Truer words were never spoken.
For your situation I would isntall the attack blocker AND TURN IT ON.
The Attack Blocker does some rather esoteric crap... but the most important of which for a situation as large as yours...
It regulate the concurrent session use of clients passing through the UT...
The only way a UT stops responding to the network is you've locked out the 10k concurrent session limit.