Attack that tries a few common passwords against many accounts to avoid triggering lockouts.
Password spraying reverses the typical brute force approach—instead of trying many passwords against one account, it tries a few common passwords against many accounts. This avoids account lockout thresholds while exploiting the statistical likelihood that some users have weak passwords. Attackers test passwords like 'Summer2024!' or 'CompanyName1' across all discoverable accounts. A single success provides access. Password spraying is particularly effective against organisations without MFA.
Why It Matters
The DSC Perspective:
Password spraying defeats account lockout policies. Even with lockouts configured, if any user has a weak password, attackers get in. Strong password policies, banned password lists, and MFA are essential defences.