If you were tasked with testing an organization’s password security, what would you prioritize first: trying credential stuffing with real-world breach data, attempting brute force against weak accounts, or assessing the organization’s password policy and controls? From a CISSP perspective, which approach best balances technical depth with business risk?