ADAM PULSE Why do hackers keep trying simple passwords?
The short answer: Attackers keep trying simple passwords because simple passwords still work.
They do not need every password attempt to succeed.
They do not need most attempts to succeed.
When software can automatically test credentials against thousands or millions of systems, even a very small success rate can make the attack worthwhile.
This is one of the most important things businesses need to understand about modern cyberattacks:
> The attacker does not need to guess your password personally. A computer can do the guessing for them.
And computers do not get bored. They do not go home. They do not get tired of receiving Incorrect password. They simply try again.
That changes password security from a human problem into an automation problem.
Why Would a Hacker Try a Password Like “123456”?
Because somebody somewhere is still using it.
Attackers understand human behavior. People choose passwords they can remember. That often leads to predictable choices involving simple number sequences, common words, company names, seasons, years, sports teams, locations, keyboard patterns, default passwords, and variations of previous passwords.
Attackers do not have to randomly guess every possible combination. They can start with the passwords humans are most likely to choose.
What Is a Brute Force Attack?
A brute force attack repeatedly attempts different passwords until the correct one is discovered.
Computers make this scalable. An attacker does not need to sit at a keyboard typing passwords individually. Software can automate the attempts.
Does Brute Force Mean Trying Every Possible Password?
Not always. Attackers can begin with common passwords, password dictionaries, known default credentials, common username patterns, previously breached passwords, company related words, and predictable variations.
Attackers generally want efficiency.
What Is a Dictionary Attack?
A dictionary attack uses a prepared collection of likely passwords rather than generating every possible combination. Automation makes testing thousands or millions of variations inexpensive.
Why Are Company Names Bad Passwords?
Because attackers can learn your company name. Public information can help attackers construct more targeted password lists.
What Is Password Spraying?
Password spraying reverses the traditional brute force approach. Instead of one account plus thousands of passwords, the attacker may try one common password against many accounts.
This can help avoid protections designed to lock a single account after repeated failures.
Password Spraying vs. Brute Force
Traditional brute force: One account, many password guesses.
Password spraying: Many accounts, a small number of likely passwords.
Both exploit predictable credentials, but their behavior can look different in security logs.
What Is Credential Stuffing?
Credential stuffing uses credentials that were already exposed somewhere else.
If an employee reuses the same password for a personal service and a business account, a breach of the personal service may give criminals a credential they can automatically test against the business service.
No password cracking may be required.
Why Password Reuse Is So Dangerous
A password can be difficult to guess and still be dangerous if it is reused.
> A strong password is not necessarily a safe password if it is reused.
The FTC advises businesses never to reuse passwords and recommends MFA for employees, contractors, vendors, and others accessing business networks and devices.
Source: Federal Trade Commission, Cybersecurity for Small Business https://www.ftc.gov/business-guidance/small-businesses/cybersecurity
What Are Default Credentials?
Many devices and applications have historically shipped with preset usernames and passwords. The danger occurs when the organization installs the equipment and never changes them.
Why Would a Hacker Try “admin”?
Because administrative account names are predictable. Accounts such as admin, administrator, root, and support are logical places to start.
Why Would an Attacker Try a Blank Password?
Because automated testing is inexpensive. Trying a blank password costs almost nothing.
> Attackers test assumptions businesses think are too obvious to matter.
Most attempts fail. Attackers only need the exceptions.
Why Automation Changes Everything
Automated systems can scan, identify login services, try common usernames and passwords, record results, and move to the next target continuously.
Why Attackers Can Afford to Fail Thousands of Times
Each automated failure costs almost nothing. If 99,999 attempts fail but one succeeds, that successful login may still make the campaign worthwhile.
Why Account Lockout Helps
Account lockout and login throttling can make repeated password guessing harder. The FTC recommends limiting unsuccessful login attempts as a defense against password guessing attacks.
Can Attackers Abuse Account Lockouts?
Potentially. Authentication security should not rely on one mechanism alone. Organizations should combine strong authentication, MFA, rate limiting, monitoring, risk based controls, and appropriate account policies.
What Is MFA?
MFA stands for multifactor authentication. It requires more than one authentication factor.
The FTC recommends MFA for employees, contractors, and others accessing business networks and devices.
Why Does MFA Matter If My Password Is Strong?
Strong passwords can still be phished, reused, stolen, exposed in a breach, captured by malware, or accidentally shared.
MFA changes the attacker's problem. A stolen password alone may no longer be sufficient.
Does MFA Make Passwords Unimportant?
No. MFA is an additional layer. Strong unique credentials, MFA, and login monitoring work together.
What Makes a Good Business Password?
The FTC recommends passwords of at least 12 characters and notes that longer is stronger. It also recommends considering passphrases, avoiding password reuse, and limiting failed login attempts.
What Is a Passphrase?
A passphrase uses multiple words or a longer memorable sequence instead of a short password. The phrase still needs to be unpredictable.
Should Employees Change Passwords Every 30 or 90 Days?
