16 Oct 2026 · HIPAA Journal
American Collection Medical Agency clients agreed to a $6.4 million settlement resolving claims over a major historical data breach. The cyberattack targeted AMCA's web payment portal and exposed sensitive personal, …
This week
American Collection Medical Agency Public report
A Volexity customer Public report
Organizations across 150 countries Public report
Attacker’s-eye view · Evidence-grade · Human-verified
Find how an attacker could get in. Close forged email in your name before it is used.
The outside record of trust between businesses. Attackers use AI to find a way in. LeakTrace checks it first and closes each opening.
See what can be seen of your firm from outside, before you sign. We read it first, and each finding is human-verified before your assessment is released.
No software to install, no access to give, no meeting first.
- FBI IC3, 2025 Internet Crime Report: $3,046,598,558 in reported losses to business email compromise in the United States.
- LeakTrace index, readings to 8 October 2026: 3 in 4 of the professional firms we read have no published rule telling mail servers to refuse mail forged in their name. Read the index
Read-only, from outsideNothing tested or logged intoHuman-verified72 hours from confirmation
Your domain, from outsideFour layers
Domain and email7 mail records
Your addressesBreach records
WebsiteHeaders
Lookalike domainsRegistrations
Domain and email. Whether mail that fakes your address is delivered, and what your domain publishes.
Human-verified before releaseRead-only
01 · What we watch
Attackers read businesses with AI. LeakTrace reads them first. Every finding carries its evidence.
Others hand you a grade to trust. Your reading shows the proof for the lead finding. In the assessment, each finding carries the record, header or listing behind it, with a check anyone can re-run, your insurer included. We also show where separate gaps combine into one route in, the way an attacker's AI tools would connect them, and a person verifies each one first.
Email that can be forged in your name
Evidence: the DMARC record your domain publishes, quoted as it reads today, with the one-line lookup that returns it. Forged-email protection is switched on where we can reach your DNS host, one click per step.
Your addresses in monitored breach databases
Evidence: the addresses we can name and the breaches they are listed in, on your private assessment page. On monitoring, re-checked every day.
Lookalike domains
Evidence: we check for registered domains made from your firm's name and tell you which deserve a second look, with the public record behind each: when it was registered, whether it is set up for email, whether it has a website. We never say who owns one; we ask: is it yours? Your assessment drafts a takedown request for each one worth a second look that you say is not yours, addressed to the registrar's abuse desk, for you to send. A look-alike can be registered any day after your assessment, so monitoring re-checks for new ones every hour, with an alert within the hour.
What your website advertises
Evidence: the headers and software versions your site sends, quoted as read. On monitoring, a flaw newly listed as exploited in the wild is matched to the software your site shows within a day.
The 2026 picture
The ways in have not changed. The speed has.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. Attacks still start the same way: a forged email, a reused password, a login page left unpatched. AI makes each step after that faster and cheaper, and lets every phishing email be written for the person who opens it. A new flaw is now used against businesses within a day, so fixes have to land in days, not weeks.
3 in 4
Of the professional firms we read have no published rule telling mail servers to refuse mail forged in their name. LeakTrace index, readings to 8 October 2026
4 in 10
Professional firms have a look-alike of their domain registered and live. LeakTrace Research, measured 30 Sep 2026
2 in 10
Professional firms have a shared address such as info@ in monitored breach databases. LeakTrace Research, measured 30 Sep 2026
02 · This week · 17 Oct 2026
How attackers got in this week, and what we check for it.
1 organisation was listed on criminal leak sites in the last 7 days. Source: public ransomware leak-site listings.
14 Oct 2026 · Security Affairs
Threat actor UTA0576 compromised a fully patched Ivanti Connect Secure VPN appliance belonging to a customer monitored by cybersecurity firm Volexity. The attacker chained three zero-day vulnerabilities to gain unauthenticated …
- Way in
- A known flaw in software the victim ran.
- We check
- Software versions your site advertises and known flaws in them.
14 Oct 2026 · BleepingComputer
A massive cybercriminal ecosystem targeted over 75,000 organizations across 150 countries with more than a billion malicious messages. Law enforcement and technology partners disrupted the infrastructure, which utilized compromised...
- Way in
- Email made to look like it came from a trusted sender.
- We check
- Whether anyone can send mail that passes as your domain.
03 · What you receive
Human-verified. The full outside watch, the proof for every finding, and the fix.
Every assessment is human-verified before you see it, within 72 hours of confirmation, and the watch keeps running after. Your evidence pack: an owner summary, the technical evidence with the fix for each finding, a rules and insurance briefing, and a dated assessment record. It doubles as your insurance renewal evidence pack: the questions insurers commonly ask that the public internet can show, each with its evidence, and forged-email protection where we reach your DNS host, one click per step.
1Owner Summary and Action BriefFor the owner
2Technical Evidence and FindingsEvery finding, with its fix
3Rules and Insurance BriefingPrivacy rules and insurer questions
4Assessment RecordDated record, issued by LeakTrace Inc.
