When a user fails to terminate the session properly

When an intruder accesses another users session

When a succession of failed login attempts have occured

When a user leaves a host during an active session