When an attacker attempts to log in to a website with a username that does not exist, the website should display a message indicating that the username does not exist. This will prevent the attacker from knowing whether or not they have guessed a valid username.
If the website simply displays the message "Incorrect username or password," the attacker will be able to keep trying different usernames until they find one that works. This could allow the attacker to gain access to the website even if they do not know the correct password.
Username lockout is a security feature that prevents an attacker from trying to log in with a particular username too many times. If an attacker exceeds the lockout threshold, they will be temporarily blocked from trying to log in with that username. This will make it more difficult for the attacker to gain access to the website.
In this case, the analyst should recommend that the client enable username lockout to prevent the attacker from guessing valid usernames.