A Single Password Got Them Into the Colonial Pipeline

In May 2021, a single compromised password on an inactive VPN account gave the DarkSide ransomware group access to Colonial Pipeline's network. There was no multi-factor authentication on that account. The attackers didn't need a sophisticated zero-day exploit. They just needed one credential — and they got it.

That incident shut down fuel distribution across the U.S. East Coast for nearly a week. And while the exact method of credential compromise is debated, the lesson is universal: if your systems allow weak, reused, or unprotected passwords, a brute force attack is not a question of if but when.

Brute force attack prevention is the practice of making it computationally expensive, operationally difficult, or outright impossible for threat actors to guess their way into your systems. This post gives you nine specific, layered defenses I've seen work in real environments — from small businesses to enterprise networks.

What Is a Brute Force Attack, Really?

A brute force attack is any method where an attacker systematically tries combinations of usernames and passwords until one works. That's the textbook answer. In practice, it's more nuanced than that.

The Variants You Need to Know

  • Simple brute force: The attacker tries every possible character combination. Slow, but effective against short passwords.
  • Dictionary attack: The attacker uses a wordlist — common passwords, leaked credential databases, and variations. This is the most common form I see in incident reports.
  • Credential stuffing: Attackers take username/password pairs from one data breach and try them on other services. According to the Verizon 2024 Data Breach Investigations Report, stolen credentials were involved in roughly 31% of all breaches over the last decade.
  • Reverse brute force: The attacker starts with a known common password (like "Password1!") and tries it against many usernames.
  • Password spraying: A slow, distributed version of reverse brute force designed to stay under lockout thresholds. This is what hits enterprise environments the hardest.

Each variant requires a slightly different defensive posture. A lockout policy alone won't stop password spraying. A long password alone won't stop credential stuffing. You need layers.

The $4.88M Reason You Can't Ignore This

IBM's 2024 Cost of a Data Breach Report put the global average cost of a breach at $4.88 million. Compromised credentials were the most common initial attack vector — and breaches caused by stolen or brute-forced credentials took an average of 292 days to identify and contain.

That's nearly 10 months of an attacker living in your network. If you're a small or mid-sized organization, you don't have 10 months of budget to absorb that kind of damage.

I've worked with organizations that assumed their systems were too small to target. They weren't. Automated brute force tools don't discriminate. Botnets scan entire IP ranges and try default credentials against every exposed RDP port, SSH service, and web login they find.

9 Brute Force Attack Prevention Defenses That Actually Work

1. Enforce Multi-Factor Authentication Everywhere

This is the single most impactful step. Multi-factor authentication (MFA) makes a brute-forced password useless on its own. Even if an attacker guesses the correct credential, they still need the second factor.

I've seen organizations deploy MFA on their email but leave VPN, admin panels, and cloud dashboards unprotected. That's exactly the gap attackers exploit. Roll MFA out to every externally accessible service first, then work inward.

CISA has been explicit about this. Their guidance on implementing multi-factor authentication is a solid starting point for any organization.

2. Implement Intelligent Account Lockout Policies

A basic lockout policy — lock the account after five failed attempts for 30 minutes — stops simple brute force attacks. But attackers know this. Password spraying specifically targets one or two attempts per account to stay under the threshold.

The smarter approach: combine lockout policies with velocity detection. If your security tools see 500 accounts each getting one failed login in a 10-minute window, that's a spray attack. Your SIEM or identity provider should flag that pattern even though no single account hit the lockout threshold.

3. Kill Default Credentials on Day One

Every appliance, database, and network device ships with default credentials. Attackers know every single one of them. Shodan makes it trivial to find exposed devices, and automated tools try default logins as the very first step.

I've personally seen breaches that started with admin/admin on a forgotten network printer that had access to an internal VLAN. Audit your asset inventory. Change every default credential. Disable accounts you don't need.

4. Use Long Passphrases, Not Complex Short Passwords

"P@ssw0rd1!" meets most complexity requirements and gets cracked in seconds. "correct horse battery staple" — the famous XKCD example — is harder to brute force by orders of magnitude.

NIST's SP 800-63B Digital Identity Guidelines recommend a minimum of 8 characters for user-selected passwords and suggest allowing up to at least 64 characters. They explicitly recommend against mandatory complexity rules that lead to predictable patterns. Follow NIST, not legacy policies.

5. Block Known Breached Passwords

Your password policy should check every new password against databases of known compromised credentials. If an employee tries to set their password to one that appeared in a prior data breach, reject it immediately.

Active Directory integrations exist for this. Azure AD (now Entra ID) has built-in banned password lists. For on-prem environments, tools that check against the Have I Been Pwned database work well. This single control eliminates the low-hanging fruit that dictionary attacks depend on.

