Since they mention Office 365, it's worth noting Microsoft's Smart Lockout tooling has been pretty efficient here imo. https://www.microsoft.com/en-us/microsof

Since they mention Office 365, it's worth noting Microsoft's Smart Lockout tooling has been pretty efficient here imo. https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/05/azure-ad-and-adfs-best-practices-defending-against-password-spray-attacks/ https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/0... There are also some great capabilities like forcing a password reset after multiple "correct password but failed MFA" logons.