Why do per-account lockout rules miss credential stuffing attacks?

Why Per-Account Lockout Misses the Real Attack Pattern

Per-account lockout rules assume attackers concentrate effort on one username until the threshold trips. credential stuffing does the opposite. It uses breached username and password pairs at scale, distributing a small number of guesses across many accounts, many IPs, and many services. That pattern is visible in breach analyses such as the 52 NHI Breaches Analysis, where exposed credentials are repeatedly reused after the initial compromise.

This is why the control fails even when it appears to be working. A noisy attacker can stay under the lockout threshold for every individual account while still harvesting a meaningful success rate across the population. The right mental model is not “how many bad attempts hit this account,” but “what abusive pattern emerges across the identity estate.” NIST’s NIST SP 800-63 Digital Identity Guidelines reinforce that authentication should be paired with risk-aware monitoring, not treated as a standalone gate. In practice, many security teams discover stuffing only after anomalous logins have already spread across the estate, rather than through intentional detection design.

How Detection Changes in Practice

Effective defense shifts from per-account punishment to population-level correlation. Instead of counting failures on one username, teams look for repeated login attempts across many accounts that share the same source traits, timing, or password pattern. That requires telemetry from authentication logs, proxy headers, device fingerprints, geolocation, and session outcomes, then correlating those signals quickly enough to stop the campaign.

Current guidance suggests layering several controls rather than depending on lockout alone. Risk-based throttling, breached-password checks, bot detection, MFA, and anomaly scoring work better together than any single threshold. For identity programs, the OWASP Non-Human Identity Top 10 is useful because it treats identity abuse as a lifecycle problem, not just an authentication problem. Related NHIMG research such as the Guide to the Secret Sprawl Challenge shows how reused credentials and poor secret hygiene create the conditions attackers need.

• Correlate failed logins across usernames, not just within a single account.
• Track source diversity, including IP rotation, ASN spread, and device variation.
• Use breached-credential intelligence to flag likely stuffed pairs before success.
• Apply adaptive friction, such as step-up verification, when patterns match automation.

Operationally, this works best when authentication events, threat intelligence, and session telemetry are centralized and searchable in near real time. These controls tend to break down in highly distributed SaaS estates with inconsistent logging, because the attacker’s activity becomes fragmented across systems and no single control plane sees the full campaign.

Where Lockout Still Helps and Where It Breaks

Tighter lockout rules often increase user friction and help desk load, requiring organisations to balance abuse resistance against account recovery overhead. That tradeoff is real, especially for consumer services and external-facing portals where legitimate users mistype passwords or switch devices frequently. The safer answer is usually not harsher lockout, but smarter escalation based on context.

There is no universal standard for exactly which correlation threshold should trigger action. Best practice is evolving toward layered response: short delays for repeated failures, CAPTCHA or proof-of-work for bot-like behavior, and selective step-up authentication when a cluster of attempts indicates stuffing. For threat context, the CISA cyber threat advisories and the MITRE ATT&CK Enterprise Matrix are useful for mapping follow-on techniques after initial login success. The key lesson from NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now is that identity abuse is rarely isolated to one account once adversaries have working credentials.

Per-account lockout still has value against brute force on a single username, but it is the wrong primary defense for a distributed stuffing campaign. It breaks down most sharply in high-volume consumer auth, single sign-on front doors, and environments where attackers can rotate IPs and automate retries faster than analysts can review alerts.

Related resources from NHI Mgmt Group

• Why is NHI governance critical in the age of AI attacks?
• How can organizations manage the risk of credential leaks in MCP frameworks?
• Why do Shai Hulud style attacks matter to NHI governance?
• Should organisations prioritise external exposure or internal credential governance first?