risk and cost modifiers against password complexity for each employee and in total