Password spraying
Trying one common password against many accounts, rather than many passwords against one account.
This inverts brute force specifically to avoid lockouts. An attacker takes a list of usernames and tries a single plausible password against all of them, waits, then tries the next. Each account sees one failed attempt, so nothing triggers.
It works because in any large enough organization somebody has chosen the seasonal password everyone predicts. Detection needs correlation across accounts rather than per-account thresholds.
Where this comes up
Password spraying sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.