See which of your addresses are in breach records
An address at your firm lands in breach records when a service it was used with loses its user list. If the password that went with it still opens something, a stranger can sign in as you. We read from outside which of your shared addresses are listed, and from which breach.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
What a listed address means, and what we read.
On 13 October, SecurityWeek reported Meta: the way in was stolen or reused passwords.
Addresses such as info@ and admin@ are read by several people, printed on your website and often the sign-in for your domain, your website or a payments portal. We check whether each appears in monitored breach databases.
For each listed address, the breach that listed it and its date, so you know which password to change and where it was used.
We do not look up your people on the free reading. In the paid assessment you give us the addresses of the people to check, and we check only those.
Change the password wherever that address is a sign-in, to one used nowhere else, and turn on two-step sign-in for it. On its own, two-step sign-in defeats a reused password.
Measured on 30 September 2026.
Measured across the firms we have assessed, not a national census. The method is in the study.
Attackers read businesses with AI. LeakTrace reads them first. Every finding carries its evidence.
A different job from the people you already work with.
Excellent at running your systems. We read what the outside world sees and give you the exact fix for each finding, with the check that proves it. Different job, and independent: we are paid by no one who sells the fixes.
Tries to break in and needs access. We are not a pen test: nothing attacked, nothing installed, no access given. We read only what is already public, from outside, and log into nothing.
It can feed your premium and eligibility, and we do not see it. We show you what anyone can see of your firm from outside first, in plain words, so you walk into renewal knowing your own answers.
On a paid assessment, the Discover AI agent handles this one: its fixed checks record the firm addresses found in monitored breach databases, each with the breach that listed it.
On monitoring, fixed checks re-check every day.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
See which of your addresses are listed, before someone signs in with one.
The External Exposure Check: your outside reading, the openings a stranger can see on your firm today, with the proof for the lead finding. Read-only, from outside.