Brute-force attack
A brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically. Cyber Essentials requires protection by MFA, by throttling to no more than 10 guesses in 5 minutes, or by locking after no more than 10 unsuccessful attempts. A7.10 and A5.7 ask which you use.
- Term
- Brute-force attack
- Also known as
- Brute force, Password guessing attack
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term brute-force attack mean in Cyber Essentials?
A brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
How does brute-force attack apply to Cyber Essentials?
In plain terms
Picture someone trying every combination on a bike lock until it clicks open. A computer can try guesses far faster than a person, so an account that allows unlimited attempts will eventually give way. The defence is to stop or slow the guessing after a handful of wrong tries, or to require a second factor that a guess cannot supply.
What Cyber Essentials asks
The A7.10 guidance defines it as "an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works."
The NCSC requirements say passwords must be protected against brute-force password guessing by at least one of:
- multi-factor authentication
- throttling, where the wait between attempts grows after each wrong guess, allowing "no more than 10 guesses in 5 minutes"
- "locking devices after no more than 10 unsuccessful attempts"
A7.10 asks how this is done for systems that use passwords, including "where passwords are a backup for a passwordless system". A5.7 asks the same for external services you host. The device unlocking rules apply the same protection to biometrics, passwords and PINs, and say that where the vendor does not let you configure it, you use the vendor's default setting.
What an assessor looks for
A7.10 is a written answer. Name the setting on each type of system, for example the account lockout policy on Windows, the sign-in protections on your Microsoft 365 or Google Workspace tenant, and the built-in lockout on phones. Check the numbers: a lockout threshold above 10 does not meet the requirement.
See how passwords must be protected against brute force and A7.10. Related: account lockout, throttling, credential stuffing.
Related terms
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- Credential stuffingCredential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- Conditional accessConditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
Frequently asked questions
A brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
In the 2026 Danzell question set, brute-force attack comes up at A5.7, A7.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Brute-force attack relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.