The vulnerability of a municipal well in the Northwest well field in southeastern Florida to potential contamination by Cryptosporidium parvum oocysts was assessed in a large‐scale, forced‐gradient (convergent) injection and recovery test. The field study involved a simultaneous pulse introduction of a nonreactive tracer (SF₆, an inert gas) and oocyst‐sized (1.6, 2.9, and 4.9 μm diameter) carboxylated polystyrene microspheres into karst limestone of the Biscayne aquifer characterized by a complex triple (matrix, touching‐vug, and conduit) porosity. Fractional recoveries 97 m down gradient were inversely related to diameter and ranged from 2.9% for the 4.9 μm microspheres to 5.8% for 1.6 μm microspheres. Their centers of mass arrived at the pumping well approximately threefold earlier than that of the nonreactive tracer SF₆ (gas), underscoring the need for use of colloid tracers and field‐scale tracer tests for these kinds of evaluations. In a modified triaxial cell using near in situ chemical conditions, 2.9 and 4.9 μm microspheres underestimated by fourfold to sixfold the attachment potential of the less electronegative 2.9–4.1 μm oocysts in the matrix porosity of limestone core samples. The field and laboratory results collectively suggested that it may take 200–300 m of transport to ensure even a 1‐log unit removal of oocysts, even though the limestone surfaces exhibited a substantive capability for their sorptive removal. The study further demonstrated the utility of microspheres as oocyst surrogates in field‐scale assessments of well vulnerability in limestone, provided that differences in attachment behaviors between oocysts and microspheres are taken into account.