Cross analyses
Exposed staff
Every account of your domains is aggregated, scored and placed in a cohort, with a single security action: awareness, device to reinstall, access to harden, to watch, no exposure. Exposed-staff analysis aggregates, for every account of your domains, the exposures that concern it, derives a probable role, an exposure score and a single recommended action, then places it in a cohort: awareness recommended, device to reinstall, access to harden, to watch or no exposure. A security aid, never an HR tool.
Requires the service Compromised credentials
The problem
After a breach, the list of affected addresses does not say what to do for each person. An employee who reuses a password does not call for the same answer as an infected personal device or a privileged account with no proof of a second factor. Briefing everyone is expensive and does not protect the accounts that matter; doing nothing leaves the exposure in place. What is needed is a short list, account by account, with one security measure for each.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: the list of accounts per cohort in your client area, with the score, the recommended action, the recorded actions and the export for the security team.
- 01
The five cohorts and their headcounts: awareness recommended, device to reinstall, access to harden, to watch, no exposure
- 02
For every account: the probable role (executive, privileged, standard), inferred from your perimeter, the exposure score, its reasons and the recommended action
- 03
The recorded actions (briefed, device reinstalled, access hardened, sessions revoked) and the export for the security team, cohort by cohort
A limit stated plainly · Our data does not say whether MFA is on: “access to harden” means a usable password is circulating for a sensitive target with no proof of a second factor.
How it works
Our answer in three steps
For every account of your domains, VesperID aggregates what breaches, stealer logs and live sessions reveal, including exposed personal data and suspected password reuse, without inferring anything about private life. Out of it come a probable role inferred from your perimeter, an exposure score and a single recommended action per account; the list of exposed accounts and the recommended action exports for the security team, to organise resets, reinstalls and awareness sessions. A security aid, never an HR tool.
- 01
The analysis starts from the compromised credentials of your verified domains; infected devices, stolen sessions and executive protection enrich every record when they are active.
- 02
The platform aggregates per account: leaks, usable passwords, stealer logs, live sessions, distinct sources, exposed personal data, suspected reuse. It derives the probable role, the score and the recommended action: phishing awareness, password hygiene, device reinstall and rotation, access hardening, session revocation, executive protection or plain monitoring. Every inference is shown as such, with its rule.
- 03
You record the actions taken; the score drops, and a new exposure flags the account again. A notification tells you when an account enters a cohort to protect.
Where this data comes from
The records draw on the leaks and stealer logs our partners acquire (usable passwords, sessions), on the mentions their analysts follow and on the personal data collected on the open web; VesperID aggregates per account, without keeping any secret and without inferring anything about private life.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Risk score and takeover class
Each account’s score builds on the risk computed per identity and its takeover class: possible, likely or immediate depending on usable passwords, infected devices and still-valid cookies.
- 02
Exposure chains
A person present in an exposure chain shows it on their record, with the probable origin and the playbook; an action recorded on the person has the chain recomputed within minutes.
- 03
Notification when a cohort is entered
When someone enters “device to protect” or “access to harden”, a notification tells you and the person moves to the top of the list.
What you receive
Exposed staff
- 01
The list of accounts per cohort in the client area, with the score and the recommended action
- 02
Export for the security team, cohort by cohort, to organise resets, reinstalls and awareness sessions
- 03
Recorded actions that lower the score, and a new flag at the next exposure
- 04
A notification when an account enters a cohort to protect
Frequently asked questions
Is this a ranking of employees?
No. A cohort reads as a list of security actions to organise, not as a league table. The score measures the external exposure of an employee’s accounts, and nothing else: neither their activity nor their habits; the recommended action is the same for the whole cohort. The probable role (executive, privileged, standard) is inferred from your declared perimeter and the services touched, not from a judgement, and it is shown as an inference. The service is a security aid: it has no HR, disciplinary or appraisal use, and the terms and conditions forbid it.
What does “access to harden” mean if you cannot see MFA?
Exactly what our data allows us to say: a usable password is circulating for a sensitive target (SSO, VPN, mailbox, administration tool) and nothing proves a second factor. If MFA is already in place, the “access hardened” action records it and lowers the risk.
Do other services need to be active?
The analysis requires the Compromised credentials service, which provides the raw material. Infected devices, stolen sessions and executive protection are not mandatory but complete the records: without them, the “device to reinstall” cohort stays empty and the “executive” role is only set from your perimeter. The service is for organisations; an executive’s own profile belongs to executive protection.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.