Password spraying shows why login hardening still matters in IAM

At a glance

What this is: This analysis argues that password spraying remains a dominant identity attack path because attackers exploit weak, reused, and compromised credentials instead of forcing technical breaks.

Why it matters: It matters because IAM teams still have to secure password-based access paths while they move toward passwordless controls, or attackers will keep using the weakest login boundary.

Context

Password spraying is a low-and-slow login attack that tests common passwords across many accounts while staying below lockout thresholds. It succeeds because many identity programmes still depend on passwords, legacy applications, VPN access, and hybrid directories.

For IAM teams, the governance problem is not the existence of passwordless as a destination. It is the operational gap between that destination and the current reality of password-based authentication, where weak policy enforcement creates the attack surface attackers actually use.

Key questions

Q: How should security teams defend against password spraying in hybrid identity environments?

A: Start with MFA on every internet-facing authentication path, then remove weak password acceptance wherever possible. Reduce exposed login surfaces by retiring unused tenants and legacy access points. Finally, centralise identity logs so repeated low-frequency failures across many accounts can be correlated before an attacker finds a valid login.

Q: Why do password spraying attacks keep working in IAM programmes?

A: They keep working because many organisations still depend on passwords, and attackers only need one valid login from a reused or weak credential. Lockout thresholds, legacy apps, and incomplete password hygiene create enough surface area for low-and-slow abuse.

Q: What are the signs that password spraying or brute force attacks are in progress?

A: Common signs include unusual login patterns, repeated failed authentications across many accounts, spikes in access attempts from suspicious sources, and log activity that shows the same password or automation pattern being tried broadly. In a mature environment, early indicators often appear in access logs before a breach, so continuous monitoring and regular audit review are essential.

Q: Should organisations prioritise passwordless or privileged access modernisation first?

A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.

Technical breakdown

Why password spraying bypasses weak login controls

Password spraying works by spreading a small number of password guesses across many accounts instead of hammering one account until it locks. That keeps the activity below basic threshold-based detection and avoids the noisy patterns defenders expect from brute force. The attack depends on credential hygiene failure, not technical sophistication. If users reuse passwords or choose predictable variants, the attacker needs only one successful login to start a broader intrusion path.

Practical implication: enforce strong password policy and compromised-password blocking at the point of credential creation.

How compromised credentials turn a login into persistence

Once an attacker logs in with a valid account, the security problem changes from authentication failure to session and privilege abuse. A low-privilege account can still provide a foothold for discovery, lateral movement, and privilege escalation if access paths are too broad or poorly segmented. The article’s point is that defenders should not treat a successful password spray as a minor login event. It is often the first stage of a longer identity-led intrusion.

Practical implication: correlate failed login patterns with post-login behaviour to detect early-stage compromise.

Why passwordless does not eliminate today’s attack surface

Passwordless methods such as FIDO2 and Windows Hello reduce reliance on passwords, but most organisations still run hybrid environments with legacy apps, service accounts, and users who need password-based access. That means the password attack surface persists during transformation. The control question is not whether passwordless is desirable. It is whether current login paths are hardened enough to survive the transition period.

Practical implication: treat passwordless as a roadmap while continuing to harden existing authentication paths.

Threat narrative

Attacker objective: The attacker wants a quiet, valid login that can be used as a foothold for broader identity compromise and operational expansion.

1. Entry occurs through password spraying, where the attacker tests common passwords across many accounts while staying under lockout thresholds.
2. Credential access succeeds when one reused or weak password matches an active account and the attacker obtains a valid login session.
3. Escalation follows if the compromised account reveals additional access paths, allowing discovery, lateral movement, or privilege escalation.
4. Impact is achieved when the attacker turns a single successful login into broader environment access and persistence.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password hardening remains a front-line identity control, not a legacy inconvenience. Password spraying is effective because organisations still leave human login paths exposed to guessable credentials, password reuse, and uneven policy enforcement. That makes login hardening a live IAM control issue, not a transitional inconvenience on the way to passwordless. The practitioner conclusion is simple: authentication hygiene still carries direct risk-reduction value.

The passwordless roadmap does not erase the current credential problem. Hybrid directories, VPN dependencies, and older applications keep password-based access in the environment long after modernisation begins. The governance mistake is to treat the destination as evidence that the journey no longer needs control. Practitioners should read this as a sequencing problem: the current state still needs enforcement even if the end state is better.

Weak-password exposure is an identity governance failure, not just a user-behaviour issue. When organisations allow weak, reused, or compromised credentials into Active Directory or Entra ID, they are accepting avoidable authentication debt. The named concept here is login hardening gap: the distance between passwordless ambition and the controls still required to make existing logins defensible. The practitioner conclusion is to govern the gap explicitly.

Detection alone is insufficient when the attack is designed to look normal. Password spraying is intentionally quiet, so EDR, SIEM, and incident response often enter after the attacker has already authenticated. That shifts the control objective toward preventing weak credential acceptance rather than relying on after-the-fact visibility. The practitioner conclusion is to move enforcement left, to the point of password creation and validation.

The identity control model must assume attackers will always test the easiest door first. Microsoft’s reported pattern shows that adversaries continue to prefer the path of least resistance, which is valid login rather than exploit development. That should push IAM leaders to prioritise authentication policy, compromised-password rejection, and legacy path hardening as baseline governance, not optional enhancement. The practitioner conclusion is to harden the easiest door before assuming the rest of the house is safe.

What this signals

Login hardening is the immediate control gap. Passwordless programmes are strategically correct, but most organisations still live in a hybrid state where passwords, legacy applications, and service dependencies remain active. That means authentication policy has to be enforced against the environment that exists, not the one in the roadmap.

Compromised-password rejection is now a baseline governance requirement. When attackers succeed by guessing at scale, the control boundary is not the perimeter but the password acceptance point. Practitioners should treat password validation, legacy path hardening, and lockout tuning as part of core IAM hygiene rather than exceptional remediation.

For practitioners

• Block compromised passwords at creation time Reject passwords that appear in known breach corpora or meet weak-pattern criteria before they are accepted by Active Directory or hybrid identity systems.
• Harden legacy authentication paths Review VPNs, legacy applications, and hybrid directory integrations that still rely on passwords and apply stronger policy enforcement where passwordless is not yet available.
• Tune detection for quiet login abuse Look for distributed failed logins across many accounts, repeated low-and-slow attempts, and successful authentication followed by unusual post-login activity.
• Treat passwordless as a transition plan Track where passwords remain mandatory, assign control owners for each path, and keep password policy enforcement active until those dependencies are retired.

Key takeaways

• Password spraying stays effective because organisations still allow weak, reused, or compromised credentials to exist in active login paths.
• The article’s evidence points to a simple reality: attackers keep choosing quiet authentication abuse because it is reliable and scalable.
• IAM teams should harden current password-based access while they continue the move toward passwordless authentication.

Key terms

• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Compromised Password: A compromised password is a credential that has been exposed, stolen, guessed, or otherwise placed at risk and should no longer be trusted. In practice, it requires immediate reset, review of related accounts, and verification that no unauthorized access occurred before the change was made.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Hybrid Identity Environment: An environment where cloud identity services and on-premises directories, applications, and controls must work together. This arrangement increases complexity because access paths, trust boundaries, and remediation workflows are spread across systems with different assumptions and operating models.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.