Once an authentication failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.

NB: the key concept for this card is permitting access, even though authentication checks were undertaken and detected a failure. See AT 4 for the similar authorization failure.