> modern networks are built with short-lived certificates issued off 2FA from an IdP Modern networks are sadly far too rare; 95%+ of the industry is built on l

> modern networks are built with short-lived certificates issued off 2FA from an IdP Modern networks are sadly far too rare; 95%+ of the industry is built on legacy networks. My take on fail2ban and port knocking are: * they reduce the amounts of logs produced * they defend against fully automated at-scale scans / password stuffing attacks that a well-maintained application wouldn't need defending against, but we all know that in any sufficiently big organization, not all applications and accounts will be well maintained.