Password attacks

Have the island do password attacks on hashes and try to figure out the plaintext password. limit resource-wise (the web and BE always take priority thread wise for example). If it manages to figure out the password (dictionary, too short, etc.) then it should be changed and the user ought to be alerted. Doesn't make the tool slower but creates value. The value could be very visible: if it doesn't crack it the report could write "tried to crack passwords with 16,000,000,000 attempts and failed - good job".
cloud endpoint is scary but that would work way better
machine is strong == really really really strong
we could try to crack NTLM for basic stuff
more than we try brute force attempts
we can try to say top 10000 passwords
NTLM rainbow table sizes start from 50GB and scale to 690GB for basic passwords.
if we want, better to start from cracking. top 1000 passwords should take a few seconds on a background thread on a weak PC