How to Defend Against a Password Spraying Attack

Password guessing attacks exploit default credentials, weak policies, and service accounts. The guide covers attack types, detection, and mitigation, including NIST-aligned guidance.

Password spraying tries a few common passwords across many accounts to evade lockouts, targeting VPNs, Citrix gateways, and Entra ID tenants. Defenses include MFA and passwordless; DSP can detect it.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.