Topic starter
02/02/2026 8:37 pm
TL;DR: Password spraying targets many accounts with common passwords to avoid lockouts, and the article shows how that pattern affects Active Directory, VPNs, Citrix gateways, and Entra ID tenants, according to Semperis. Weak passwords, missing MFA, and exposed internet-facing login paths keep making this attack practical.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Password Spraying Explained”.
Key questions
Q: How should security teams detect password spraying in Active Directory?
A: Security teams should detect password spraying by correlating low-volume login failures across many accounts, not just repeated failures on one user.
Q: Why do password spraying attacks evade common lockout controls?
A: Password spraying evades common lockout controls because each account receives only a few guesses, which keeps the attacker below per-account thresholds.
Q: What are the signs that password spraying is being missed?
A: Look for low-frequency authentication failures across many accounts, attempts against multiple internet-facing portals, and sign-in activity that comes from distributed sources rather than one source.
Practitioner guidance
- Enforce MFA on every internet-facing login portal Require MFA wherever a user can authenticate from outside the network, including VPNs, Citrix, RDP gateways, and cloud sign-in paths that federate to Active Directory or Entra ID.
- Harden password policy across the hybrid estate Set password controls so Active Directory and tenant authentication both reject weak, common, and compromised passwords, then verify that the policy applies consistently across all user paths.
- Retire unused tenants and exposed systems Decommission non-production Entra ID tenants and internet-facing systems that no longer serve a business function so they cannot be used as low-value entry points.
Bottom line: Password spraying succeeds when weak passwords, external login paths, and uneven MFA coverage line up across hybrid identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:21 pm
Hybrid identity turns password spraying into a boundary problem, not a password problem. The attack works because Active Directory, Entra ID, and internet-facing portals often share the same trust chain but not the same control posture. That means one weak authentication path can undermine the whole identity programme. Practitioners need to treat directory and cloud sign-in as one exposure surface, not two separate teams.
A question worth separating out:
Q: What should organisations do when password spraying is detected on internal accounts?
A: When password spraying is detected, organisations should force password resets for affected accounts, review authentication logs for successful compromises, and increase monitoring for repeat attempts. They should also notify users, enforce multi factor authentication where missing, and remove any shared or reused passwords from circulation. The goal is to close the initial access path and limit lateral access quickly.
👉 Read our full editorial: Password spraying in Active Directory and Entra ID: why controls fail