Skeleton Key - Lets Admins log in as non-admin users with the admin password.
User Locker - Blocks multiple failed logon attempts.
Capability Manager - One of my favorites, lets you modify current user roles and create new ones. I started using this because Contributors didn't have access to the photo upload.
WP Security Scan - Multiple security features. I liked this because it shows your current installation folder permissions (and most of mine needed to be adjusted). Also blocks things like your WordPress version.
Audit Trail - Great for multi-user blogs, can record all kinds of information. If something ever goes missing or gets broken, this is a good way to track down the source.
Bad Behavior - Another method of blocking malicious users/bots. I was getting crazy amounts of spam (even with Akismet) and this stopped almost all of it.
Akismet - The spam blocker we're probably all quite familiar with.
Anyone have other suggestions?