How CEM measures executive exposure

What CEM does with a company name

CEM finds your leadership team from the company name, with each person's current and past email addresses. Managers and employees can be added. There is nothing to install and CEM needs no access to your infrastructure, so the first findings arrive within minutes.

Each person is then checked for leaked credentials and exposed personal data. For every finding CEM records what was exposed, in which breach and when, so your team can see which passwords, phone numbers and other personal details are out there and fix the most urgent ones first.

Where the data comes from

CEM checks each person against breach corpora and leak databases: collections of records from past breaches and leaks. What CEM reports is what those sources hold about the person at the time of the scan.

How findings are ranked

A leaked password matters more than other exposed details, a recent breach more than an old one, and a breach that hit several of your colleagues more than one that hit a single person. CEM ranks findings by these factors so the list starts with what to fix first. The score sums the same factors up in one number per person. The rest of this page states exactly how.

The exposure score in brief

Each scanned person gets a score from 0 to 100: 60% behavior risk and 40% vendor risk, both calculated from the records found for that person when they were scanned. Every score belongs to one of four bands: Critical, High, Medium or Low.

Behavior risk: 60% of the score

This half looks at what the person's own records show.

• How many records are exposed. Each exposed record adds to the score.
• Which data types are exposed. An exposed email address, phone number or password each adds a fixed amount once, however many records of that type there are.
• Likely password reuse. When a password is exposed and the person appears in more than three breaches, the score rises again.
• Breaches across many platforms. A person found in breaches of more than five different services gets a further 3 points for each platform beyond five.

Behavior risk is capped at 100.

Vendor risk: 40% of the score

This half looks at the breaches themselves. Each breach the person appears in adds to it, and a breach counts for more when:

• its severity is higher (see below);
• colleagues appear in the same breach, with more added for each person at the company it affects;
• it is recent: a breach from the last 6 months adds the most, one from the last 12 months adds less, one from the last 24 months adds less again, and an older breach adds nothing for recency. A breach without a known date adds nothing for recency.

Vendor risk is capped at 100. Recency is built in because a password exposed years ago may have been changed since, so older breaches add less to the vendor half than recent ones.

How severity is rated

A breach record's severity is set from the data it exposes. Sources differ, but a record is typically rated critical when it exposes a password, payment card or social security number, high when it exposes an email address, phone number or username, and medium otherwise. Severity counts only in the vendor half of the score.

Score bands

• Critical: 75 and above
• High: 50 to 74
• Medium: 25 to 49
• Low: below 25

A person who has been scanned and has no findings scores 0 and is Low. A person who has not been scanned yet has no score: the band reads Unknown, never Low.

Company score

A company's score is a weighted average of the scores of its scanned executives. Roles are read from each person's job title, and more senior roles count for more:

• Titles that name a chief, founder, owner, president or chairman, or a C-suite abbreviation such as CEO or CFO: weight 3
• VP, SVP and EVP titles, including a spelled-out Vice President: weight 2.5
• Director and Head of titles: weight 2
• Manager, Lead and Principal titles: weight 1.5
• Everyone else: weight 1

The weight sets how much a person counts toward the company average. It never changes that person's own score or band, and because the result is an average, a weight of 3 does not triple anyone's score. People who have not been scanned are left out of the average, and a company with nobody scanned has no score: it shows Unknown, never Low.

Beyond breach data: removal and leak intelligence

• CEM measures what has leaked about a person in breach data. Listings on people-search and data broker sites are the work of Information Removal, where specialists file the opt-outs and takedown requests.
• Stolen data offered on dark web forums, Telegram channels and leak databases is watched by EDG3, which links reposted copies to the first post and shows who is selling.

References

• CEM: request a demo and see your own leadership team's leaked credentials.
• Editorial policy: how WebThreat Research names its sources and dates corrections.