What the term usually means
Services sold under this name watch places where stolen data turns up: collections of passwords from past breaches, paste sites where copied text is posted, and, for some providers, closed forums and marketplaces. They match what they find against the addresses and domains they are watching.
What we read
LeakTrace reads monitored breach databases for the addresses at your firm’s own domain, and the code your own website serves, for keys left in it. We do not crawl criminal forums, and we do not look at anybody’s personal accounts. We hold no keys to your firm: no login to your systems, nothing installed on your machines, no access to your mailboxes. A person verifies every finding in an assessment before it is released.
What gets checked
For a firm, the starting point is its domain: every address at that domain is checked against breach records. When there is a match, the finding names the breach, when it happened and what kinds of data were in it, so the firm can decide which passwords to change first.
One check, or a watch
A one-time check answers whether your addresses are in known breach records on the day it is read. That answer ages fast: new breaches are disclosed every week and old collections are re-shared. For firms we monitor, the same checks run again (email settings, look-alikes and new host names re-checked every hour, the rest every day), and a new appearance is recorded with the date we found it, not months later.
What monitoring does not do
- It does not prevent a breach at another company.
- It does not remove data from breach collections once it is copied.
- It cannot see every source: some data is traded privately and never becomes visible.
What it does is shorten the time between an exposure and the password change that closes it.
Questions to ask any provider
- Which sources do you read, by type?
- Do you need a login to our systems, software on our machines or access to our mailboxes?
- How often is each address re-checked?
- Does a person review a finding before it is sent, and does each finding carry its proof?
- What exactly will I receive, and what do I do with it?