Step by step

How it works.

The outside record of trust in four steps, from your request to the problem fixed. Nothing to install. Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first: we discover every way in we can see, validate every finding, close forged email in your name where we can reach your DNS host, one click per step, and monitor it hourly and daily. For every other way in you get the exact fix, step by step, and we re-check each fix. Everything we report is human-verified before your assessment is released.

Check my firm Methodology
Read-onlyPublic sources onlyNot a pen testHuman-verified
Delivered
Inside 72 hours of confirmation
You get
The full outside watch, the record behind it, and the fix
Then
A recorded walkthrough of your own dashboard and the first month of monitoring
Log-ins
None
01 · The four steps

From your request to a fix you can confirm.

01
You ask
Use the request form, or reply to an email we sent. A name and a work email. Nothing is installed.
02
We discover and validate
Your outside reading: what you show the public internet, and nothing more, with the proof for the lead finding.
03
You order if it is worth it
The External Cybersecurity Assessment reads further, once you authorise it.
04
Delivered, reviewed first
Human-verified, inside 72 hours of confirmation, with a recorded walkthrough of your own dashboard and the first month of the watch.
02 · What is read

Five groups, each with its evidence.

Email and domainThe records that say who may send email as you, your DNS settings and certificates. Evidence: dig TXT _dmarc.yourfirm.com returns the same record for anyone.
Your addressesPresence in monitored breach databases, as addresses found in public sources. Evidence: the breach that listed each address, named and dated.
WebsiteWhat its responses advertise about its software, its security headers, known flaws in the versions shown, and keys left in the page’s own code. Evidence: the response headers and versions your site sends, quoted as read.
Lookalike domainsRegistered domains made from your firm’s name. We tell you which deserve a second look. Evidence: the public record behind each, including when it was registered, whether it is set up for email and whether it has a website. We never say who owns one; we ask: is it yours?
Public recordsBusiness registrations and breach notification filings. Evidence: the registry entry, linked.
03 · What you receive

Human-verified. The proof for every finding, and the fix.

We give you the fix for each finding and re-check from outside until it is closed. The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it. Where it does not, you get the exact records to paste.

With monitoring you are first to know: email settings, look-alikes and new host names re-checked every hour, with an alert within the hour; the rest daily, the same day. A look-alike can be registered any day after your assessment, so monitoring re-checks for new ones every hour.

Your evidence pack: an owner summary, the technical evidence with the fix for each finding, a rules and insurance briefing, and a dated assessment record. It doubles as your insurance renewal evidence pack: the questions insurers commonly ask that the public internet can show, each with its evidence, and forged-email protection where we reach your DNS host, one click per step.

Everything you receive, item by item.

On a paid assessment, our AI agents work your firm from outside, stage by stage:

  • the Discover AI agent reads what your firm shows the public internet with fixed checks
  • the Close AI agent gives you each fix and re-checks it from outside
  • on monitoring fixed checks re-check every hour and every day

Every paid assessment is human-verified before release. After you buy, AI chooses follow-up checks, picks when to re-check from outside, and sorts new changes by which needs you first.

No AI agent can state a finding without a fixed outside check behind it.

What each AI agent does, and what it can never do.

Your assessment comes with your AI security agent, on your dashboard.

  • Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.
  • It drafts a note about any finding, for you to send.
  • It proposes a re-check and runs it only when you approve.
  • Your dashboard shows what our AI agents checked without being asked, and tells you when a re-check finds an opening closed.
  • When it cannot answer, a person replies.
01Owner Summary and Action BriefFor the owner
02Technical Evidence and FindingsEach finding, with its fix
03Rules and Insurance BriefingPrivacy rules and insurer questions
04Assessment RecordDated record, issued by LeakTrace Inc.
Your outside changes

What changes after your assessment, and how often we look.

  • 01A new vendor or tool is allowed to send as you.
  • 02Your mail moves to a new provider.
  • 03A new portal or subdomain goes live.
  • 04A certificate lapses.
  • 05Your addresses turn up in a fresh breach.
  • 06A look-alike of your name is registered.

On monitoring: email settings, look-alikes and new host names hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.

04 · What we never do

Read-only means read-only.

Every limit is written down in the outside reading policy.

Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.

  • Log in to your systems
  • Test, exploit or try to get past anything
  • Change anything without your say-so: you make the changes from our steps, and the forged-email fix, one click per step, works only where we reach your DNS host and changes nothing until you confirm each step
  • Contact your staff
  • Name your business, or any other, publicly
05 · Said plainly

Who LeakTrace is not for.

LeakTrace is for a firm that wants to know what it shows the internet, with the proof for each finding, and to see each way in closed. It is not the right choice for these.

Someone working inside your systemsWe hold no keys to your firm. No login, no install, no mailbox access. We read what your firm shows the internet, the way an attacker reads it, and nothing behind it.
A penetration testWe test nothing, exploit nothing and try to get past nothing. An assessment is a dated reading of your firm, with the evidence for every finding.
Every change made for youWe give you the fix for each finding and re-check from outside until it is closed. The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it.
An IT providerIt does not replace an IT provider. It is an independent reading of your firm, paid for by no one who sells the fixes.
Personal accountsIt reads your firm's own domain and the addresses at it from outside, the way an attacker's tools would. It does not read inside your network or your staff's personal email accounts.
06 · One finding, start to finish

One public record, read the way a mail server reads it.

The setting that fails, what it lets a stranger send in your name, and the fix. Twenty-five seconds, no sound. A constructed example; no firm is named.

07 · Which page next
What you getExactly what you receive, item by item, and who it is not forWhat you get → For a businessCheck my firm, then the External Cybersecurity AssessmentBusiness → For a personThe free check, then the Personal Exposure BriefingIndividual → For an associationA private summary across your membersNetworks →