A company's website is continuously being brute forced, and its users have reported multiple account intrusions in the last few months. All users are using passwords that are at least 12 characters lo

Account lockout stops brute force but negatively impacts user experience by locking out legitimate users after a set number of failed attempts, which can also be weaponized as a denial-of-service against accounts.

Progressive login delay inserts an exponentially increasing delay after each failed authentication attempt, making automated brute force attacks impractical because the time required to guess credentials becomes prohibitive. Unlike account lockout, it does not deny service to legitimate users who occasionally mistype their password, preserving a positive user experience while directly countering the brute force vector.

Reducing password complexity makes credentials easier to guess and would worsen the brute force and account intrusion problem, not mitigate it.

Passwords are already 12 characters long; increasing length adds marginal resistance to brute force but does not actively throttle or block automated attack attempts.