Count how many of the IPs that attacked you were ever actually blocked
Most of us install fail2ban or a blocklist, watch the ban count go up, and stop there. The ban count tells you the tool is running. It does not tell you what fraction of the traffic hitting you it ever covered.
I went looking for that fraction across the boxes I watch. Pull the distinct source IPs out of the auth log for a fixed window, pull the distinct IPs that appear in your ban set or firewall drop rules over the same window, and see how much of the first list appears in the second.
journalctl -u ssh --since "30 days ago" | grep -oE 'from [0-9.]+' | awk '{print $2}' | sort -u > /tmp/seen
iptables -S | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sort -u > /tmp/blocked
comm -12 /tmp/seen /tmp/blocked | wc -l; wc -l < /tmp/seen
Mine came out around a quarter. That is lower than I expected and it is not a scandal, because most of what is left is a single knock that never repeats, and repeat offenders are exactly what a ban threshold is built to catch. But a quarter is a very different mental picture from the one the ban counter gives you.
Two things to watch before you trust your own number. The ban set is a snapshot and expired bans are gone, so read the ratio as a floor. And if your rules live in ipset or nftables rather than plain iptables, the second command reads empty and quietly gives you zero.