AI hacking makes password spraying faster. Here's how to close the gap

AI hacking didn't invent password spraying. It just gave it a faster engine

Password spraying is one of the least glamorous attacks in the book. An attacker picks a handful of common passwords and tries them against a long list of accounts, staying under lockout thresholds so no single failure trips an alarm. No exploit. No malware. Just patience and a login form.

Password spraying is also the technique behind most identity attacks today. We've broken down why in Password spraying: 97% of attacks don't hack, they just log in, and that math hasn't changed. What has changed is who can run the attack, and how fast.

That's the story behind AI hacking: not a new attack type, but an old one running at a speed and scale human operators never had.

What AI hacking actually changes about a spray campaign

A manual password spray campaign has natural limits. Someone has to pick the password list, manage the timing, and adjust when an account locks out or a defense kicks in. AI hacking removes most of those limits.

• Timing optimization. Instead of guessing at safe intervals between attempts, AI hacking tools model an organization's lockout policy and pace requests just under the threshold, across thousands of accounts at once.
• Infrastructure rotation. Attackers can spin up and retire proxy chains automatically, so the same source never generates enough failed logins to get flagged.
• Personalization at scale. The same AI hacking approach that makes phishing emails more convincing also builds smarter credential lists, pulling employee names, formats, and likely password patterns from public breach data and social profiles.

Netwrix's research shows the gap is already costing organizations

Netwrix Research Lab surveyed 2,317 IT and security professionals across 1,889 organizations for the 2026 Data and Identity Security Report, and the headline finding lines up with what AI hacking is doing to identity attacks generally. Organizations where AI significantly expanded the number of identities requiring access reported a 43% breach rate over the past 12 months, compared with 11% at organizations where AI hadn't materially changed their identity footprint. That's a four times gap, and it isn't a maturity story. The report found that the organizations leaning hardest into AI were actually further ahead on identity fundamentals. They got breached anyway, because governance built for human-paced change can't keep up with identities and access created at deployment speed, the same speed AI hacking uses against password-based defenses.

The report also found that 76% of organizations don't fully govern or monitor non-human identities, and only 11% have reached full AI security readiness. Download the full 2026 Data and Identity Security Report for the complete breakdown, including industry and regional benchmarks.

Detection catches AI hacking late. Prevention stops it at the door

Behavior analytics and threat detection matter, and they catch a lot of what gets past the first line of defense. But for password spraying specifically, detection is already a step behind. By the time a spray campaign trips an alert, the attacker has already tried the password. Prevention means the weak or breached password was never usable in the first place.

That's the layer Netwrix Password Policy Enforcer is built for.

Where Password Policy Enforcer fits

Password Policy Enforcer checks new and existing passwords against breach databases, such as Have I Been Pwned, before they ever get set, so credentials already exposed in a prior leak get blocked instead of becoming next week's spray target. It layers in dictionary and pattern protection to catch common words, substitutions, and the predictable patterns attackers try first, plus custom complexity rules by user, group, or organizational unit.

Because it runs on the domain controller in Active Directory environments, policy enforcement happens at the point where the password is actually created or changed, not after the fact. Built-in compliance templates for CIS, NIST, HIPAA, and PCI DSS mean the same policy that blocks a spray attempt also satisfies the audit. And real-time feedback tells users why a password was rejected, so the fix happens on the first try instead of a support ticket.

Password policy stops the front door. Data Classification limits what's behind it

Password Policy Enforcer is built to keep a spray attempt from ever succeeding, but no single control closes every path. If an attacker gets in through a phishing email, a third-party breach, or a channel Password Policy Enforcer doesn't cover, what happens next depends on what that account can reach and how exposed it is.

That's where Netwrix Data Classification comes in. It continuously discovers and classifies sensitive data across file servers, SharePoint, Microsoft 365, and cloud repositories, so security teams know where regulated and high-risk data actually lives before an incident, not after. It also flags redundant, obsolete, and trivial data for cleanup, shrinking the amount of exposed data sitting around for an attacker to find in the first place. From there, it feeds that classification into downstream access governance and DLP tools, giving those systems what they need to tighten permissions and controls around what's actually sensitive instead of applying them blindly across everything.

Password Policy Enforcer and Data Classification solve different problems. One keeps a stolen or guessed password from working. The other makes sure that if an account does get compromised anyway, there's less sensitive data sitting in reach and better information about exactly where it is. Together they narrow both ends of the attack: fewer working credentials, and sensitive data classified before an attacker ever finds it.

AI hacking raises the speed of the attack, not the difficulty of defending against it. The fundamentals still hold: enforce credential hygiene and know where sensitive data lives. Get both right, and the attacker's speed stops being an advantage.