Identity & access
Compromised credentials
We detect, in breaches and information-stealer logs, the passwords tied to your domains, and tell you which ones still open an access. Compromised-credential monitoring detects, in data breaches and information-stealer logs, the address-and-password pairs tied to your domains, and tells you which ones still open an access.
The problem
A work address is the login on dozens of services you do not control. When one of them leaks, or an infected device sends back what was typed, the password circulates and can be replayed against your email, your VPN or your SSO. You usually learn about it the day a login succeeds. Our collection partners see those leaks and logs as soon as they circulate, often weeks before that login.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: this screen in your client area, refreshed at every synchronisation, with CSV and JSON export.
- 01
The exposed identities of your perimeter, with their number of exposures and the most recent one
- 02
For each exposure: the source, its date, the hash type and whether a cleartext password was present, with its length
- 03
The handling status, the owner and the CSV or JSON export for your IAM team
How it works
Our answer in three steps
VesperID ties every credential exposed on your domains to an identity, dates it, sources it and grades it. Neither the value of a password nor the hash supplied by the source is kept: you see what a decision needs, and you reset before an attacker tries.
- 01
You declare your domains, your key addresses and, if you use it, your Microsoft 365 tenant; every domain is verified through a DNS record.
- 02
Our collection partners acquire the breaches and stealer logs as soon as they circulate; the platform ties your identities to them, pulls in the history and deduplicates.
- 03
The platform scores every case and sends it to your channels with the expected action, according to your rules; an analyst qualifies a case at your request.
Where this data comes from
Address-and-password pairs come from the leaked databases and stealer logs our partners acquire as they circulate, from combolists sold on forums and from open-web pastes; VesperID ties them to your identities without keeping the password.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Risk score per identity
Every address gets a score and its reasons: usable password, number of sources, freshness, suspected reuse.
- 02
Takeover class
Possible, likely or immediate, depending on whether a usable password combines with an infected device or a still-valid corporate cookie.
- 03
Accounts to brief
The aggregated accounts feed the cohorts: awareness recommended, access to harden, to watch, with an export for the security team.
What you receive
Compromised credentials
- 01
Alerts by severity, in real time or as a daily digest
- 02
Filterable, exportable table of exposed identities
- 03
Its own section in the monthly posture report
- 04
Password policy recommendations grounded in what was observed
Frequently asked questions
Do you keep the exposed passwords?
No. Neither the value of a password, nor the hash supplied by the source, nor the value of a cookie is stored. We keep metadata: the account concerned, source, dates, hash type, presence and length of a cleartext password. A sensitive item is viewed on demand, masked by default, after re-authentication, and the viewing is logged.
How do we know whether the password is still valid?
We never test a credential against your services. You have the leak date, the observation date and, when the source says so, the reported validity; the only safe answer remains a reset.
Do you monitor personal addresses?
Only as part of executive protection, once the person has accepted the invitation themselves. The enterprise perimeter covers the identifiers attached to domains whose ownership you have proven.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.