How Password Spray Attacks Bypass Lockouts and Compromise Enterprise Accounts

Password spraying is a cyberattack technique where criminals test a small set of commonly used passwords across a large number of user accounts, deliberately avoiding account lockout triggers. Unlike brute-force attacks that target a single account with many password attempts, spraying spreads low-frequency attempts across many accounts, making it far harder to detect. The method is particularly effective against cloud services, VPNs, Microsoft 365, and Single Sign-On platforms, which offer centralized access to multiple systems. Attackers exploit predictable human password habits — such as using seasons, company names, or keyboard patterns — and rely on publicly available lists of the most common passwords. Even a small success rate can be significant: in a 100,000-account organization, just 0.1% of weak passwords could hand attackers roughly 100 entry points into the network.