Modern authentication guidance increasingly focuses on strong, unique credentials and changing passwords when compromise is suspected or known rather than mechanical rotation without cause.
What Is a Password Manager?
A password manager helps users create and store unique credentials, reducing password reuse and predictable variations.
Should Businesses Use Password Managers?
For many organizations, yes. Useful capabilities can include unique password generation, secure credential storage, shared credential management, access removal, administrative controls, and auditing.
Shared Passwords Create Accountability Problems
When several technicians use one shared administrator credential, determining who made a change becomes difficult. Individual accounts improve accountability.
Every Administrator Should Be Identifiable
Where supported, privileged access should map to identifiable individuals so logs can meaningfully answer who performed an action.
Why Former Employee Accounts Matter
Offboarding should address the full identity footprint, including email, VPN, firewall, server, cloud applications, remote support systems, vendor portals, and password managers.
Why Vendor Accounts Matter Too
Businesses should know whether vendors still need access, whether accounts are individual or shared, whether MFA is enabled, what each account can reach, and whether access expires.
What Is a Service Account?
Service accounts are identities used by applications, scripts, integrations, and automated processes. They may hold significant privileges and require governance.
Why Passwords Stored in Scripts Are Dangerous
Credentials placed directly in scripts, configuration files, spreadsheets, documentation, notes, or source code create additional exposure. Appropriate secrets management should be used where possible.
What Is Credential Theft?
Credential theft occurs when attackers obtain authentication information through phishing, malware, breaches, social engineering, poor storage, shared credentials, or compromised devices.
Brute Force vs. Credential Theft
Brute force: The attacker does not know the password and tries to guess it.
Credential theft: The attacker obtains the password and uses it.
What Is a Valid Account Attack?
Sometimes attackers simply authenticate using legitimate stolen credentials. The system may see a correct username and password even though the person using them is unauthorized.
Why Successful Logins Matter More Than Huge Failure Counts
Twenty five thousand failed login attempts deserve attention. But a series of failures followed by a successful login may be much more concerning.
> Do not only ask how many attacks occurred. Ask whether anything worked.
Why Baselines Matter
Authentication that differs significantly from normal user behavior may deserve investigation. Context can include time, device, location, privilege, and subsequent activity.
Impossible Travel and Location Alerts
Geographic authentication signals can be useful, but VPNs, proxies, mobile networks, and cloud infrastructure mean location should be treated as a signal rather than proof.
What Is Account Enumeration?
Attackers may attempt to determine which usernames exist before attacking passwords. Authentication systems should avoid unnecessarily revealing valid identities.
Can Attackers Guess Usernames Too?
Yes. Public company websites, LinkedIn, press releases, directories, and predictable email naming conventions can help attackers identify likely usernames.
Are Passwords Going Away?
Passkeys and passwordless technologies are becoming more common, but passwords will remain part of many business environments for years.
What Is a Passkey?
A passkey uses cryptographic authentication rather than requiring a traditional reusable password to be transmitted to a service.
What About Network Devices That Do Not Support Modern Authentication?
Older routers, switches, cameras, appliances, and embedded systems may require compensating controls such as network restrictions, administrative segmentation, VPN access, IP allowlisting, strong unique credentials, monitoring, and lifecycle replacement.
Default Passwords Are Also a Product Design Problem
CISA's Secure by Design initiative has encouraged technology manufacturers to eliminate default passwords and make secure configurations the default.
Source: CISA, Secure by Design https://www.cisa.gov/securebydesign
But Businesses Still Need to Check Existing Equipment
Organizations should review routers, firewalls, cameras, wireless access points, printers, storage devices, and IoT systems for default credentials and insecure management configurations.
Why Routers Deserve Special Attention
The FTC recommends changing preset router passwords and keeping router software current.
Source: FTC, Cybersecurity for Small Business: Secure Remote Access https://www.ftc.gov/business-guidance/blog/2019/02/cybersecurity-small-business-secure-remote-access
Authentication Is Really an Identity Lifecycle
A business identity has a lifecycle:
Join: Employee or vendor receives appropriate access.
Change: Responsibilities and privileges evolve.
Review: Access is periodically verified.
Leave: Access is removed promptly.
What Is Least Privilege?
Least privilege means giving accounts only the permissions necessary for their jobs. Strong authentication reduces the chance of compromise. Least privilege reduces the impact if compromise still occurs.
Why MFA and Least Privilege Work Together
Strong unique passwords, MFA, limited administrative scope, and monitoring create layered security.
Where USA Telecom and ADAM Fit
USA Telecom and ADAM are not replacements for identity providers, MFA platforms, password managers, privileged access management, or endpoint security.
Credential attacks can, however, create operational signals worth investigating, including repeated authentication failures, unexpected administrative access, remote access problems, firewall configuration changes, unusual device behavior, and service interruptions after unauthorized changes.
Identity systems ask:
Who authenticated?
Network monitoring asks:
What happened to the infrastructure?
Together, those signals can tell a much more useful story.
Attackers Automate Credentials. Defenders Need to Automate Awareness.
