# What is the difference between brute force and password spraying?

Both guess passwords, in opposite directions. Brute force tries many passwords against one account, which usually triggers an account lockout and shows up clearly in the target's logs. Password spraying tries one or two common passwords, such as a season and a year, against many accounts, staying under lockout limits, and often spreads the attempts over hours or across several services. Spraying is more common against VPNs, webmail and cloud logins, where account names are easy to guess. The defences are the same for both: multi-factor authentication (MFA), banning common passwords, and alerts on failed logins across many accounts from one source. Inside the company, either one appears on the network as one host making repeated short connections to login services. NetSenX shows those connections between hosts; the failure counts and accounts tried are in the server's or identity provider's logs.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/difference-between-brute-force-and-password-spraying

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is credential stuffing?](https://netsenx.com/en/faq/what-is-credential-stuffing)
- [What is Kerberoasting?](https://netsenx.com/en/faq/what-is-kerberoasting)
- [What is pass-the-hash?](https://netsenx.com/en/faq/what-is-pass-the-hash)
- [What is a drive-by download?](https://netsenx.com/en/faq/what-is-a-drive-by-download)
- [What is a botnet, and how would we know a device of ours is part of one?](https://netsenx.com/en/faq/what-is-a-botnet)