Notifications
Clear all
Topic starter
12/07/2026 12:24 pm
TL;DR: Brute force attacks still succeed because weak passwords, credential reuse, password spraying, and authentication blind spots let automated login attempts scale faster than many controls can respond, according to SecurityScorecard. The practical lesson is that password policy alone is obsolete without MFA, rate limiting, non-interactive sign-in monitoring, and third-party visibility.
NHIMG editorial — based on content published by SecurityScorecard: What is a brute force attack and how attackers use password cracking methods
By the numbers:
- According to SecurityScorecard's 2025 Global Third-Party Breach Report, 35.5% of all data breaches now originate from third-party compromises, up from 29% the previous year.
Questions worth separating out
Q: What breaks when brute force protections do not cover every sign-in path?
A: Attackers exploit the weakest authentication route, not the strongest one.
Q: Why do reused passwords make brute force attacks more effective?
A: Reused passwords make brute force attacks more effective because one stolen credential pair can unlock multiple accounts, systems, or services.
Q: How should security teams detect password spraying in Active Directory?
A: Security teams should detect password spraying by correlating low-volume login failures across many accounts, not just repeated failures on one user.
Practitioner guidance
- Enforce password screening and minimum entropy rules Block common passwords, breached credential sets, and predictable variations during account creation and reset flows.
- Extend MFA to every authentication pathway Apply MFA policy to interactive logins, non-interactive sign-ins, and legacy protocols where possible.
- Monitor for spraying and stuffing patterns Alert on many failed logins across many accounts, attempts against non-existent usernames, and repeated access from unusual source networks.
What's in the full article
SecurityScorecard's full article covers the operational detail this post intentionally leaves for the source:
- Password cracking method comparisons, including simple, dictionary, hybrid, reverse, and credential stuffing attack patterns.
- Step-by-step prevention guidance for lockout policies, CAPTCHAs, rate limiting, and password manager adoption.
- Operational recommendations for disabling Basic Authentication and tightening conditional access across Microsoft 365 sign-ins.
- External attack-surface monitoring examples that show how brute force exposure appears from a defender's perspective.
👉 Read SecurityScorecard's analysis of brute force attack methods and defenses →
Brute force attack defenses: are your login controls keeping up?
Explore further
12/07/2026 12:37 pm
Credential abuse is now an identity governance problem, not a password problem. Brute force attacks work when organisations treat authentication as a user experience issue rather than a control plane. Weak passwords matter, but the real failure is allowing low-assurance credentials, reused passwords, and inconsistent policy enforcement across accounts and protocols. For IAM and PAM teams, the conclusion is straightforward: brute force defence belongs in governance, not just in helpdesk policy.
A question worth separating out:
Q: Who is accountable when third-party credentials are abused in a brute force attack?
A: Accountability usually sits with the organisation that owns the access decision, not just the vendor supplying the account. If vendor identities, OAuth grants, or shared service credentials are reachable without strong lifecycle control, the business has accepted that risk boundary. Governance should assign ownership for third-party authentication, offboarding, and monitoring so compromised access is not treated as someone else’s problem.
👉 Read our full editorial: Brute force attack defenses are failing where MFA and logging end
