How logins break

Brute force hammers one account with many passwords and dies on any lockout. Password spraying inverts it: a few common passwords across many accounts, staying under each account's failure threshold. Against organizations without MFA, spraying works for years because no single account looks attacked.

Then there is logic, which skips guessing entirely. Lockouts keyed only on username fall to spraying by construction. Password-reset tokens that never expire turn one leaked email into permanent access. 2FA that can be skipped by requesting the next step directly was never 2FA. Each is a design flaw, not a weak password.

The defensive stack, in order: MFA on every remote and admin login, lockouts with alerting (and spraying-aware monitoring: many accounts, few passwords, one source), short-lived single-use reset tokens, and enforcing every step of a multi-step flow server-side.