Password spraying

Password spraying is the opposite way round from what people imagine. Instead of trying thousands of passwords against one account, it tries a handful of very common ones against thousands of accounts.

It is done that way to stay quiet. Hammering one account gets it locked and sets off alarms. Trying "Summer2026!" once against every person in an organisation stays under every threshold, looks like ordinary failed logins, and only needs one person to have chosen it. In a company of any size, somebody always has. It is a reminder that your own password is not only your problem; it is also your colleagues'.