What is password spraying?
Password spraying is an online credential attack that inverts the usual brute-force pattern. Instead of trying many passwords against one account, the attacker tries one carefully chosen password against many accounts, then waits and tries a second password against all of them later. Because each account sees only one or two failures in a lockout window, no account locks out, and the attack can run quietly for days or weeks.
How it works
The passwords are the ones careless users pick under a complexity policy: a season and year such as Autumn2026, the company name plus a number, or Welcome1. With enough accounts, a single guess finds someone. Spraying is a favorite against cloud services such as Microsoft 365 and against VPN and single sign-on portals, where one valid password can open the whole environment.
How it looks in the logs
The log signature is distinctive once you know it: many different usernames, one failure each, close together, often from one source address, and no lockouts.
08:31:02 4625 user=abarnes src=198.51.100.50
08:31:02 4625 user=cflores src=198.51.100.50
08:31:03 4625 user=dmorgan src=198.51.100.50
On Windows, event ID 4625 is a failed logon. A run of 4625s spread across many distinct accounts, rather than piling up on one, is the tell. The absence of event 4740 lockouts is what separates spraying from a brute-force attack on a single account.
How to defend against it
Account lockout alone does not catch spraying, because the attack is designed never to trip it. The defenses are multifactor authentication, so a found password is not enough on its own; banned-password lists that block weak and seasonal choices; detection that looks for one source failing against many accounts; and conditional access that flags sign-ins from unexpected locations. Longer, unique passwords and a password manager remove the easy guesses the attack relies on.
Password spraying vs. credential stuffing
Both aim at many accounts, but the input differs. Spraying guesses a small set of common passwords and hopes one matches someone. Credential stuffing replays real username and password pairs leaked from other breaches, betting on reuse. Spraying shows one failed password repeated across accounts; stuffing shows varied pairs and scattered successes from many addresses.
Password spraying on the CompTIA Security+ exam
Password spraying is an indicator of malicious activity under objective 2.5. A scenario describing one failed sign-in each for hundreds of accounts, from one address, with no lockouts, is pointing straight at it. The distractors are a brute-force attack, which hammers a single account, and credential stuffing, which uses leaked pairs rather than a single guessed password. The strongest listed defense is multifactor authentication, with banned-password lists as a supporting control.