Services like HaveIBeenPwned's API, SpyCloud, or Enzoic can check if employee credentials appear in known breaches > - **Multi-factor authentication** — Even valid credentials are useless without the second factor > - **Bot detection** — CAPTCHAs, device fingerprinting, and behavioral analysis to di