Trade a lockout threshold against helpdesk cost and how much of a common-password list an attacker can still test.
A lockout policy hands an attacker a fixed guessing budget: threshold attempts every lockout period, forever. Ten attempts per 15 minutes is 350,400 guesses per account per year, enough to walk a 10,000-entry common-password list 35 times over. Legitimate lockouts run the other way, modelled as a geometric burst — each additional failure in an episode is less likely, so raising the threshold cuts lockouts exponentially. This is the clearest example of a security control with two opposed costs, and the arithmetic shows that lockout duration, not threshold, is the lever that actually starves an online attacker.
Account Lockout Threshold
guesses per account per year = threshold × (60 ÷ lockout minutes) × 24 × 365, and list coverage = that ÷ password list size.
Legitimate lockout volume
legitimate lockouts = users × episodes per year × continuation rate^(threshold − 1).
guesses per account per year = threshold × (60 ÷ lockout minutes) × 24 × 365, and list coverage = that ÷ password list size. A lockout policy hands an attacker a fixed guessing budget: threshold attempts every lockout period, forever. Ten attempts per 15 minutes is 350,400 guesses per account per year, enough to walk a 10,000-entry common-password list 35 times over. Legitimate lockouts run the other way, modelled as a geometric burst — each additional failure in an episode is less likely, so raising the threshold cuts lockouts exponentially.
This is the clearest example of a security control with two opposed costs, and the arithmetic shows that lockout duration, not threshold, is the lever that actually starves an online attacker.
This calculator takes 8 inputs: Failed attempts before lockout, Lockout duration, Users in scope, Failed-login episodes per user per year, Chance an episode produces another failure, Cost per assisted unlock, Unlocks handled by self-service, Size of the attacker's password list. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
NIST SP 800-63B asks for no more than 100 consecutive failed attempts and prefers rate limiting with increasing delays over hard lockouts, because a hard lockout is itself a denial-of-service vector against known usernames.
Because the yearly budget is threshold ÷ lockout duration. Halving the threshold from 10 to 5 halves the budget; extending the lockout from 15 to 60 minutes quarters it, and it inconveniences far fewer legitimate users because most episodes never reach the threshold at all.