Brute force attack
Trying large numbers of passwords against an account until one works.
Straightforward brute force is largely defeated by lockout thresholds, which is why attackers moved to slower, quieter variants that stay under those limits.
It still succeeds regularly against services with no lockout or no MFA, particularly exposed remote access, VPN portals, and legacy authentication endpoints that were never turned off.
Where this comes up
Brute force attack sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Password spraying Trying one common password against many accounts, rather than many passwords against one account. Credential stuffing Using username and password pairs stolen from one breach to log into unrelated services. Multi-factor authentication Requiring two or more different kinds of proof to sign in, so a stolen password alone is not enough. Legacy authentication Older sign-in protocols that cannot support MFA, and are therefore a standing bypass of it.