When implemented properly, even weak passwords can take a long time to crack. I usually implement a time out. For example, after 5 unsuccessful attempts, you'

When implemented properly, even weak passwords can take a long time to crack. I usually implement a time out. For example, after 5 unsuccessful attempts, you're locked out for 3 minutes. After 20 unsuccessful attempts in a row, you need to contact somebody for a reset. You can't crack anything if you can't test your attempts. 2FA adds significant difficulty and can alert others to any attempt. In my experience, most hackers will abort any attempt and move on to greener pastures once they discover 2FA is required.