Account lockout is the safeguard that temporarily blocks sign-in after repeated failed attempts or suspicious activity. Its job is to slow down password guessing enough that automated attacks become impractical, while giving administrators a signal that someone is probing an account.
For employers it deserves attention for a second reason: lockout events against HR, payroll, and self-service accounts are one of the few early warnings an organization gets that its workforce systems are being targeted — and most employers never look at them.
The attack it addresses is credential guessing at scale. Automated tools test thousands of password combinations, or test one leaked password against thousands of accounts. Without lockout, those tools run until they succeed. With it, each account tolerates only a handful of attempts before the door closes.
It does not defend against the more common modern attack — using a password that is already known from a breach or a phishing page, which succeeds on the first attempt and triggers nothing. That is what multi-factor authentication is for. Lockout and MFA are complements, not alternatives.
Lockout policy is a trade between security and disruption, and both extremes fail.
Set too loose — dozens of attempts allowed, or a lockout that clears in a minute — and automated guessing simply paces itself. Set too tight — three attempts, long lockouts, manual unlock only — and ordinary typos lock out legitimate employees daily, the help desk drowns in unlock requests, and staff respond by choosing simpler passwords they cannot mistype.
The workable middle ground for most employers: a moderate threshold, a lockout that clears automatically after a short period, and escalation only on sustained patterns. Progressive delays — each failed attempt slowing the next — achieve the same protection with less disruption than hard lockouts.
A lockout policy can be turned against the workforce. An attacker who knows usernames — and usernames are usually just email addresses — can deliberately fail logins to lock employees out en masse, including at moments chosen for effect, such as the morning payroll closes.
This argues for automatic expiry rather than permanent lockout requiring manual reset, and for alerting when lockouts spike across many accounts at once, which is itself a signal of an attack in progress.
However well the lockout is tuned, the recovery process determines whether it holds. An attacker who cannot guess a password will happily call the help desk pretending to be the locked-out employee.
Unlock requests should be verified the same way any identity claim is: against information the caller did not supply, ideally by calling back a number already on file. A help desk that unlocks accounts based on name and date of birth — both readily available — has converted the lockout control into a social engineering entry point.
This matters doubly for payroll and HR accounts, where the value of a successful unlock is highest.
Lockout events are telemetry, and for workforce systems they are unusually informative:
None of this requires sophisticated tooling — most platforms already record the events. What is usually missing is anyone reviewing them, or an alert routing the high-value cases to a person.
Employer's Guardian helps employers configure and monitor access safeguards across payroll and workforce systems through EGPay workforce management.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.