A brute force attack is when an attacker uses automated tools to try password after password, or username and password pair after pair, until one works. It exploits guessable passwords and unlimited login attempts rather than a software flaw. The strongest defence is a combination of long, unique passwords, multi-factor authentication, attempt limits and bot verification on the sign-in screen.
Key takeaways
- A brute force attack is an automated, high-volume attempt to guess a password; dictionary attacks, credential stuffing and password spraying all belong to the same family.
- According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks.
- NIST SP 800-63B requires consecutive failed attempts on a single account to be capped at no more than 100.
- A "complex password" alone is not enough; MFA, attempt limits, bot verification and login monitoring need to work together.
- Removing shared passwords and being able to end sessions from one place keeps even a successful guess manageable.
How does a brute force attack work, and what types are there?
The attacker targets a sign-in page (email, VPN, remote desktop, an admin panel) and runs software that makes thousands of attempts. The attempts rarely come from one machine; they are usually spread across thousands of IP addresses so that "too many tries from one IP" rules never fire. The aim is to take over a single account and move from there into email, files or payment processes.
| Type | How it works | Typical target | Most effective control |
|---|---|---|---|
| Simple brute force | Tries every character combination in turn | Short passwords, PINs | Long passwords, attempt limits |
| Dictionary attack | Tries lists of common passwords and words | Patterns such as "Company2026!" | Blocklist of banned passwords |
| Credential stuffing | Replays email–password pairs leaked from other sites | People who reuse passwords | Unique passwords, MFA |
| Password spraying | Tries a few common passwords across many accounts | Attackers avoiding lockout | MFA, login monitoring, bot verification |
| Offline cracking | Cracks stolen password hashes on the attacker's own hardware | After a data breach | Strong hashing, long passwords |
Password spraying is particularly sly: because each account sees only one or two attempts, lockout never triggers. Credential stuffing, meanwhile, starts not with your systems but with a password leaked from some other site an employee uses privately; we cover it separately in what is credential stuffing. We explain why password patterns are so easy to guess in our business password security guide.
What does a brute force attack cost a business?
Guessing passwords is still the cheapest and most popular route in for attackers.
According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks, and phishing-resistant multi-factor authentication can stop over 99% of them.
A compromised account often becomes the breach itself. In the Verizon 2026 Data Breach Investigations Report, use of stolen credentials appears as an action in 36% of breaches. Yet in security vendor Sophos' The State of Identity Security 2026 survey, only 24% of responding organisations said they continually monitor for unusual login attempts.
The cost is not only technical. A hijacked mailbox can send fake payment instructions to customers, leak correspondence containing personal data and trigger notification duties under data protection law. For the Turkish KVKK process, see our guide to the 72-hour data breach notification.
How can you tell a brute force attack is happening?
These attacks are often quiet, but they leave traces in the logs. Check regularly for:
- A burst of failed sign-ins in a short period, especially overnight.
- A few failed attempts on many different accounts at the same time (a sign of password spraying).
- A successful sign-in from a country the employee has never been to, or from an unknown device.
- Staff complaining that their account is locked or their password has changed.
- Forwarding rules in a mailbox that the user never set up.
If you find a successful intrusion, our guide to the first 24 hours after an email account is compromised lists what to do, step by step.
Seven steps to protect company accounts from brute force attacks
No single control stops the attack; layers cover each other's gaps. Working through them in this order removes the biggest risk fastest.
- Turn on multi-factor authentication (MFA). Even a correctly guessed password is useless without the second factor; we compare the options in our multi-factor authentication guide, and the glossary has a short definition.
- Prefer length over complexity. NIST SP 800-63B asks for at least 15 characters when a password is the only factor and at least 8 when it is part of MFA; it rules out forced periodic changes and character-mix rules.
- Use a banned-password list. The same NIST guidance requires new passwords to be checked against a blocklist of common or compromised passwords, so "Company123" is rejected from the start.
- Limit attempts. NIST requires consecutive failed attempts on a single account to be capped at no more than 100; in practice, adding a delay after a few failures disrupts staff far less than a hard lockout.
- Add bot verification to sign-in screens. Automated attempts come from software, not people; human verification before the request reaches the server stops most distributed guessing at the door.
- Remove shared passwords and legacy protocols. If everyone knows the password to
info@, a single leak exposes the whole team; we describe the single-identity approach in our single sign-on (SSO) article. - Monitor sign-ins and cut off leavers immediately. Seeing open sessions and closing them remotely turns a successful guess into a short-lived problem; see our offboarding checklist for all employee accounts.
To fit these steps into a wider plan, the SME cyber security checklist is a good starting point. Staff password habits matter as much as technical controls, and a security awareness training programme closes that gap.
Account lockout or bot verification?
Lockout stops an attack, but it has a side effect: an attacker can deliberately enter wrong passwords to lock staff out. Password spraying is designed to stay below the lockout threshold anyway. Bot verification looks at whether the attempt comes from a person or a script, so it filters automated traffic without locking out genuine users. The best results come from using both, together with a delay between attempts.
How does Smart360 reduce brute force risk?
Digital Bridge's Smart360 product family brings SmartMail, SmartFiles, SmartOperator and SmartPass together in one ecosystem managed from a single panel. Its security layer, Smart360 Security, protects sign-in screens and forms against automated bot traffic; the threats it stops include password-guessing attacks, fake account sign-ups and automated form submissions. No sign-in request reaches the server until verification is complete; verification usually finishes in the background with no extra step, and asks for a one-tap confirmation only when needed.
Picture a 40-person logistics firm where staff have used the same password for the accounts@ and export@ mailboxes for years. After moving to Smart360, the system generates mailbox passwords and stores them encrypted; staff never see them, because access to a mailbox is a permission rather than a password. Each employee signs in to every product with a single identity, SmartID, so there is no shared password left to guess, pass around or walk out of the door with a leaver.
When distributed attempts start hitting the SmartMail sign-in page at midnight, Smart360 Security applies the same verification on the SmartMail, SmartFiles and organisation panel sign-ins; because it can also check whether verification was solved on the expected page, a verification solved on a different address is not accepted. If an employee suspects their password has leaked, they can see their open sessions with device details, close a suspicious device remotely, and a password change ends sessions on every device. When someone leaves, the administrator closes their access in one place, however many products they used.
For details, see the Smart360 product page and, for the business email side, the SmartMail page.
How Digital Bridge can help
Reducing brute force risk is less about installing one product and more about listing every sign-in point and adding the right layer to each. Through our cyber security consultancy, Digital Bridge reviews your email, VPN, remote access and admin panels and builds an MFA, password policy and login monitoring plan that fits your company. When you move to Smart360, the domain, DNS records, mailboxes and permissions are configured with guidance from the Smart360 team. For more security articles, browse the security and data protection topic page.
Next step
Start this week with three things: switch on MFA for every admin and email account, list your shared passwords, and review the last 30 days of failed sign-ins. If you want to remove shared passwords, protect sign-in screens with bot verification and manage sessions from one panel, explore Smart360 and choose your package on the Smart360 purchase page. For questions, get in touch.