Brute-force defense is any control that slows, blocks, or limits repeated attempts to guess a password, PIN, or other authentication secret. Common examples include rate limiting, temporary lockouts, exponential backoff, CAPTCHAs, multi-factor prompts, and alerts after too many failures.
It matters because guessing attacks are simple to automate at scale. On phones and online accounts, a weak or reused credential can be probed thousands of times unless the system adds friction. Good brute-force defenses raise the cost of attack, give defenders time to react, and reduce the chance that an attacker can reach a valid login through trial and error. In practice, these controls appear in device unlock policies, account sign-in protections, and security features that specifically slow repeated authentication failures.