What does a failed login event prove?¶

A failed login event proves that the system rejected an authentication attempt or could not complete it.

The reason for failure determines what can safely be inferred.

Avoid this assumption: That every failed login proves someone entered the wrong password. It may not.

A login can fail because the password was wrong, the account was disabled, the token expired, multi-factor authentication was not completed, the device was blocked or the identity service was unavailable.

Automated software can also generate failures. A device may retain an old password. A service may repeatedly attempt to use expired credentials. Security scanners and attackers may both test accounts.

The event may contain the account, source address, device, application, failure code, authentication method and timestamp. Those details can help distinguish user error, stale credentials, automated activity and hostile attempts.

Investigators should obtain the failure-code definition and any sub-status field. Ask whether the account existed, whether authentication reached the password stage and whether the attempt was interactive or automated.

A failed event does not prove that the person knew the account belonged to someone else, intended to gain access or was physically present at the source device. It also does not prove the password entered was close to correct.

Preserve surrounding successes and failures, source addresses, device details and session identifiers. Patterns across multiple accounts or systems may be more informative than a single failure.

Operational takeaway¶

A failed login event shows that authentication was rejected or incomplete, but the technical reason, initiating process and personal intent must be established before drawing wider conclusions.