What the fourth document is. A dated record of what was read from outside your firm, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems. What the third covers. Sets your findings beside the privacy and breach-notice rules for Canada or the United States, and beside the sector rule where one is named: law, health, accounting, and financial and wealth firms. Most technical findings fall under one safeguards rule. Then the questions insurers ask at renewal that an outside read can answer. It is not legal advice.
A recorded walkthrough
A short video of your own dashboard, made at release.
The first month of monitoring
Your domain and its addresses watched for 30 days: email settings, look-alikes and new host names re-checked every hour, with an alert within the hour; the rest daily, with a same-day alert. By email, and in Slack or Microsoft Teams if you connect them.
We close it
We give you the fix for each finding and re-check from outside until it is closed. The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it. Where it does not, you get the exact records to paste.
The other findings
Each of the others carries its exact fix step by step, inside Technical Evidence and Findings. When a fix lands, we re-check it from outside and the record shows it closed, with the date.
Look-alike domains
A look-alike worth a second look that you say is not yours gets a takedown request, drafted.
On your dashboard
Your assessment comes with your AI security agent, on your dashboard.
- Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.
- It drafts a note about any finding, for you to send.
- It proposes a re-check and runs it only when you approve.
- Your dashboard shows what our AI agents checked without being asked, and tells you when a re-check finds an opening closed.
- When it cannot answer, a person replies.
What your AI agents do between assessments
On monitoring, fixed checks re-check your email settings, look-alike domains and new host names every hour, and everything else in full every day.
When they find a change, the Monitor AI agent puts first the one that needs you. When the daily re-check lists something new, the Discover AI agent chooses follow-up checks on it.
On monitoring, when a finding goes from the daily re-check, the Close AI agent confirms it with a fresh read from outside before it is recorded closed.
Each month on a monitoring plan you get a digest of what they did: checks run, changes found, findings confirmed closed. Every paid assessment is human-verified before release.
Outside only
Agent against agent: attackers point AI at firms, and LeakTrace reads them first.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
04 · How it works
Four steps, from your request to the problem fixed. You decide at each one.
1
You ask
Tell us who you are and your domain. A person reads every request and replies within 4 business hours.
2
We discover and validate
Each way in we can find, from public sources only, with a check you can run.
3
You order if it is worth it
Your outside reading shows what the assessment covers. No obligation.
4
Delivered and reviewed
Inside 72 hours of confirmation, human-verified first.
05 · Independence
Every finding is independent: we are paid by no one who sells the fixes.
We are paid by no one who sells the fixes, so every finding is independent. A finding is there because it is true; nothing in it is there to create work for anyone. You get the exact steps for each finding, and we re-check it until it is closed.
Paid by a seller of fixesNever
Your IT providerStays yours
Access neededNone
Your outside changes
What changes after your assessment, and how often we look.
- 01A new vendor or tool is allowed to send as you.
- 02Your mail moves to a new provider.
- 03A new portal or subdomain goes live.
- 04A certificate lapses.
- 05Your addresses turn up in a fresh breach.
- 06A look-alike of your name is registered.
On monitoring: email settings, look-alikes and new host names hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.
06 · How we are different
A different job from the people you already work with.
Your IT provider
Excellent at running your systems. We read what the outside world sees and give you the exact fix for each finding, with the check that proves it. Different job, and independent.
A penetration test
Tries to break in and needs access. We are not a pen test: nothing attacked, nothing installed, no access given. We read only what is already public, and log into nothing.
Your insurer's scan
It can feed your premium and eligibility, and we do not see it. We show you first what anyone can see, in plain words, so you walk into renewal knowing your own answers.
07 · Sectors
Pages written for your line of work.
08 · When we refund
Your assessment will show more than your outside reading. If it does not, we refund it in full.
09 · Questions
What owners ask first.
What do you touch?
Nothing of yours. We read what is public, the way an attacker would.
Do you need access?
No log-ins, no software, no access to your systems.
Who sees it?
You do. An unrequested reading goes privately to your published address; a requested one goes to the address that asked. It is not published or indexed, and we delete it when you ask.
What does it cost?
The assessment is quoted on your outside reading. The reading itself costs nothing.
Do you fix things?
Forged email we close from your assessment page, one click per step, in stages you confirm, where we can reach your DNS host; where we cannot, you get the exact records to paste. For the rest you get the exact fix, step by step, and we re-check each one until it is closed.
How long does it take?
The assessment is delivered inside 72 hours of confirmation.
What is the AI security agent?
It comes with the assessment, on your dashboard. Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.It drafts a note about any finding, for you to send, and proposes a re-check that runs only when you approve.It keeps a log of everything it did, and when it cannot answer, a person replies. Every paid assessment is still human-verified before release.
10 · Check my firm
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
See a sample reading → An invented firm, so you see what arrives before you ask for yours.
Reading requestPrivate
Received
A person reads your firm from outside and emails your outside reading within 72 hours, from [email protected].
What happens next
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
While you wait: the 72 hours · 34 seconds, no sound
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/