attacker then waits before the next round, staying below the threshold that triggers lockouts.

The technique works because:

Many users choose predictable passwords that meet minimum complexity rules.
Lockout policies are usually per-account, not per-source-IP.
A single valid credential is enough to begin lateral movement.

Password spraying is a common first step in attacks targeting Active Directory, Microsoft 365, VPNs, and web-facing login portals.

Why it matters

A successful spray gives an attacker a foothold inside the identity layer. From there they can escalate privileges, access email, or pivot to other systems. Because only one or two failed attempts appear per account, the attack often goes undetected in standard authentication logs. Security teams that rely only on lockout alerts will miss it entirely.

How tools address it

Identity Threat Detection and Response (ITDR) platforms are the primary control. They correlate authentication events across all accounts and flag the pattern: many accounts each seeing one or two failures from the same source, in a short window. Specific capabilities include:

Baseline deviation detection: alerting when failed-login spread across accounts exceeds normal variance.
Source correlation: linking attempts from the same IP, ASN, or device fingerprint across accounts.
Device fingerprinting: identifying bots or scripted clients that cycle through accounts.

What is Password Spraying?

What it is

Why it matters

How tools address it

Common confusions

Identity Threat Detection and Response tools

Frequently asked questions