Account throttling is the deliberate limiting of how quickly users can create accounts or perform sensitive actions, such as publishing packages, sending messages, or resetting credentials. Instead of blocking everyone outright, the system slows activity that exceeds normal patterns, giving defenders time to inspect suspicious behavior.
In cyber security, throttling matters because abuse often begins with scale: bots register many accounts, test stolen credentials, flood forms, or push malicious content before controls react. Throttling raises the cost of that activity and reduces the impact of automation. Defenders may combine rate limits, IP or device scoring, CAPTCHA, email verification, and temporary freezes when suspicious spikes appear. Attackers, in turn, try to evade these limits by rotating infrastructure or spreading actions across many accounts, which is why throttling works best as part of a broader trust and review process.