The Delay Trick: How Attackers Use Timing to Hide Password Spraying

Security teams have gotten reasonably good at catching the obvious stuff. A single account hit with a thousand login attempts in ten minutes lights up every dashboard in the building. But attackers know this too, and many of them have adjusted their playbook accordingly. Instead of brute-forcing one account into submission, they spread a small number of guesses across a large number of accounts, and they slow everything down. This combination of breadth and patience is what makes modern credential attacks hard to spot, and it starts with understanding what is password spraying and why timing is the attacker’s best friend.

What Is Password Spraying, and Why Does It Work

Password spraying is a technique where an attacker tries one or a few commonly used passwords against many different user accounts, rather than testing many passwords against one account. The logic is simple: in any sufficiently large organization, some percentage of employees are using weak, predictable passwords like “Summer2026!” or “Company123.” Instead of guessing repeatedly at a single door, the attacker tries the same key on hundreds of doors, expecting a few to open.

This approach works because of two persistent human habits. First, people reuse password patterns across accounts and over time, often just changing a number or symbol to satisfy a complexity rule. Second, organizations that enforce account lockouts after a handful of failed attempts inadvertently make traditional brute-force attacks risky for attackers, but password spraying sidesteps that defense entirely, since no single account ever receives enough failed attempts to trigger a lockout.

Research from Microsoft’s security team has repeatedly identified password spraying as one of the most common initial access techniques used against cloud identity systems, precisely because it blends in with normal login noise rather than standing out as an anomaly.

The Role of Timing in Evading Detection

The part of password spraying that catches most defenders off guard isn’t the technique itself, it’s the pacing. A naive attack might try a password against fifty accounts in under a minute, which is fast enough to trip rate-limiting or anomaly detection. A more patient attacker spreads those same fifty attempts across hours or even days, staying well under the thresholds most systems use to flag suspicious activity.

This is the delay trick. By introducing deliberate gaps between login attempts, attackers make their activity resemble the background hum of normal failed logins that every organization experiences, employees mistyping passwords, forgotten credentials, expired accounts. Security logs are full of this kind of noise, and a slow-moving spray attack hides inside it.

Some of the pacing strategies observed in real-world attacks include:

• Randomized intervals between attempts, avoiding the fixed, mechanical timing that automated detection tools are built to catch
• Low-and-slow cadences, sometimes limited to just one or two attempts per account per day
• Distributed source IPs, often using proxy networks or compromised devices so that no single IP address accumulates a suspicious volume of failed logins
• Time-zone alignment, scheduling attempts during an organization’s normal business hours so the traffic doesn’t stand out as occurring at odd hours

Each of these choices, on its own, seems minor. Together, they can push an attack below the detection threshold of tools that were designed around volume and speed rather than patience.

Why Traditional Defenses Struggle to Catch This

Most legacy detection systems were built around a narrow assumption: malicious login activity will differ noticeably from legitimate activity in volume, frequency, or origin. Rate limiting, account lockout policies, and threshold-based alerts all depend on this assumption.

A carefully paced password-spraying campaign may avoid triggering any of these controls. It does not necessarily lock accounts, generate a sudden traffic spike from one source, or produce enough failures against any individual account to appear suspicious. Instead, it creates a subtle pattern across the organization: numerous accounts each receive a small number of failed login attempts, often involving the same handful of commonly used passwords.

This is precisely why the question “what is password spraying?” matters beyond its basic definition. Understanding how the attack distributes low-frequency attempts across many accounts allows analysts to search for the correct signals. A single failed login may be insignificant, but repeated failures across hundreds or thousands of accounts over several days can reveal a coordinated credential attack that traditional account-level monitoring may overlook.

Detecting the Pattern Instead of the Speed

Because attackers have adapted their timing, defenders have had to adapt their detection logic. Rather than asking “did this happen too fast,” modern identity protection increasingly asks “does this happen too broadly.” That shift matters. Analysts and automated systems alike now look for correlated failure patterns across many accounts within a shared time window, even when the individual attempts are spaced far apart.

Some organizations have found success by monitoring for a small set of commonly used weak passwords being tried against multiple accounts, regardless of how slowly those attempts trickle in. Others rely on behavioral baselines that flag login attempts originating from unfamiliar geographies or devices, even if the failure count itself is low. Multi-factor authentication remains one of the most effective mitigations, since it renders a correctly guessed password insufficient on its own, though it isn’t a complete solution, as attackers have also developed methods to fatigue or bypass MFA prompts once a password has been successfully guessed.

What We’ve Learned

The delay trick works because it exploits a gap between how attacks actually unfold and how detection systems were originally designed to think about risk. Speed and volume are easy to measure and easy to alarm on. Patience is not. When attackers slow down and spread their guesses across many accounts, they force defenders to think in terms of patterns rather than spikes.

Understanding what is password spraying is really about understanding this shift in attacker behavior, away from loud, obvious brute force and toward quiet, distributed guessing that blends into the everyday noise of failed logins. Recognizing that pattern, and building detection around correlation rather than raw speed, is what separates organizations that catch these attacks early from those that discover them only after credentials have already been compromised.

---