Brute-force and authentication alarms are noisy, so teams tune them down — and then miss the one attempt that succeeds. Credential abuse rarely looks dramatic;