Your Login Page Could Be Giving Attackers Too Many Chances

In partnership with

Blu Dot surpasses 2,000% ROAS with self-serve CTV ads

Home furniture brand Blu Dot blew up on CTV with help from Roku Ads Manager. Here’s how:

After a test campaign reached 211,000 households and achieved 1,010% ROAS, the brand went all in to promote its annual sales event. It removed age and income constraints to expand reach and shifted budget to custom audiences and retargeting, where intent was strongest.

The results speak for themselves. As Blu Dot increased their investment by 10x, ROAS jumped to 2,308% and more page-view conversions surpassed 50,000.

“For CTV campaigns, Roku has been a top performer,” said Claire Folkestad, Paid Media Strategist, Blu Dot. “Comping to our other platforms, we have seen really strong ROAS… and highly efficient CPMs, lower than any other CTV partner we've worked with.”

Using Roku Ads Manager, the campaign moved from a pilot to a permanent performance engine for the brand.

Learn More

Login Pages Are Constantly Under Attack

Every publicly accessible authentication page is a potential target for automated attacks. Attackers use bots to test stolen credentials, guess weak passwords, and identify accounts with insufficient protection.

Credential Stuffing Exploits Password Reuse

When credentials leak from one service, attackers can automatically test those same combinations against other platforms. A password exposed in an unrelated breach can become the key to a corporate account.

Unlimited Login Attempts Create Opportunity

Authentication systems without effective rate limiting, suspicious-activity detection, or additional verification allow attackers to test large numbers of credentials with relatively little resistance.

How Jennifer Aniston’s LolaVie brand grew sales 40% with CTV ads

The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.

Learn more

Distributed Attacks Are Harder to Recognize

Attackers can spread login attempts across multiple IP addresses, devices, and geographic locations to avoid simple blocking rules and traditional detection thresholds.

Account Lockouts Need Careful Design

Aggressive lockout policies can stop brute-force attempts, but they can also be abused to deny legitimate users access. Strong defenses must balance protection with availability.

Make Automated Account Takeovers Expensive

Enforce phishing-resistant MFA, block known compromised passwords, apply adaptive rate limiting, monitor abnormal authentication patterns, and investigate credential-stuffing activity. Your login page should welcome legitimate users — not provide unlimited opportunities for attackers.

State of Product reveals what AI still hasn’t solved

80% of product professionals say AI helps them ship faster, but customers aren’t seeing value any sooner. Atlassian’s State of Product 2027 explores the gains AI is delivering and the challenges that remain, from decision-making that hasn’t kept pace to gut instinct overriding customer evidence.

Read the report