Executive digital exposure

How it works

Nisos defines executive digital exposure as the publicly available information that can be used to identify, profile or target an executive, and lists public records, breach data, social media activity and property records as examples. Most of that concerns privacy and physical safety: where a leader lives, who their family is, what they post.

One part is narrower and easier to measure. When a service is breached, its stolen records can end up in a breach corpus or a leak database. Those records are tied to a person through an email address, a phone number or a username. For one executive, that part answers three questions: which breaches contain their records, which data types were exposed, and how recent the breaches are. It can be assessed from the outside, with nothing installed and no access to the company network.

How it shows up in executive exposure

Executives often register accounts with personal email addresses and phone numbers long before or alongside their current role. A breach of a retail site, a social network or a fitness app can therefore expose a CEO's credentials even though the company itself was never breached. MITRE ATT&CK (technique T1589.001) notes that credentials gathered during reconnaissance can come from breach dumps, and that adversaries may also buy them from dark web markets or Telegram channels that distribute infostealer logs.

For an attacker, an exposed password, a phone number and a list of past breaches are raw material. They support credential stuffing, targeted phishing, and social engineering against assistants and help desks. For defenders, knowing which executives appear in which breaches shows where to reset passwords and tighten accounts first.

WebThreat's CEM measures this breach and leak part. It discovers executives from a company name, checks each person against breach corpora and leak databases, and ranks the findings by what to fix first, using the factors on the methodology page. Nothing is installed. For the longer explanation, read the article on executive digital exposure.

How to reduce the risk

• Reset any password that appears in a breach, and never reuse it elsewhere.
• Turn on multi-factor authentication for email, banking and social accounts, with hardware keys where possible.
• Use a password manager so every account has a unique password.
• Separate personal and business email addresses where practical, and know which old accounts still exist.
• Brief assistants and family members who can reset accounts on the executive's behalf.

How it differs from related terms

The executive attack surface is wider still: every device, account and channel through which a leader can be attacked, including physical ones. Executive digital exposure is about information. Its breach and leak part is what a breach-data scan sees; listings on people-search sites are another part. Information Removal reduces those: our specialists audit the listings, file the opt-outs and takedown requests and verify each removal. Outside-in monitoring names a method of looking, not the information itself.