Why do dictionary attacks still succeed against well-run organisations?

Why This Matters for Security Teams

Dictionary attacks still work because they target the gap between what organisations assume about password hygiene and what actually happens at the edge of identity systems. Attackers do not need to crack strong cryptography when they can test common passwords, reused credentials, and predictable variations at scale. That matters even in mature environments with MFA, because stolen passwords remain useful for account takeover, password spraying, and noisy-but-low-rate authentication abuse that blends into legitimate traffic.

The operational mistake is treating this as a user problem instead of an identity telemetry problem. Security teams often have policy language, lockout thresholds, and periodic awareness training, but no reliable correlation across failed logins, unusual source patterns, or cross-account attempts. NIST guidance on access control and authentication remains relevant here, but the practical issue is that defenders need detection logic that understands attempt patterns, not just event counts. NHIMG research on the State of Secrets in AppSec shows how confidence often exceeds reality in adjacent identity hygiene areas, which is why password risk is frequently underestimated too.

In practice, many security teams encounter the blast radius only after a valid account has already been used for access, rather than through intentional early detection of spraying and reuse.

How It Works in Practice

Dictionary attacks succeed when the attacker can search the most likely password space faster than defenders can separate malicious attempts from normal user error. The technique is simple: harvest likely passwords from breaches, company naming conventions, seasons, keyboard patterns, and credential dumps, then try them against many accounts or many passwords against one account. The attack often stays below single-account lockout thresholds and spreads attempts across time, IP ranges, or services to avoid obvious spikes.

Good defence requires layered controls rather than a single threshold. That usually means MFA, but also breached-password screening at creation and reset time, rate limiting that considers source reputation and account targeting, and alerting that correlates across identities, applications, and geographies. NIST SP 800-53 Rev. 5 emphasises authentication and access control discipline, while MITRE ATT&CK helps teams map the observable techniques used in credential abuse. For broader identity risk context, NHIMG’s 52 NHI Breaches Analysis is useful for understanding how weak identity handling tends to compound once an attacker lands inside a trusted environment.

• Block known breached passwords at set, reset, and recovery points.
• Correlate failed logins across users, applications, and distributed sources.
• Use adaptive controls for repeated attempts, not only hard lockouts.
• Prioritise MFA resistant to replay and phishing when feasible.
• Review authentication telemetry for spraying, reuse, and password reset abuse.

These controls tend to break down in federated environments with inconsistent logging and delegated authentication because defenders lose the cross-system visibility needed to distinguish spraying from routine login failure.

Common Variations and Edge Cases

Tighter login controls often increase user friction and support overhead, so organisations must balance resilience against recovery burden. That tradeoff becomes sharper where business users travel, share devices, or depend on legacy applications that cannot support modern MFA consistently.

Some environments are especially prone to dictionary attack success. Legacy VPNs, externally exposed remote access portals, and consumer-facing applications with weak password policy enforcement often provide the easiest entry points. There is also no universal standard for lockout tuning yet: best practice is evolving toward adaptive controls that account for risk, rather than fixed thresholds that attackers can learn to stay under. CISA advisories and the MITRE ATT&CK Enterprise Matrix both show that credential abuse remains a common pathway because it is cheap, scalable, and difficult to spot early. NHIMG’s Top 10 NHI Issues also reinforces a broader pattern: once identity hygiene is weak, attackers rarely stop at the first account.

Dictionary attacks are most persistent where password reuse is high, logging is fragmented, and response remains manual. In those cases, the organisation may look well run on paper while still being easy to probe in practice.

Related resources from NHI Mgmt Group

• Why do business email compromise attacks succeed even in well-run organisations?
• Why do social engineering attacks still succeed in well-defended organisations?
• Why do AI-driven phishing attacks still succeed when organisations use modern authentication?
• Why do credential stuffing attacks still succeed against consumer identity systems?