Dictionary Attack

A dictionary attack is a password guessing method that tests common words, phrases, and known password variants against a login system. Attackers use precompiled wordlists rather than random character combinations, which makes the technique efficient against human chosen passwords and reused credentials.

Expanded Definition

A dictionary attack is a credential guessing method that starts with likely passwords, not random brute force. In NHI security, the same approach is used against service accounts, API keys, and token-derived login paths when attackers know human operators reused weak secrets or built predictable naming patterns. The term overlaps with brute force, but the distinction matters: brute force explores all combinations, while a dictionary attack leverages likely values, seasonal words, leaked passwords, and common substitutions. This makes it highly effective when secrets are human chosen, recycled across systems, or stored in places that reveal structure such as code repositories and CI/CD variables. Definitions vary across vendors on whether targeted password spray and dictionary attack should be treated as separate techniques, but operationally both depend on weak secret hygiene and poor detection. For background on the broader NHI risk surface, see Ultimate Guide to NHIs — Key Challenges and Risks and the MITRE ATT&CK Enterprise Matrix. The most common misapplication is calling any repeated login failure a dictionary attack, which occurs when rate-limited password spraying or simple user error is mistaken for wordlist-driven guessing.

Examples and Use Cases

Implementing strong detection for dictionary attacks often introduces more false positives, requiring organisations to weigh tighter access controls against user friction and analyst workload.

• An attacker tests a breached password list against cloud console logins, looking for reused passwords tied to service owners and platform admins.
• A malicious actor targets an internal application with common password variants that match the organisation’s naming conventions, such as season-based changes or appended years.
• A compromised NHI secret is paired with a wordlist-driven attempt against a basic auth endpoint, especially where secrets were embedded in scripts or copied into tickets. See the 52 NHI Breaches Analysis for recurring exposure patterns.
• Security teams simulate dictionary attack resistance by testing against weak passwords and exposed service credentials, using guidance from CISA cyber threat advisories and internal detection rules.
• Analysts distinguish dictionary attacks from credential stuffing by checking whether the attempt set is curated around likely values or assembled from prior breaches and wordlists.

For related NHI governance context, the Top 10 NHI Issues highlights how secret reuse and weak rotation fuel this attack path.

Why It Matters in NHI Security

Dictionary attacks matter because NHIs rarely fail like humans do. They often fail silently through reused passwords, exposed API credentials, and long-lived tokens that remain valid after disclosure. NHIMG research shows that 91.6% of secrets remain valid five days after notification, which gives attackers ample time to cycle through likely guesses, pivot into systems, and find privileged access paths. That risk is amplified when 97% of NHIs carry excessive privileges and 96% of organisations store secrets outside secrets managers in vulnerable locations including code, config files, and CI/CD tools, as noted in the Ultimate Guide to NHIs — Key Challenges and Risks. A wordlist attack against a service account is not just an authentication problem; it is often a governance failure involving rotation, offboarding, and secret sprawl. NIST guidance on authentication controls in NIST SP 800-53 Rev 5 Security and Privacy Controls supports stronger password and access management practices. Organisations typically encounter the real cost only after a credential is abused in production, at which point dictionary attack resistance becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Hybrid Dictionary Attack
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?