“Your authentication system should have some type of a some type of a tie-in to those hashes that have been dumped before.”

Transcript evidence from Chris and Robert -- Passwords, Identity, and #AppSec.