CyberGlossary

Attacks & Threats

Password Spraying

Also known as: Low-and-slow guessing

Definition

A low-and-slow attack that tries a small set of common passwords against many user accounts, staying under lockout and rate-limit thresholds.

Password spraying inverts the classical brute-force pattern: instead of many passwords per account, attackers try one password (e.g. "Winter2025!", "P@ssw0rd") across an entire user directory and then move to the next. This avoids triggering per-account lockouts and produces hits because real organisations always contain a long tail of weak passwords. Spraying is a favourite technique for compromising cloud identity providers (Microsoft Entra ID, Okta) and VPN portals. Defences include banning common and breached passwords, smart-lockout and risk-based MFA, conditional access, geo/IP analytics, and alerting on high-fan-out, single-password authentication patterns.

Examples

  • An APT trying "Spring2025!" against every account in an Entra ID tenant during a single hour each day.
  • Bots cycling through seasonal passwords against a corporate SSL VPN to find weak users.

Related terms