In 1986-1987 I was an admin for a VMS 4.2 (or 4.1 or 4.3) system in college. I recall that at some point, there was a problem that caused the DECwriter console to spew messages to the effect of "INTRUSION COUNTERMEASURES ACTIVATED". I think the problem was actually a bad serial line or terminal; i.e., not an actual intruder trying to brute-force entry. We only had a handful of serial terminals on this Vax 11/750, all in the same room. My question is: what are these "countermeasures" the console message spoke of? (I would guess some sort of account lockout)
Edit: Looking at the documentation linked in the comment, my memory says that maybe the terminology in the console messages may have been "intrusion evasion activated".