Monitor your company's data leaks
The exercise is to look at your organisation as an attacker sees it: from the outside, without privileged access. It almost always reveals assets missing from the official inventory and credentials circulating in leaks. Free tiers are enough for a first assessment.
The tools, in order
- 01Have I been pwned?freemium
Domain search to spot compromised addresses
Database of breached credentials and email addresses from known data breaches.
- 03
Reveals internal hosts exposed through certificates
CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.
- 04Shodanfreemium
Shows the organisation's services visible from the internet
Search engine for internet-exposed devices, services, and security-relevant banners.
- 05Censysfreemium
Complementary view on certificates and hosts
Internet-wide scanner and search engine for hosts, certificates, and services.
The pitfall to avoid
A one-off audit goes stale within weeks. It is the gap between declared inventory and observed reality, and how it evolves, that is the real indicator.
🧭 The full plan
The copilot orders every step from your starting point, with pre-filled queries.
📖 The guides
Detailed methods by investigation type.