docs: protected Set<Event> handlePossibleSuspiciousAttempt(final HttpServletRequest request, final Authentication authentication,
                                                           final RegisteredService service) {
  
          getWebflowEventResolutionConfigurationContext().getEventPublisher()
              .publishEvent(new CasRiskBasedAuthenticationEvaluationStartedEvent(this, authentication, service));
  
          LOGGER.debug("Evaluating possible suspicious authentication attempt for [{}]", authentication.getPrincipal());
          val score = authenticationRiskEvaluator.eval(authentication, service, request);
  
          if (score.isRiskGreaterThan(threshold)) {
              getWebflowEventResolutionConfigurationContext().getEventPublisher()
                  .publishEvent(new CasRiskyAuthenticationDetectedEvent(this, authentication, service, score));
  
              LOGGER.debug("Calculated risk score [{}] for authentication request by [{}] is above the risk threshold [{}].",
                  score.getScore(),
                  authentication.getPrincipal(),
                  threshold);
  
              getWebflowEventResolutionConfigurationContext().getEventPublisher()
                  .publishEvent(new CasRiskBasedAuthenticationMitigationStartedEvent(this, authentication, service, score));
              val res = authenticationRiskMitigator.mitigate(authentication, service, score, request);
              getWebflowEventResolutionConfigurationContext().getEventPublisher()
                  .publishEvent(new CasRiskyAuthenticationMitigatedEvent(this, authentication, service, res));
  
              return CollectionUtils.wrapSet(res.getResult());
          }
  
          LOGGER.debug("Authentication request for [{}] is below the risk threshold", authentication.getPrincipal());
          return null;
      }