Tests credentials on a recurrent basis

[martindube]

One of the most important thing to do when you figure out that you were pwned is to CHANGE YOUR PASSWORD.

As a pentester, it would be great to measure the password changes during or after a phishing campaign. One way is to test the credentials on a regular basis (e.g. every six hour or every day).