They keep working because many organisations still depend on passwords, and attackers only need one valid login from a reused or weak credential. Lockout thresholds, legacy apps, and incomplete password hygiene create enough surface area for low-and-slow abuse.
Why password spraying stays effective in IAM programmes
password spraying keeps working because IAM often reduces the visible account surface without eliminating password dependence. Attackers exploit the smallest gap in the population: one reused password, one legacy protocol, one account that was never moved to stronger authentication. At scale, low-and-slow attempts can stay below noisy detection and lockout thresholds.
Spraying also benefits from the uneven maturity of IAM controls across applications and business units. A programme may be strong on central SSO while still carrying exceptions for older apps, break-glass access, service-adjacent accounts, or users who can still authenticate with passwords even when stronger options exist.
The practical issue is that password spraying is not a single control failure, it is the accumulation of weak assumptions. Where password policy, recovery flows, and monitoring do not move together, password security guidance becomes hard to enforce consistently across the estate.
Why lockouts, legacy access, and password reuse keep the door open
Lockout thresholds are meant to slow abuse, but attackers adapt by spreading attempts across many usernames and many tenants, making each try look ordinary. Legacy authentication paths create the other half of the problem, because they preserve password-based entry points even when the organisation believes modern controls are in place.
Password reuse makes the attack portable. If one password is valid anywhere, the attacker can test it across adjacent systems, accounts, or identity providers until one login succeeds. That is why IAM teams have to look at password spraying as a cross-system exposure, not just an MFA problem or a help desk problem.
For workforce environments, workforce identity security matters because recovery flows, federation, and session controls often determine whether a sprayed credential becomes real access. The same is true in broader IAM and IGA basics, where authentication policy, entitlement governance, and access review need to reinforce each other rather than operate as separate workstreams.
What effective defence looks like in practice
Effective defence starts by shrinking the password attack surface, not by tuning one more alert. The highest-value moves are phishing-resistant authentication for people, removal of weak or legacy auth paths, strong policy on failed attempts, and continuous review of accounts that still support password entry.
Detection also needs to reflect how spraying actually behaves. One failed login is rarely useful; repeated failures across many accounts, unusual geography, and bursts against older protocols or dormant accounts are the patterns that matter. Identity threat detection and response is especially relevant when the same credential misuse can become session theft, privilege escalation, or lateral movement after the first successful login.
Where the programme still depends on passwords, the control objective should be measurable: fewer accounts able to authenticate with only a password, fewer legacy protocols exposed, faster detection of distributed guessing, and shorter time from compromise signal to credential reset or access suspension.
Risk and Threat Considerations
Password spraying is attractive because it scales cheaply against organisations that have not fully removed password fallbacks. The attacker does not need high volume or technical novelty, only enough patience to avoid detection and enough coverage to find one weak or reused credential.
Failure mechanism: The control fails when authentication policy, legacy access, lockout behaviour, and monitoring are not aligned. A single weak account, a tolerant legacy application, or a misconfigured threshold can provide the valid login the attacker needs.
Impact: One successful spray can lead to mailbox access, SSO pivoting, session hijack, data exposure, or follow-on privilege abuse, especially where the same identity is trusted across multiple systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0, OWASP ASVS and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Password spraying exploits weak account and authentication hygiene across IAM estates. |
| Recommendation — Harden account lifecycle, remove stale accounts, and enforce consistent authentication policy. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Spraying succeeds when password lifecycle, reset, and reuse controls are weak. |
| IA-2 — Identification and Authentication (Organizational Users) | Human login paths remain the primary target of password spraying attacks. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Distributed guessing depends on detection gaps across many low-signal failures. | |
| Recommendation — Restrict weak authenticators and manage password lifecycle tightly. Require stronger authentication for organisational users and reduce password-only access. Correlate failed logins across accounts and alert on distributed spraying patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The issue is an IAM control weakness in authentication paths and exceptions. |
| Recommendation — Remove weak authentication paths and enforce consistent access control across systems. | ||
| OWASP ASVS | V6 — Authentication | The attack is fundamentally about abusing weak authentication behaviour and recovery. |
| Recommendation — Verify strong authentication, throttling, and lockout behaviour across all login paths. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Password spraying is directly shaped by authenticator strength and recovery expectations. |
| Recommendation — Apply phishing-resistant and rate-limited authentication guidance to reduce password dependence. | ||
Practitioner Guidance
What to prioritise: Remove password-only access paths first for high-value populations, then identify every exception that still permits basic authentication or weak recovery. If you cannot retire the path quickly, bound it with tighter monitoring and narrower blast radius.
What to verify: Confirm that lockout, throttling, and alerting behave consistently across cloud, on-prem, and legacy applications. A control that works in the primary IdP but not in the older application behind it still leaves a viable spray target.
Common mistake: Treating password spraying as just a user hygiene issue. It is usually an identity architecture issue, because the attack succeeds where the programme still allows passwords to remain a usable primary factor.
Practitioner takeaway: The durable fix is not better password rules alone, it is reducing the number of places where a password can still open a path to real access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org