What Is A Brute-Force Attack?

This report defines brute-force attacks and details their common forms (knowledge-based, dictionary, credential stuffing, reverse brute-force, hybrid, password spraying, and offline hash cracking), the typical attack steps, reasons for success (weak/reused passwords, lack of MFA or rate limiting, poor monitoring), and practical mitigations—such as enforcing strong, lengthy passwords, deploying MFA, account lockouts and rate limiting, CAPTCHAs, IP controls, monitoring for login anomalies, zero trust/least privilege, endpoint security, and user training.