Attackers automate scanning, username discovery, password guessing, credential testing, and exploitation.
Defenders need to automate inventory, authentication monitoring, alerting, correlation, access review, and response.
Automation should help humans find the events that deserve investigation.
25 Password and Identity Questions Every Business Should Ask
- Do any devices still use manufacturer default passwords?
- Are employees reusing business passwords elsewhere?
- Is MFA enabled for business applications?
- Is MFA required for administrators?
- Is MFA required for remote access?
- Are VPN accounts individually assigned?
- Are administrator accounts shared?
- Do vendors have individual accounts?
- Are former vendor accounts disabled?
- Are former employee accounts disabled promptly?
- Do we limit failed login attempts where appropriate?
- Can we detect password spraying?
- Can we detect repeated authentication failures?
- Can we detect unusual successful logins?
- Do employees use a password manager?
- Are passwords unique?
- Are service accounts inventoried?
- Who owns each service account?
- Are credentials stored inside scripts?
- Are credentials stored in spreadsheets?
- Are privileged accounts separate from everyday user accounts?
- Are old default administrator accounts disabled?
- Do older network devices support modern authentication?
- What is our plan for equipment that cannot support stronger authentication?
- Would we know if a stolen password successfully logged in tonight?
Key Takeaway
Attackers try blank passwords, root, administrator, and simple number sequences because automation makes the cost almost zero.
Businesses should change default passwords, use long unique credentials, avoid password reuse, enable MFA, limit failed authentication attempts, protect privileged accounts, eliminate unnecessary shared accounts, review vendor access, manage service accounts, monitor authentication, investigate successful anomalies, and deprovision access when people leave.
> Attackers do not keep trying simple passwords because the attackers are simple. They keep trying them because simple passwords still work.
The objective should not be to create passwords that merely satisfy a policy.
The objective should be to create an identity environment where guessing, stealing, or reusing one credential is not enough to compromise the business.
Frequently asked questions
Why do hackers try simple passwords?
Because simple and predictable passwords are still used, and automated tools make testing them inexpensive.
What is a brute force attack?
A brute force attack repeatedly attempts passwords or authentication combinations until a correct credential is found.
What is a dictionary attack?
A dictionary attack uses a prepared collection of likely passwords and common variations.
What is password spraying?
Password spraying tries a small number of likely passwords across many accounts.
What is credential stuffing?
Credential stuffing uses usernames and passwords exposed in previous breaches and tests them against other services.
Why is password reuse dangerous?
Because a password exposed by one service may allow attackers to access other accounts where it was reused.
What are default credentials?
Default credentials are usernames and passwords provided with a device or application before the customer configures its own authentication.
Should default passwords always be changed?
Yes. Businesses should change default manufacturer passwords.
Why do hackers try admin and administrator?
Because administrative account names can be predictable and may provide valuable privileges.
Why would hackers try a blank password?
Because automated testing is inexpensive, and occasionally a misconfigured system may permit one.
Does account lockout stop brute force attacks?
It can make repeated guessing more difficult, but it should be part of a broader authentication strategy.
What is MFA?
Multifactor authentication requires more than one authentication factor before access is granted.
Does MFA stop stolen passwords?
MFA can significantly reduce the usefulness of a stolen password because another authentication factor is required.
Should every employee use MFA?
The FTC recommends MFA for employees, contractors, and others accessing business networks and devices.
How long should a password be?
FTC small business guidance recommends at least 12 characters and emphasizes that longer passwords are stronger.
Should I reuse a strong password?
No. A strong password can still become compromised elsewhere.
Should businesses use password managers?
Password managers can help organizations maintain unique credentials.
Are shared administrator passwords dangerous?
They can create security and accountability problems.
Should former employee accounts be deleted?
Organizations should promptly disable or appropriately deprovision access that is no longer authorized.
Should vendors use separate accounts?
Individual vendor identities can improve access control, accountability, auditing, and offboarding.
What is a service account?
A service account is an identity used by software, scripts, applications, or automated systems.
What is a passkey?
A passkey uses cryptographic authentication and can reduce dependence on traditional reusable passwords.
Are passwords going away?
Passwordless authentication is expanding, but many businesses will continue using passwords for existing systems and devices for years.
Sources
- CISA — Require Multifactor Authentication, and the Cross-Sector Cybersecurity Performance Goals, goal 2.H on phishing-resistant MFA.
- FTC — Start with Security: A Guide for Business (August 2023).
- FTC — How To Secure Your Home Wi-Fi Network.
- FTC — Cybersecurity for Small Business.
- NIST — The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29, 26 February 2024).
Cybersecurity risk and the controls appropriate to it vary by organization. Evaluate these recommendations against your own technology environment, business requirements, regulatory obligations, threat profile and risk tolerance.
USA Telecom Consulting LLC is a Service-Disabled Veteran-Owned Small Business running a 24/7 NOC. We monitor networks, circuits and firewalls for regulated and defense-supply-chain organizations.