An attempt to break into an account or decrypt data by systematically trying many possible passwords or keys until one works.
In a simple brute force attack, software tries every possible combination of characters. Variations include dictionary attacks, which try common words and leaked passwords, and password spraying, which tries a few common passwords against many accounts to avoid lockouts. Attacks can target online login pages or stolen password files that attackers try to crack offline.
For example, attackers often scan the internet for remote desktop services and try thousands of username and password combinations against them. Short, simple passwords can fall quickly, while long, random ones take impractically long to guess. Protection includes strong unique passwords, multi-factor authentication, account lockout or delays after failed attempts, rate limiting, and keeping remote access services off the open internet. Properly hashed and salted password storage makes offline cracking much harder.
An attack that uses usernames and passwords stolen from one breach to try logging in to many other websites automatically.
HashingTransforming data of any size into a fixed-length string, called a hash, using a one-way mathematical function.
Rate LimitingRestricting how many requests a user, device, or application can make to a service within a set time period.
CMMC is now in DoD contracts, and third-party Level 2 assessments start appearing November 10, 2026. Here's what each level requires and the first steps for small suppliers.
Annotated example emails showing the exact clues employees should check before clicking, plus what to do when a suspicious message lands in your inbox.
Passkeys replace passwords with phishing-resistant cryptography built into your devices. Here is how they work, how to start using them, and how businesses can roll them out.