This object counts session setup attempts that were declined specifically due to authentication or authorization failure, with the counter resetting each time the device fires the ciscoRasTooManyFailedAuths notification. Because the counting window resets on that trap, an admin reading a low value here does not necessarily mean things are fine - it may mean the threshold trap just fired and reset the tally, so this should be read alongside the trap history. A sudden run of, say, 50 declined logins in minutes pointing at one username strongly suggests a credential-stuffing or brute-force attempt against that account.