I think we're all coming back to this question:
**Does your application care WHO is attacking it?**
Imagine someTHING is:
→ trying credentials
→ probing your APIs
→ accessing things it shouldn't
→ exploiting a vulnerability
→ changing its approach when something doesn't work
1/4
