Password Spraying

An attacker does not have to guess hundreds of passwords for one person. They can try the same few common passwords on many accounts, hoping that someone uses one. This is called password spraying. To investigate it, start by reading the recent sign-in logs:

seclab logs --since 2026-10-22

You should see:

2026-10-22 08:00:10 mail LOGIN_FAILED user=lee ip=203.0.113.71 wrong password
2026-10-22 08:00:20 mail LOGIN_FAILED user=ava ip=203.0.113.72 wrong password

The example shows attempts on two accounts from different addresses. Blocking one address would leave the others able to try. Requiring MFA for everyone means that knowing a password alone is no longer enough to sign in:

seclab policy set mfa everyone

You should see:

Policy updated: mfa is everyone.

At Lumen, this rule also blocks password-only sign-ins for accounts whose MFA is not set up yet. However, it does not sign out someone who already got in. If the logs show that Ava's stolen password was used, reset it to replace the password and end those sessions:

seclab reset ava

You should see:

Password reset for ava. Every session they had is signed out.