45% of organisations who only check for compromised passwords during expiry or reset events average only two checks for compromised passwords per year.