Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.

How should existing security controls be adjusted to prevent this in the future?