Password Spraying: Why It Slips Past Lockout Policies

Account lockout policies stop brute force. They don't stop password spraying, and that distinction is exactly why the technique remains one of the most consistently effective ways into an organization. A joint advisory covered by CISA describes the technique plainly: instead of guessing many passwords against one account (which trips a lockout fast), an attacker tries one or a few common passwords against many accounts, then waits and rotates to the next password, staying under each individual account's lockout threshold the entire time.

Why it works against organizations that "have MFA"

Password spraying doesn't need to compromise every account, it needs to compromise one account without MFA enforced, or one account where MFA can be bypassed or fatigued. Service accounts, shared mailboxes, legacy protocol endpoints (POP/IMAP/SMTP AUTH, which often can't support modern MFA at all), and accounts created outside a standard onboarding process are the accounts that consistently turn out to be the gap, not the well-managed primary user accounts a security review usually focuses on first.

What makes an organization vulnerable

• A seasonal or predictable password pattern across many accounts (Company2026!-style passwords are exactly what spraying is built to catch)
• Legacy authentication protocols left enabled, which frequently bypass Conditional Access and MFA policies entirely
• No Conditional Access policy blocking authentication from unexpected geographies or unfamiliar sign-in patterns
• Service and shared accounts excluded from MFA "because they can't support it", often true, but rarely mitigated with an equivalent compensating control
• No alerting on the specific pattern that distinguishes spraying from normal failed logins: many accounts, each failing once or twice, in a short window

Why this is different from a typical brute-force test

Testing for password spraying resistance is less about proving passwords can be cracked and more about proving the organization's detection and prevention catches the specific low-and-slow pattern real attackers use, not just a naive rapid-fire guessing attempt a lockout policy already stops. A test that only tries many passwords against one account and confirms lockout works has tested the wrong thing entirely.

What we check

• Whether legacy authentication protocols are genuinely disabled, not just deprecated in documentation
• Whether Conditional Access policies apply to every account type, including service and shared accounts, not just standard user sign-ins
• Password policy strength against exactly the patterns spraying exploits, seasonal, company-name-based, and default patterns
• Whether security monitoring actually distinguishes a spraying pattern from routine failed-login noise

This is core to how we scope Penetration Testing engagements involving Entra ID and Microsoft 365, and it's exactly the kind of gap our Microsoft 365 Assessment reviews directly in Conditional Access and legacy-auth configuration. For the broader set of techniques that chain with this one inside a real Active Directory environment, see our piece on Active Directory attack paths. For what happens once a sprayed password succeeds and hits an MFA prompt, see MFA bypass techniques we test for and credential stuffing and password reuse.