This counter tracks the total number of user accounts that the device has automatically disabled because of repeated login failures, functioning as a lockout-policy tripwire. An admin monitoring this figure can catch both legitimate lockout events (a user who mistyped their password too many times) and, if the count spikes sharply, a credential-stuffing attack systematically triggering lockouts across many accounts. A jump from a baseline of one or two lockouts a week to fifteen in a single hour would be a strong signal to investigate an attack rather than routine user error.