Also, there’s no lockdown after X attempts. I can try infinitely, as far as I’m aware.
Eh, AFAIK that’s not a best practice anyway, at least not any low number. From what I recall, the recommendation is to either have a high number of attempts that causes a lockout (50+?) or high-priority alerts when a large number of invalid attempts is detected. One of the problems with lockouts based on X attempts, especially low numbers like you often see, at least in my mind, is that it opens people up to a denial of service attack. Let’s say that all account names are predictable, like first initial and last name. A rogue user could lock out anyone they wanted to with that knowledge. What if they know or can easily predict the usernames for all admins or IT people in the organization and they lock them all out?
That is an absolute nightmare.