The Old Playbook: Counting Failed Logins
The classic defense against a brute-force attack is straightforward: if you see too many failed login attempts from one IP address in a short period, you block it. This is known as rate limiting. The logic is simple—if someone is trying to kick down the
same door over and over, you eventually bar the entrance. For years, this worked reasonably well against unsophisticated attacks where a single script from a single server would hammer an account. However, modern attackers have evolved their methods, rendering this defense largely ineffective. The fundamental flaw is that this strategy assumes the attacker is noisy and predictable, coming from a single, identifiable location. That assumption is now dangerously outdated.
The Modern Attack: A 'Low and Slow' Distributed Army
Today’s attackers don't knock on one door from one spot. They use botnets—vast networks of compromised devices—to distribute their attempts across thousands of IP addresses around the globe. Each IP address might only try one or two passwords, staying completely under the radar of traditional rate-limiting rules. This is often called a 'distributed' brute-force attack. Furthermore, attackers employ tactics like 'password spraying'. Instead of trying many passwords on one account (which would trigger an account lockout), they try one common password (like 'Winter2026!') against thousands of different user accounts. To a monitoring system, this doesn't look like an attack on any single account; it just looks like a lot of different people coincidentally forgetting their password at the same time. This 'low and slow' method avoids the tripwires that almost every legacy security system is built to detect.
It's Not Brute-Force, It's Credential Stuffing
Often lumped in with brute-force, 'credential stuffing' is a more surgical and dangerous variant. This isn't about guessing passwords; it's about using passwords that are already known to be valid. Following massive data breaches, attackers acquire lists of millions of username/password pairs from the dark web. They then use automated tools to 'stuff' these stolen credentials into the login pages of other popular services, like banking, email, or corporate VPNs. The attack preys on the common human habit of reusing passwords across multiple sites. Since the attacker is using a legitimate (though stolen) credential for each attempt, from their perspective, the first login attempt often works. This bypasses defenses based on detecting failed logins entirely.
The Right Response: Focus on Behavior, Not Just Attempts
Effective, modern detection and response requires a shift in thinking. Instead of just counting failed logins from an IP, security teams need to focus on anomalous behavior. This means building a baseline of what's normal and flagging deviations. For instance, is a user account that has always logged in from Ohio suddenly attempting to access the system from three different continents within an hour? That's a massive red flag, even if each attempt uses a different IP. Is a service account that only runs at midnight suddenly active at 2 PM? That's another. The best defense is a layered one: enforce multi-factor authentication (MFA) relentlessly, as it stops most of these attacks even if the password is correct. Beyond that, use tools that can analyze login patterns, device fingerprints, and geographic data in real-time to spot the subtle signals of a distributed attack, rather than just waiting for the loud noise of an old-fashioned one.
