Definition
Password spraying
In one sentence
Password spraying is an attack that tries a small number of common passwords, such as Spring2026 or Company123, against many user accounts at once to avoid triggering account lockouts.
Credential stuffingMulti-factor authenticationConditional access
Password Spraying Explained
Account lockout policies are designed to stop an attacker guessing many passwords for one user. Password spraying flips the approach: try one or two likely passwords against every account, wait, then try again. Each account sees only a few failures, so lockouts rarely trigger.
Spraying is commonly aimed at Microsoft 365, VPN portals, Outlook Web Access and remote desktop gateways. Attackers often build user lists from LinkedIn and the company's email naming pattern. A single success on an account without MFA can be enough to start a business email compromise or a ransomware intrusion.
The defences are well established. Enforce MFA on every account, including service and shared accounts. Block legacy authentication protocols in Microsoft 365, since they bypass MFA. Use banned password lists that reject seasonal and company-name passwords. Monitor for many failed logins across many accounts from the same sources, which is a pattern a SIEM or identity protection tool can detect.
Cyber insurers frequently ask about MFA coverage precisely because spraying is so effective against accounts that lack it.
General information for Canadian organizations, not legal advice.