Comment Re:Missing point (Score 1) 12
It's about being able to trust the response after an incident happens.
If Jane Doe's credentials are used to push malware then in the response you blacklist Jane Doe's credentials and don't trust any fixes from Jane.
But after Jane, it will be Betty, then Ruth. Look at how trolls farm account on social networks to spread fake news. They are constantly blacklisted, and start over under another identity.