[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-7":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-7","AC-7","Unsuccessful Logon Attempts",66,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must limit the number of consecutive failed logon attempts within a defined period and, when the limit is exceeded, take a defined action such as locking the account, delaying the next attempt or notifying an administrator.\n\n**In practice.** This means lockout or throttling settings in the identity provider and applications, combined with detection of password spraying across many accounts. Modern identity platforms offer smart lockout that slows attackers without locking out legitimate users. Auditors look for configured thresholds, evidence they apply to all login interfaces and alerting on unusual failure patterns.\n\n**Common gaps.** Lockout settings often apply to the main directory but not to APIs, legacy protocols or custom applications. Password spraying, which stays below per-account thresholds, frequently goes undetected.","a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period] ; and\n  b. Automatically [Selection: lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.\nDiscussion: The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fortibleed-campaign-compromises-86000-devices-via-stolen-credentials","FortiBleed Campaign Compromises 86,000+ Devices via Stolen Credentials","2026-10-09T12:22:00.251+00:00",{"slug":25,"title":26,"published_at":27},"unauthorized-portal-access-exposes-400000-utility-customer-records","Unauthorized Portal Access Exposes 400,000 Utility Customer Records","2026-10-07T16:21:13.362+00:00",{"slug":29,"title":30,"published_at":31},"microsofts-x-account-hijacked-to-push-crypto-scam","Microsoft's X Account Hijacked to Push Crypto Scam","2026-10-02T12:20:21.468+00:00",{"slug":33,"title":34,"published_at":35},"schneider-electric-powerchute-flaw-exposes-systems-to-brute-force-account-takeover","Schneider Electric PowerChute Flaw Exposes Systems to Brute-Force Account Takeover","2026-09-17T19:20:41.474+00:00",{"slug":37,"title":38,"published_at":39},"ai-powered-attacks-are-automating-credential-theft-at-scale","AI-Powered Attacks Are Automating Credential Theft at Scale","2026-09-17T18:22:14.153+00:00",{"slug":41,"title":42,"published_at":43},"compromised-credentials-enable-months-long-telus-account-takeover-campaign","Compromised Credentials Enable Months-Long Telus Account Takeover Campaign","2026-09-14T10:20:22.16+00:00",{"slug":45,"title":46,"published_at":47},"ai-powered-multi-agent-frameworks-accelerate-credential-theft-at-scale","AI-Powered Multi-Agent Frameworks Accelerate Credential Theft at Scale","2026-09-08T14:22:44.797+00:00",{"slug":49,"title":50,"published_at":51},"breeze-comet-exploits-weak-auth-and-unpatched-servers-to-steal-from-brazilian-payment-systems","Breeze Comet Exploits Weak Auth and Unpatched Servers to Steal from Brazilian Payment Systems","2026-09-01T20:21:46.423+00:00",{"slug":53,"title":54,"published_at":55},"ai-powered-phishing-outsmarts-traditional-email-filters","AI-Powered Phishing Outsmarts Traditional Email Filters","2026-08-20T16:21:28.063+00:00",{"slug":57,"title":58,"published_at":59},"phishing-as-a-service-exploits-ringcentral-branding-to-hijack-microsoft-365-accounts","Phishing-as-a-Service Exploits RingCentral Branding to Hijack Microsoft 365 Accounts","2026-08-04T22:20:20.526+00:00",{"slug":61,"title":62,"published_at":63},"credential-stuffing-campaign-compromises-sonicwall-vpn-accounts-at-scale","Credential Stuffing Campaign Compromises SonicWall VPN Accounts at Scale","2026-07-29T14:20:23.57+00:00",{"slug":65,"title":66,"published_at":67},"mikrotik-routeros-vulnerable-to-password-guessing-attacks-due-to-missing-login-protections","MikroTik RouterOS Vulnerable to Password Guessing Attacks Due to Missing Login Protections","2026-07-28T17:20:54.275+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",45,{"slug":75,"name":76,"problem":77,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",44,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",17,{"slug":85,"name":86,"problem":87,"stories":88},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",16,{"slug":90,"name":91,"problem":92,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":94,"name":95,"problem":96,"stories":97},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",8,[99,105,110,116,121,125,130,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","6","Control 6","Access Control Management",56,{"family":5,"item":106,"code":107,"title":108,"together":109},"ac-2","AC-2","Account Management",50,{"family":111,"item":112,"code":113,"title":114,"together":115},"gdpr","32","Article 32","Security of processing",36,{"family":5,"item":117,"code":118,"title":119,"together":120},"ia-2","IA-2","Identification and Authentication (Organizational Users)",25,{"family":100,"item":122,"code":123,"title":108,"together":124},"5","Control 5",20,{"family":5,"item":126,"code":127,"title":128,"together":129},"si-4","SI-4","System Monitoring",19,{"family":131,"item":132,"code":133,"title":134,"together":88},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":5,"item":136,"code":137,"title":138,"together":139},"ia-5","IA-5","Authenticator Management",13]