As an example, with device validation turned on, the user’s account is bound to a physical hardware device. Even if a hacker gets the username and password, they would not have the same hardware device, so any attempt to make a connection would be denied