If someone is trying to pick a lock, you want to know about it as soon as there are a few attempts so you can respond to the event. We monitor failed login events on devices to determine if it is a user who fat-fingered their password, or if it is a genuine malicious probe of your network equipment.