The Password Spray That Took 4 Minutes and Opened 200 Accounts

The client had a strong password policy on paper. Minimum length, complexity requirements, the works. They were confident. Four minutes into the test we had valid credentials for roughly two hundred accounts, and we had not cracked a single password or triggered a single lockout. We had simply guessed one obvious password — and tried it against everyone.

This is password spraying, and it remains one of the most reliable ways into an organisation precisely because it sidesteps every defence built for a different attack. Understanding why it works tells you a great deal about the gap between security policy and security reality.

Spraying vs brute force

A brute-force attack takes one account and throws thousands of passwords at it. It is loud, it is slow, and every modern system stops it cold: after a handful of wrong guesses the account locks, and alarms fire. Everyone defends against brute force, so brute force rarely works.

Password spraying inverts the whole thing. You take one password — a single, extremely common one — and try it once against every account in the organisation. No individual account sees more than one failed attempt, so nothing locks and nothing obviously alarms. You are not attacking a user; you are attacking the statistical certainty that in any large group of people, someone chose the obvious password.

Why one password opens hundreds of doors

Here is the uncomfortable maths. A complexity policy that demands an uppercase letter, a number, and a symbol does not produce random passwords — it produces predictable ones, because humans satisfy the rule the same lazy way. The season and the year plus an exclamation mark. The company name plus a one. A capital letter at the front and a symbol at the end of a dictionary word. The policy is technically satisfied and the password is completely guessable.

The passwords a "strong policy" produces# All of these pass a typical complexity check
Summer2026!      # season + year + symbol
Company1!        # org name + number + symbol
Password1!       # the classic, still everywhere
Welcome2026!     # onboarding default, never changed

# Try ONE of these against 2,000 users.
# Statistically, dozens will have chosen it.

Try Summer2026! against two thousand employees and you do not need a high hit rate. Even one percent is twenty accounts, and the real rate is usually higher, especially right after a seasonal password reset when everyone updates to the same predictable pattern at once. Two hundred hits out of a few thousand users is not unusual. It is the norm.

Why it stays under the alarms

The reason spraying is so dangerous is that it defeats the two controls organisations rely on most. Account lockout does nothing, because no account gets more than one attempt. And volume-based alerting often misses it, because from any single account's perspective there is just one failed login, which is completely normal — people mistype passwords constantly. The attack hides inside the noise of ordinary user behaviour.

Detecting it requires looking at the pattern across the whole organisation, not the individual account: many accounts, one source, one password, a short window. Organisations that only watch per-account thresholds never see it. This is exactly the kind of blind spot a penetration test exists to reveal, and it is why the exam emphasises understanding the defender's controls as well as the attacker's techniques.

The three things that stop it dead

Spraying has three real defences, and the first is decisive. Multi-factor authentication is the single most effective control: even a correctly guessed password is useless without the second factor, and it neutralises the entire attack. If you do one thing after reading this, it is turning on MFA everywhere that matters.

Second, ban the guessable passwords outright. Modern systems can reject passwords that appear on known-common and breached-password lists, which stops Summer2026! from ever being chosen no matter what the complexity rule says. This matters more than complexity requirements, which as we have seen actively produce predictable passwords. Third, detect the pattern: alert on many accounts failing with authentication from one source in a short window, the signature of a spray, rather than only on per-account thresholds. Do those three things and the four-minute attack that opened two hundred accounts simply stops working.

What this says about passwords in general

Password spraying is really a lesson about the failure of password complexity as a security strategy. For decades organisations believed that forcing uppercase, numbers and symbols produced strong passwords. It did the opposite: it produced a narrow, predictable set of patterns that humans reliably choose to satisfy the rule with the least effort. The attacker does not need to defeat the complexity requirement; they need only predict how humans satisfy it, which is trivial. This is why modern guidance has shifted away from complexity rules and mandatory rotation toward length, banned-password lists, and multi-factor authentication. The industry spent years defending against the wrong attack, and spraying is what exposed the gap. For anyone studying security, it is a perfect case study in the difference between a control that looks strong on a compliance checklist and one that actually resists a real attacker — and learning to tell those two apart is most of the job.

Four minutes, one password, two hundred accounts. It is not a sophisticated attack, and that is exactly why it endures: it exploits human predictability rather than technical weakness, and human predictability does not get patched. Turn on multi-factor authentication, ban the obvious passwords, and watch for the organisation-wide pattern, and you convert this reliable open door back into the locked one your policy always claimed it was.

For anyone preparing for PenTest+, spraying is worth understanding deeply because it sits at the intersection the exam cares about most: a technical attack, a set of defensive controls, and the human factors that defeat both. Master that intersection and you understand security the way the certification wants you to.