Password attacks get discussed as though they're a single problem. They aren't, and treating them that way leads to defences that only address part of the risk.
Brute force is the blunt approach: every possible combination against a single account. It's noisy and account lockout policies handle it reasonably well. Password spraying is the subtler version: take one commonly used password and test it across thousands of accounts, staying under lockout thresholds on each one. It's hard to catch without anomaly detection tuned specifically to that pattern. Credential stuffing relies on leaked breach data, testing known username and password pairs at scale against other services. It works because password reuse remains widespread. Offline attacks are a different category entirely: the attacker already has a copy of your hashed password file and is cracking it on their own hardware, entirely outside your visibility or any lockout control.
Each of these requires a different defensive response. MFA is effective against most online attack methods but provides no protection once an attacker has exfiltrated a hash file. Long, randomly generated passwords resist offline cracking significantly better than complex-but-short ones. Breach monitoring services give early warning on credential stuffing exposure. And detection logic needs to be looking for low-volume, distributed login attempts, not just volume-based anomalies, to catch spraying reliably.
The right control depends on the attack you're actually facing.