What Is Password Spraying?
Password spraying tests common passwords across many accounts to avoid lockouts. Learn how it works, why MFA stops it, and what PE due diligence should assess.
How Password Spraying Works
Password spraying attacks are designed around a specific constraint of enterprise security: most organizations lock accounts after a defined number of failed login attempts — typically 5-10 within a short window. This lockout policy, designed to prevent brute force attacks, creates an exploitable opportunity for a different attack. By trying only one or two passwords per account across many accounts, the attacker stays below the lockout threshold on every account while systematically testing the entire organization's authentication surface.
The mechanics are straightforward. The attacker obtains a list of valid usernames for the target organization — often trivially available from LinkedIn, company directories, or email format conventions (first.last@company.com). They select one or two candidate passwords — typically seasonal patterns like 'Winter2026!', 'Company2026', 'Welcome1', or the company name combined with a year and special character. They attempt authentication with each username using the candidate password, spacing requests to avoid detection by rate limiting or anomaly detection systems. They move on to a new candidate password and repeat.
The technique is remarkably effective because it exploits two genuine human behaviors: people choose predictable passwords that meet complexity requirements, and many people use the same password patterns across their accounts. In any large organization, some percentage of employees will have chosen 'Summer2026!' or 'CompanyName1!' as their current password. The question is not whether the password exists in the user population — it is how quickly the attacker finds who uses it.
Why Standard Defenses Miss Password Spraying
Account lockout policies do not stop password spraying — they are specifically designed to circumvent them. Perimeter defenses do not see the attack until authentication is attempted. Traditional failed login monitoring focuses on repeated failures against a single account — password spraying generates only one or two failures per account, which is below detection thresholds designed to catch brute force attacks.
Detecting password spraying requires behavioral analytics that look across accounts rather than per-account: an unusual number of authentication attempts across many accounts within a time window, authentication attempts using a small number of passwords across the user population, authentication from unusual source addresses or geographies affecting multiple accounts simultaneously. These cross-account patterns are invisible to per-account monitoring and require SIEM or identity analytics tooling to detect.
Defending Against Password Spraying
Multi-factor authentication is the most effective technical control against password spraying. An attacker who discovers a valid username-password combination through password spraying cannot complete authentication without the second factor. MFA does not prevent the credential discovery — the attacker now knows a valid password — but it prevents the credential from being usable for account compromise.
Banned password lists that prohibit the most commonly used passwords — including seasonal patterns, company name combinations, and the top 100 most commonly sprayed passwords — directly reduce the attack's success rate. Microsoft Entra ID, Okta, and other identity providers support banned password lists that can be configured to reject these predictable patterns at the point of password creation.
Identity threat detection tools that analyze authentication patterns across the user population — flagging unusual numbers of failed authentications spread across many accounts within a time window — are the detection control that catches password spraying in progress. These tools are typically delivered as part of identity security platforms or SIEM with appropriate correlation rules.
Password Spraying in PE Due Diligence
For PE due diligence, password spraying exposure is assessed through identity security posture: Is MFA deployed universally? Are banned password lists configured? Is there monitoring for cross-account authentication anomalies? Organizations without universal MFA and banned password configuration have an authentication surface that is systematically testable by password spraying — and the attack will find valid credentials in any organization with more than a few hundred accounts.
Related Reading
What is password spraying?
Password spraying is an authentication attack that tests a small number of common passwords against many user accounts, staying below account lockout thresholds on any individual account. It exploits the predictability of human password choices — in any large organization, some percentage of employees will have chosen a commonly sprayed password like a seasonal pattern or company name combination.
How is password spraying different from brute force?
Brute force attacks test many passwords against one account, eventually triggering account lockout. Password spraying tests one or two passwords against many accounts, staying below the lockout threshold on each. Password spraying is specifically designed to exploit account lockout policies that are intended to prevent brute force attacks.
How is password spraying different from credential stuffing?
Credential stuffing uses known username-password pairs from breach databases — testing specific credentials that were previously compromised elsewhere. Password spraying uses guessed passwords — common patterns applied to valid usernames. Both are authentication attacks, but credential stuffing requires breach data while password spraying requires only valid usernames and knowledge of common password patterns.
What passwords do attackers typically spray?
The most commonly sprayed passwords follow predictable patterns: seasonal combinations (Winter2026!, Summer2026), company name + year + special character (CompanyName2026!), simple corporate defaults (Welcome1, Password1), and passwords that meet typical complexity requirements (one uppercase, one number, one special character) in the most obvious ways. Banned password lists can prohibit these patterns at creation time.
Does MFA stop password spraying?
MFA does not prevent password spraying from finding a valid password — the attacker still discovers which credential combination works. But MFA prevents that credential from being used to compromise the account — the attacker cannot complete authentication without the second factor. MFA is the most effective defensive control against password spraying because it renders successful credential discovery operationally useless.
SolarWinds: Password Spraying as Initial Reconnaissance
Post-incident analysis of the SolarWinds breach found evidence that attackers had conducted password spraying against SolarWinds infrastructure before deploying the Sunburst backdoor. The password spraying was reconnaissance — probing the authentication surface to identify usable credentials that could be used to access development systems and understand the build environment. The SolarWinds case illustrates how password spraying fits into sophisticated attack chains: it is not always the direct access vector, but it provides credential intelligence that supports later stages of an attack. Organizations with universal MFA close this reconnaissance avenue because discovered credentials cannot be used for access regardless of password validity.
enterprise accounts are estimated to be vulnerable to password spraying at any given time due to predictable password patterns, according to Microsoft Entra ID telemetry analysis. In an organization with 500 employees, that means approximately 100 accounts are discoverable through password spraying alone — without any breach database, without any technical exploit.