Employee / customer split
The split that speeds up triage — the two groups need different responses.
LEAKS Combolists, stealer logs and database leaks
Compromised Assets
Leaks are matched against your attack surface assets; employee, customer and unrelated records are separated. Leaks from the same source file are grouped into a single case.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
The overview counts total leaks, employee leaks, customer/member records, those new in the last 7 days and open cases, and lists the most frequent domains. The record table shows type (combo, stealer, database), identifier, classification, masked password, matched asset, source file and breach date. Leak discovery searches emails, credentials, stealer artefacts, browser history and autofill data.
What it does
Grouping by source
Hundreds of records from the same file collapse into one case.
Leak discovery
Search across combolists, stealer credentials, DB leaks, autofill and browser data.
What you get
- The password-reset list comes straight out.
- Customer account-takeover risk is handled separately.
- The policy tab shows breaches of password rules.
Scenarios featuring this module
Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.