6. Rate-Limit and Geo-Fence Authentication Endpoints

If your organization operates in the United States, why is your login page accepting authentication attempts from IP ranges in countries where you have no employees, customers, or partners?

Geo-fencing login endpoints isn't perfect — attackers use VPNs and proxies — but it raises the cost. Combine it with rate limiting: no single IP address should be allowed to attempt hundreds of logins per minute. Your web application firewall or reverse proxy should enforce this at the network edge, before requests even reach your authentication server.

7. Eliminate Exposed RDP and SSH

The FBI's Internet Crime Complaint Center (IC3) has repeatedly highlighted exposed Remote Desktop Protocol (RDP) as a top initial access vector for ransomware. Brute forcing RDP credentials is trivial when the port is open to the internet.

If you must provide remote access, put it behind a VPN with MFA. Better yet, adopt a zero trust network access (ZTNA) approach where no service is directly exposed and every connection is authenticated and authorized before access is granted. The days of port-forwarding RDP to the internet should be long gone.

8. Monitor and Alert on Authentication Anomalies

You can't prevent what you can't see. Your logging infrastructure should capture every authentication event — successful and failed — and your security team should have alerts for:

  • Multiple failed logins from a single IP across different accounts (spray pattern)
  • Successful login from an unusual geographic location
  • Successful login immediately following a string of failures (likely compromise)
  • Authentication attempts against disabled or non-existent accounts

If you don't have a SIEM, even basic log analysis with scripted alerts is better than nothing. The organizations that catch brute force attacks early are the ones that invested in detection, not just prevention.

9. Train Your People to Stop Helping Attackers

Social engineering and brute force attacks are deeply connected. An employee who reuses their corporate password on a personal site that gets breached has just handed an attacker a valid credential for a stuffing attack. An employee who falls for a phishing email might give up their password directly — no brute force needed.

Security awareness training changes behavior when it's specific, ongoing, and relevant. Generic annual slideshows don't cut it. Your team needs to understand why password hygiene matters, how credential stuffing works, and what phishing simulation exercises are designed to teach them.

If you're building or updating your program, our cybersecurity awareness training course covers these topics in practical, real-world terms. And for targeted anti-phishing education, our phishing awareness training for organizations gives your team hands-on experience recognizing and reporting social engineering attempts before credentials get stolen.

How Do You Prevent a Brute Force Attack?

You prevent a brute force attack by layering multiple defenses: enforce multi-factor authentication on all accounts, implement account lockout and rate-limiting policies, require long passphrases instead of short complex passwords, block known compromised passwords, eliminate exposed remote access services like RDP, and train employees to avoid password reuse and phishing. No single control is sufficient — effective brute force attack prevention requires defense in depth.

The Zero Trust Connection

Zero trust architecture fundamentally changes the calculus for brute force attackers. In a traditional network, a valid credential often means broad lateral access. In a zero trust model, every resource requires separate authentication and authorization. Even if a threat actor brute-forces one credential, the blast radius is contained.

Zero trust also means continuous verification. A session isn't trusted just because the initial login succeeded. Behavioral analytics can detect if a compromised account starts accessing resources it never normally touches and terminate the session in real time.

This isn't a future concept. Microsoft, Google, and most major cloud providers offer zero trust tooling today. The challenge is implementation discipline — and that starts with understanding your identity infrastructure thoroughly.

What I See Organizations Get Wrong

After years in this field, I see the same mistakes repeated:

  • MFA on email but nothing else. Attackers pivot to the unprotected service. Every time.
  • Lockout policies with no monitoring. You locked the account, great. Did anyone investigate why it locked? That failed login pattern is intelligence.
  • Password policies from 2010. Mandatory 90-day rotation with complexity requirements produces "Summer2026!" and "Company123$". Predictable patterns are an attacker's best friend.
  • No credential screening. If your organization doesn't check new passwords against breach databases, you're allowing passwords that attackers already have in their wordlists.
  • Training treated as compliance, not capability. A checked box doesn't stop a credential stuffing attack. A well-trained employee who uses a password manager and recognizes phishing does.

Build Your Defense Stack Today

Brute force attacks aren't sophisticated. They're persistent, automated, and devastatingly effective against organizations that rely on passwords alone. The good news: every defense I've listed here is deployable today with existing tools and reasonable budgets.

Start with MFA. Audit your exposed services. Update your password policies to align with NIST guidelines. Screen for breached passwords. Train your people — not once a year, but continuously.

Your security awareness training program is a core part of this stack, not an afterthought. And targeted phishing awareness training directly reduces the credential theft that feeds brute force and stuffing campaigns.

The threat actors automating login attempts against your systems right now don't care about your org chart, your budget cycle, or your compliance timeline. They care about one thing: finding the path of least resistance. Make sure that path doesn't run through your front door.