Topic starter
24/06/2026 7:28 pm
TL;DR: Microsoft’s latest Digital Defense Report says 97% of identity attacks are password spray attacks, underscoring how often attackers still win by logging in rather than breaking in, according to Netwrix’s analysis of the report. The practical lesson is that passwordless ambitions do not remove the need to harden today’s authentication paths and block weak, reused, and compromised credentials.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Password spraying: 97% of attacks donât hackâthey just log in”.
Key questions
Q: How should security teams defend against password spraying in hybrid identity environments?
A: Start with MFA on every internet-facing authentication path, then remove weak password acceptance wherever possible.
Q: Why do password spraying attacks keep working in IAM programmes?
A: They keep working because many organisations still depend on passwords, and attackers only need one valid login from a reused or weak credential.
Q: What are the signs that password spraying or brute force attacks are in progress?
A: Common signs include unusual login patterns, repeated failed authentications across many accounts, spikes in access attempts from suspicious sources, and log activity that shows the same password or automation pattern being tried broadly.
Practitioner guidance
- Block compromised passwords at creation time Reject passwords that appear in known breach corpora or meet weak-pattern criteria before they are accepted by Active Directory or hybrid identity systems.
- Harden legacy authentication paths Review VPNs, legacy applications, and hybrid directory integrations that still rely on passwords and apply stronger policy enforcement where passwordless is not yet available.
- Tune detection for quiet login abuse Look for distributed failed logins across many accounts, repeated low-and-slow attempts, and successful authentication followed by unusual post-login activity.
Bottom line: Password spraying stays effective because organisations still allow weak, reused, or compromised credentials to exist in active login paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:46 am
Password hardening remains a front-line identity control, not a legacy inconvenience. Password spraying is effective because organisations still leave human login paths exposed to guessable credentials, password reuse, and uneven policy enforcement. That makes login hardening a live IAM control issue, not a transitional inconvenience on the way to passwordless. The practitioner conclusion is simple: authentication hygiene still carries direct risk-reduction value.
A question worth separating out:
Q: Should organisations prioritise passwordless or privileged access modernisation first?
A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.
👉 Read our full editorial: Password spraying shows why login hardening still matters in IAM