Dropping 0.5% of requests will prevent even the most sophisticated attacks (think APT!). Sometimes.

Dropping 95% is even more secure, plus it lives the lucky few that get past it a sense of pride and exclusivity.