What Is a Brute Force Attack? Types, Warning Signs and Defences

A brute force attack is an automated attempt to guess passwords until one works. The National Cyber Security Centre (NCSC) describes it as “the automated guessing of large numbers of passwords until the correct one is found.” The attacker needs no clever exploit, just a login page, a list of guesses and enough patience. That simplicity is why it is still one of the most common ways into an account.

This guide explains how the attack works, the main variants, how to spot one, and what actually stops it. It is written for IT managers and business owners rather than specialists.

What is a brute force attack, in plain terms?

Think of a combination lock with no limit on tries. Anyone willing to keep turning the dial will eventually open it. A login form without protection works the same way: software submits guess after guess, checks each response, and stops when one is accepted.

OWASP, the web security community, describes the core idea as an attacker sending predetermined values to a server and analysing the responses. The attacker can then estimate how long the job will take from the number of tries and how fast both systems are. Weak passwords fall in seconds. Long, unusual ones can take far longer than any attacker will wait.

The target does not have to be a website. MITRE ATT&CK notes that brute forcing can hit a live service that checks credentials, or work offline against captured data such as password hashes. Offline attacks are quieter, because the victim never sees failed logins.

What types of brute force attack are there?

Pure guessing of every possible combination is only one option. Attackers pick the method that gives the best odds for the least noise. MITRE lists four sub-techniques, and they behave quite differently.

Traditional and dictionary attacks

A traditional attack tries every combination of a chosen character set. A dictionary attack uses a word list instead, sometimes with small mutations such as a capital letter or a number on the end. Because people pick predictable passwords, the dictionary approach is usually faster.

Password guessing

Some guessing is done by hand. The NCSC points out that attackers try personal details such as names, birth dates and pet names. Social media hands them much of that material for free.

Password spraying

Spraying flips the logic. The NCSC describes it as “using a small number of commonly-used passwords in an attempt to access a large number of accounts.” The attacker tries one or two common passwords against every account in your company, then moves on. Each user sees almost no failed attempts, so account lockout rarely fires.

Credential stuffing

Here the guesses are real passwords taken from other breaches, tried against your systems in the hope that people reused them. We cover that case separately in our guide to how credential stuffing works and how to stop it.

How do you spot a brute force attack?

The signs are in your logs, if someone is reading them. Look for:

• bursts of failed logins against one account;
• failed logins across many accounts from one address, or from a spread of addresses;
• successful logins that follow a long run of failures;
• logins at odd hours or from countries you do not work in.

The NCSC advises pairing throttling or lockout with security monitoring that flags both brute forcing and password spraying. Controls that nobody watches only slow an attacker down. They do not tell you it happened.

How do you stop a brute force attack?

No single control does the job. The aim is to make guessing too slow, too noisy or too unlikely to succeed. These measures carry the most weight.

Turn on multi-factor authentication

A second factor means a guessed password is not enough. The NCSC says MFA is best used where risk is higher, such as internet-facing systems and priority accounts, and that it “should be the primary method” of protecting privileged accounts. MFA has gaps of its own, which we looked at in what MFA stops and what still gets through.

Throttle or lock out repeated failures

Throttling adds a growing delay between attempts. The NCSC prefers it to lockout, because “account lockout can leave legitimate users unable to access their accounts.” It also warns that lockout gives attackers an easy route to a denial of service. If you do lock accounts, the NCSC suggests allowing between 5 and 10 attempts first. MITRE makes the same point: a lockout threshold that is too strict can hurt the very accounts you are protecting.

Block weak passwords up front

A deny list of common passwords removes the guesses attackers try first. Set a sensible minimum length too. The NCSC advises against low maximum lengths and against forced complexity rules, which it says offer little protection against guessing. Its alternative is “three random words”, a longer passphrase that people can actually remember. It also notes that swapping an “o” for a zero does not meaningfully strengthen a password.

Reset exposed credentials

If an employee’s password turns up in a breach, change it. MITRE recommends resetting accounts whose credentials appear in breaches, either straight away or once brute forcing is detected.

Restrict where logins can come from

Conditional access can block sign-ins from devices that fail your checks or from outside defined IP ranges. MITRE also suggests blocking risky requests from anonymising services and proxies. Remote access portals, VPNs and webmail are the usual places to start.

How does a penetration test check for brute force weaknesses?

A tester behaves like the attacker, within an agreed scope. They check whether login pages limit repeated attempts, whether lockout works, whether default or weak passwords are accepted, and whether spraying a short list across your user base would get anyone in. They also see whether your monitoring notices.

That last part matters. Plenty of organisations have the controls on paper but have never seen them tested against live traffic. If you want a second opinion, our penetration testing service covers authentication testing as a standard part of a web or network assessment, and you can get in touch to talk through scope.

Brute force attack FAQs

Is a brute force attack illegal?

Yes, when it targets systems you do not own or have no permission to test. Testing your own systems, or a client’s with written authorisation, is how penetration testers work.

How long does a brute force attack take?

It depends on password length, how unusual it is, and whether the system limits attempts. The NCSC notes, weak passwords can be cracked in seconds, while longer and less predictable ones are much harder. Rate limiting stretches the time for online attacks further.

What is the difference between brute force and credential stuffing?

Brute force guesses passwords. Credential stuffing replays real username and password pairs leaked elsewhere. The first relies on weak choices, the second on reuse.

Does a long password stop brute force attacks?

It helps a great deal against guessing, but it does not help if the password has leaked or been reused. Pair length with MFA and monitoring.

Can small businesses be targeted?

Yes. Automated tools do not choose victims by size. They try every login page they can find, so an exposed remote access portal is a target whatever your headcount.