A lockout policy temporarily blocks a user account after repeated failed sign-in attempts. In IAM, it helps slow password guessing and brute-force attacks, and can apply to human or non-human accounts. Security teams tune thresholds, duration, and reset rules to balance attack resistance with account recovery and operational continuity.
What a lockout policy does
A lockout policy is a defensive control that temporarily disables an account after repeated failed sign-in attempts. It is meant to slow automated guessing, but it also creates a deliberate trade-off between attack resistance and the risk of locking out legitimate users.
The policy usually revolves around three tunables: the failure threshold, the lockout duration, and the reset window. Together, those settings determine how quickly an account is frozen, how long access is denied, and when failed attempts stop counting toward the threshold.
Why lockout policies matter for authentication security
Lockout policies work best as part of a broader authentication strategy, not as a standalone defense. They can frustrate brute-force attacks, password spraying, and other repeated sign-in abuse, especially when attackers rely on large numbers of guesses against a small set of accounts.
They are also relevant to both human and non-human accounts, because any account that accepts repeated authentication attempts can become a target. In that sense, the policy protects the account boundary itself, not the type of identity behind it.
For related defensive guidance on limiting repeated login abuse, see the Password Spraying and Credential Stuffing Defence Guide.
How lockout thresholds affect usability and resilience
Too-aggressive lockout settings can turn a security control into an availability problem. A low threshold or long duration may let an attacker trigger denial of access for many users, while also increasing help desk load and frustrating legitimate sign-ins.
Too-permissive settings create the opposite problem, where an attacker gets more guesses before the account is slowed or frozen. That is why organisations usually tune lockout behaviour alongside rate limiting, MFA, authentication telemetry, and account recovery workflows.
The right balance depends on the value of the account, the likelihood of automated attack, and how disruptive it would be if an account were temporarily unavailable.
What to review after a lockout event
A lockout event is not just an access issue, it can also be a signal of active guessing or credential abuse. Security teams should review whether the pattern matches user error, scripted attempts, or coordinated attack activity, and whether other accounts show similar signs.
If a lockout is unexpected, the follow-up should include authentication logs, source IP patterns, and any related sign-in anomalies. Where repeated failures are part of a broader compromise attempt, the account may need password reset, session review, and credential rotation before it is safely restored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Lockout policy is part of managing authenticators and failed authentication behavior. |
| AC-7 — Unsuccessful Logon Attempts | This control directly addresses lockout after repeated failed sign-ins. | |
| AU-6 — Audit Review, Analysis, and Reporting | Lockout activity is a useful detection signal that should be reviewed in logs. | |
| Recommendation — Set lockout thresholds, reset rules, and recovery handling under IA-5 to limit repeated authentication abuse. Configure AC-7 to limit failed logon attempts and temporarily inhibit repeated authentication failures. Use AU-6 to review repeated failures and investigate lockout patterns for signs of attack. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org