01 / Understand
Know what kind of exposure you are reviewing.
Data exposure means information has become available outside its intended audience. A finding may involve an email address, a password, a session token, or confidential business information. The type of data and the way it was obtained determine what to investigate.
The dark web includes sites accessed through specialized networks, such as Tor. Exposure can also appear on public websites, forums, messaging channels and shared files. The location of a listing is context; it is not evidence of its authenticity.
Breach datasets
Records associated with a compromised service may contain account details, contact information or password hashes. Establish which service and data fields are actually involved.
Credential collections
Lists of usernames and passwords can combine material from multiple sources. A large collection can contain duplicates, old credentials and records with incomplete provenance.
Information-stealer logs
Malware on an endpoint can collect credentials and browser data. A service URL in a log may identify where an account was used, rather than a breach of that service.
Leak claims and documents
A post may advertise stolen files or name an organization. Treat the claim, any available sample and independently confirmed facts as separate pieces of evidence.
- Compromised device
Malware runs on a work or personal endpoint.
- Browser data taken
Saved credentials or session data may be copied.
- Account access at risk
An attacker may attempt to reuse the stolen data.
Illustrative path, not proof of an intrusion. Investigate both the account and the device. [1]
Work accounts can be exposed outside the workplace.
An unmanaged or personal device can hold work credentials or browser sessions. Investigate relevant devices as well as the account. Stolen session cookies can sometimes allow access without a fresh password or MFA prompt. [1]
02 / Interpret
Separate historical evidence from current access.
Exposure intelligence records what was observed. Your directory, sign-in logs and endpoint evidence help establish what is happening now. Review both before assigning an outcome.
Three dates can describe three different events.
- ExposureWhen data was taken
May be unknown or based only on a source’s claim.
- PublicationWhen it was shared
Data may be released, resold or reposted later.
- ObservationWhen it was indexed
A recent discovery does not, by itself, date the compromise.
The gaps between events vary. Publication and observation may happen repeatedly.
Keep these dates distinct in reports. If a collection date or source attribution is unavailable, record it as unknown. Repeated appearances can reflect redistribution rather than separate intrusions.
“That URL no longer exists.”
A retired service can remain in historical records. Confirm its ownership and retirement, then check whether the identity or password was reused elsewhere.
“We already disabled that account.”
Confirm its current status and the access that was removed. Consider other accounts, sessions and services within the scope of the exposure.
“The password has already changed.”
Compare the reset history with the available evidence. A reset does not erase the historical record, and session or device concerns may require separate action.
03 / Prioritize
Assess the consequence, not just the record count.
Use the finding’s credibility, the sensitivity of the exposed information, and the account’s current access to set priority. An enabled privileged account with suspicious sign-ins warrants a different response from a retired account with documented remediation.
- Identity: Does the record belong to your organization? Confirm the account, tenant and service; a matching username alone may be ambiguous.
- Access: Is the account enabled? What systems, privileges and business processes can it reach?
- Evidence: Is the finding an address, a credential, a token or a document? What is verified, and what remains uncertain?
- Activity: Do sign-in, application or endpoint records indicate misuse? Is there evidence of a compromised device?
- Remediation: What has already changed, when, and with what confirmed result?
An enabled-account filter helps focus work. It does not make disabled accounts, third-party services or historical exposure irrelevant. Review those where the investigation requires it.
04 / Respond
Move from alert to a documented outcome.
-
Validate and preserve the evidence
Assign an owner. Record the finding reference, affected account or asset, exposed data types and available dates. Preserve necessary evidence in an access-controlled case; keep passwords and session secrets out of email, chat and routine audit notes.
-
Contain credible access risk
Follow your incident-response process. Depending on the evidence, restrict an account, revoke sessions, rotate exposed credentials or contain a suspected endpoint. Coordinate with service owners and preserve evidence before disruptive changes.
-
Address the route of exposure
Investigate suspected malware, unauthorized account changes and credential reuse. Reset passwords through official services from a trusted device. Review authentication methods and strengthen MFA; a password reset alone does not remediate an infected endpoint. [2]
-
Verify, communicate and follow up
Confirm each action’s result in the relevant system. Review subsequent activity, record remaining uncertainty and document why the case can close. Involve your incident, privacy and legal owners when sensitive information or reporting obligations may be affected.
For employees receiving an exposure alert
Contact your IT or security team through a known channel. Share the finding reference, not the exposed secret. Do not visit a leak site, download a sample or try a leaked password to validate the alert. Follow your team’s instructions for account and device recovery.
05 / Investigate
Bring the evidence and the response together.
Sentel brings exposure findings, connected directory context, account investigations and team decisions into one workspace. Security teams can review account status, examine available evidence and associated devices, and maintain a timeline of their response.
Where configured and authorized, response capabilities support actions such as session revocation, account disabling, password resets and authentication-method review. Tickets, operator attribution and action outcomes help teams maintain accountability.
Directory checks and device associations add context. A matched device does not establish where an exposure originated. A confirmed response action records that action’s outcome; closing the exposure still requires a review of the full scope.
Available context and actions depend on connected services, permissions and deployment configuration.
06 / Common questions
Questions worth asking.
Does a company email in a leak prove the company was breached?
No. It may relate to a third-party service, an endpoint infection or another source. Establish the affected system and corroborate the evidence before drawing that conclusion.
Why does a finding remain after remediation?
The historical exposure and its current risk are different records. Keep the evidence alongside the actions and assessment that explain how the risk was addressed.
Does finding nothing mean we are safe?
No monitoring service has complete visibility into every exposure. Continue reviewing internal security telemetry and investigating credible reports.
Will a password reset immediately end every session?
Do not assume it will. Session behavior depends on the identity provider and application. Review session revocation separately and verify the relevant outcomes. [1]
References & further reading
This guide combines Sentel investigation guidance with the following public resources.
