Sign-in attempts are rate limited and recorded in the audit log.