Surely you gain more than nothing, even if it's not enough to justify the costs imposed on your users? I often hear that attackers will simply increment the nu

Surely you gain more than nothing, even if it's not enough to justify the costs imposed on your users? I often hear that attackers will simply increment the number at the end of your password, but users apply many different "simple" changes and it's likely that you'd need to try a fair few tries to guess correctly. That might be feasible if you have the new password hash or you're targeting an individual victim, but if you don't, then the password expiry policy offers some defence in depth.