Executive attack surface
The executive attack surface is the set of points where an attacker can reach a company through its leaders: their accounts, devices, contact details, public profiles, family information and the data about them in breaches. WebThreat measures its breach-data layer with CEM and its listing layer with Information Removal.
Current as of · Editorial policy
How it works
NIST defines an attack surface as the set of points on the boundary of a system, a system component or an environment where an attacker can try to enter, cause an effect on, or extract data from. Applied to leadership, the system is the person together with the accounts and information that identify them.
An executive's surface includes work and personal email, phone numbers, social media, home address records, family members' accounts, travel details and anything about them already sitting in stolen data.
Why leaders are a distinct surface
Executives hold authority. A convincing request that appears to come from an executive can carry more weight with staff than one from a peer. The UK National Cyber Security Centre describes whaling as a type of spear phishing that targets a "big phish", such as a board member who has access to valuable assets. Its guidance asks organizations to consider which details on their website are unnecessary but could help attackers, and calls this particularly important for high-profile staff.
Executives also mix personal and professional life. A personal account that reuses a work password, or a personal phone number tied to a work account, joins two surfaces that security programs usually treat as separate. Executive personal accounts in breach data looks at that overlap.
What can be measured from outside
Part of the surface is visible in breach corpora and leak databases: which records exist for a person, what they contain and how recent the breaches are. CEM measures that part from outside with nothing installed, ranking each leader's findings with published factors (see the methodology). Information Removal covers the listing layer: our specialists audit people-search and data broker listings about executives, file the opt-outs and takedown requests and verify each removal. Closed listings are re-checked every 30 days.
Reducing the risk
Reduce what is published about leadership, separate personal and work credentials, use multi-factor authentication everywhere it is offered, and agree payment and access verification routines that do not rely on recognizing a voice or an email style. Review the surface on a schedule the organization chooses, and after any breach notice that names a leader. See executive digital exposure for the breach-data layer.
How it differs from related terms
The company's attack surface covers its systems. The executive attack surface covers people. Outside-in monitoring is one method of observing part of it.
Frequently asked questions
Is the executive attack surface only about cyber risk?
No. It also includes physical and reputational paths, such as published home addresses that support doxxing or swatting. CEM covers the breach-data layer, and WebThreat's information removal specialists file the opt-outs for the people-search listings that publish home addresses.
Does breach exposure data describe the whole surface?
No. CEM shows each leader's exposure in breach corpora and leak databases, which is the layer an attacker can research from outside. Listings on people-search sites are handled by Information Removal.
Sources
- Attack surface (NIST CSRC Glossary), NIST Computer Security Resource Center, accessed
- Phishing attacks: defending your organisation (NCSC guidance), UK National Cyber Security Centre, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.