Use multifactor authentication
When users are required to offer more than one form of authentication, such as both a password and a fingerprint or a password and a one-time security token, a brute force attack is less likely to succeed.
Implement IT hygiene
Gain visibility into the use of credentials across the environment  and require passwords to be changed regularly.
Set up policies that reject weak passwords
Longer passwords are not always better. What really helps is to require a mix of upper- and lowercase letters mixed with special characters. Educate users on best password practices, such as avoiding adding four numbers at the end and avoiding common numbers, such those beginning with 1 or 2. Provide a password management tool to prevent users from resorting to easily-remembered passwords and use a discovery tool that exposes default passwords on devices that haven’t been changed.
Implement proactive threat hunting
Threat hunting can expose the types of attacks that standard security measures can miss. If a brute force attack has been used to successfully enter the system, a threat hunter can detect the attack even though it’s operating under the guise of legitimate credentials.