Why do passwords and password spraying create such a persistent identity risk in enterprise access environments?

Passwords remain attractive to attackers because they are reusable, widely understood, and often protected only by weak controls. Password spraying works by trying common passwords against many accounts, which helps attackers avoid lockouts and detection. Any environment that depends on shared patterns, legacy VPN access, or weak credential hygiene increases the chance that one successful guess becomes a broader compromise.

Why This Matters for Security Teams

password spraying persists because it targets the weakest assumption in enterprise identity: that a secret shared by many users can be defended with simple lockout thresholds and periodic resets. Attackers do not need to defeat encryption or exploit a zero-day when a small set of common passwords still works against a broad population. That makes the problem less about one bad password and more about how authentication is structured across VPNs, SaaS, and legacy applications.

This risk is amplified when identity programs still rely on reusable credentials instead of stronger controls such as phishing-resistant MFA, conditional access, and privileged access management. The NIST Cybersecurity Framework 2.0 treats identity protection as a core governance issue, not a point control, because repeated guessing attacks succeed when authentication policy, detection, and recovery are not aligned. NHI Management Group’s Top 10 NHI Issues also shows how credential sprawl and weak rotation create long-lived exposure across enterprise environments.

In practice, many security teams encounter password spraying only after a handful of low-signal logins has already opened the door to account takeover or lateral movement, rather than through intentional detection engineering.

How It Works in Practice

At a technical level, password spraying is effective because it inverts the defender’s assumptions. Instead of hammering one account until it locks, attackers try one or two common passwords across many accounts, often at low volume and spaced out over time. That approach blends into normal traffic, especially where users authenticate from diverse geographies, legacy remote access services, or multiple identity providers.

The practical defense is layered. First, organisations should reduce the value of passwords by requiring phishing-resistant MFA where possible and eliminating shared or reused credentials. Second, identity systems need better runtime signals: impossible travel, unusual user-agent patterns, unmanaged device access, and repeated failures across many principals. Third, privileged pathways should be isolated with OWASP Non-Human Identity Top 10-aligned controls when service accounts or automation are in scope, because the same weak password habits that affect humans often spill into machine access.

The strongest programs also pair detection with hygiene. NHI Management Group’s Ultimate Guide to NHIs notes that 71% of NHIs are not rotated within recommended time frames, which is a reminder that long-lived secrets create a broader blast radius when spraying succeeds elsewhere in the environment. Current guidance suggests tying rate limits, alerting, and access policy to the sensitivity of the application rather than treating every login as equally safe.

These controls tend to break down in legacy VPN environments and older web portals because they lack modern risk signals, enforce weak lockout logic, or cannot support contextual authentication without application changes.

Common Variations and Edge Cases

Tighter authentication controls often increase user friction and support overhead, so organisations have to balance usability against the reality that password-based access is already a high-risk control. There is no universal standard for every environment yet, especially where industrial systems, contractors, or third-party portals still depend on passwords.

One common edge case is break-glass and recovery access. These accounts are necessary, but if they are protected by the same password policy as ordinary users, they become ideal spraying targets. Another is service and automation access: even when the question is about human passwords, weak credential practices in scripts, CI/CD pipelines, and admin tools can give attackers a second path after a successful spray. That is why the 2024 ESG Report: Managing Non-Human Identities is relevant here: two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities.

Best practice is evolving toward layered identity resilience rather than “stronger passwords” alone. That means shorter-lived credentials, better anomaly detection, and privileged access reduction. Where organisations still rely on passwords, the real question is not whether spraying can be fully eliminated, but how quickly the environment can detect and contain the first successful guess.

For deeper incident patterns, the 52 NHI Breaches Analysis shows how credential exposure often becomes a broader identity event once attackers pivot beyond the initial login.

Related resources from NHI Mgmt Group

• Why do access keys create persistent identity risk in AWS environments?
• Why do passwords and OTPs create persistent risk in enterprise identity programmes?
• Why do password spraying attacks create outsized risk in federated identity environments?
• Why do complex education environments create more identity risk than simpler organisations?