See where personal exposure creates business risk.

For high profile individuals such as c-suite executives, investors, public figures, and their families.

Agree which individuals, sources and accounts are in scope before the review. The report should distinguish verified findings from leads that need further checks.

The team can explain its collection methods, confidentiality arrangements and handling of sensitive findings before work begins. The assessment can help you:

• Uncover gaps in personal cyber defences.
• Surface fake social and professional media profiles.
• Check what information selected public searches reveal about the individual at the time of the review.
• Discuss whether related staff or family accounts require a separate, appropriately authorised review.
• Identify plausible impersonation or account-takeover scenarios and steps that reduce exposure.
• Reduce the risk of CEO / investor fraud.
• Provide you with an understanding of how threat actors obtain personal information.

Evidence of individual exposure

The report identifies matches found in the sources reviewed. A missing match does not establish that an account or password has never been exposed.

• Plaintext password exposure.
• Weak encryption on key accounts.
• Your data being in active circulation on criminal databases.

What the implication of these exposures are, for example:

Plaintext password exposure

Your password has been acquired with zero protection. Anyone who has this data has your actual password, meaning any accounts you still use it for are extremely vulnerable.

Weak encryption on key accounts

A breach may include password hashes. Whether they can be recovered depends on the hashing method, its parameters and password strength. Secure affected accounts even if the original password was not stored in plaintext.

Your data is in active circulation

A listing or observed copy can show that information is circulating. It does not prove that the information has been sold or used for a particular attack.

What triage actions to take should your report come back with critical issues, such as:

• Use a trusted route to change the affected password and change it anywhere it was reused. Prioritise email and financial accounts.
• Turn on multi-factor authentication where available and review existing sign-in methods.
• Check activity and recovery details on the affected accounts. Revoke unfamiliar sessions and contact the provider if access has been lost.
• Review mailbox forwarding rules, recovery addresses and devices with access.