Exposure Assessment
See your organization the way an attacker does.
Before a convincing lure reaches your finance team, someone has read your filings, mapped your people and found the documents you forgot were public. We do that research first, from the outside, and help you close what we find.
- Standard assessment
- 15 business days from scoping to report
- Method
- Passive and external. Nothing scanned, probed or logged into
- Team
- Exposure lead, investigators, records researcher and infrastructure analyst
- Deliverable
- Adversary-view report, ranked exposure register and reduction plan
- Pricing
- Fixed fee per assessment, or an annual program with quarterly re-checks
When to call us
When the question is what someone could learn about you.
The most effective fraud and impersonation attempts we investigate are built from material the target published itself. An exposure assessment finds that material before an attacker uses it.
Before a public moment
A listing, an acquisition, a leadership change or a major contract award, when attention and opportunistic lures both rise.
After a near miss
A lure that knew too much. We trace every detail to its source and show what else could be used the same way.
Executive impersonation
Payment instructions, filing notices and access requests from people who appear to be your leaders, counsel or agents.
Documents you did not mean to publish
Files on your sites and in search indexes that reveal internal names, usernames, templates, drafts and systems.
Impersonation already underway
Lookalike domains, cloned sites and fake profiles of your executives, found and documented for takedown.
Third parties that reveal you
Law firms, registered agents, suppliers and event organizers that publish details about your people and processes.
What you receive
The attacks your footprint makes easiest, and how to close them.
A list of exposed items is not much use on its own. Our report explains how the items combine into specific attacks, ranks them by ease and impact, and gives each one an owner and a fix.
- An adversary-view narrative of the three or four attacks your public record most supports
- A ranked exposure register, every item captured, hashed and linked to its source
- The roles most exposed to impersonation and targeting, and why
- Documents, metadata and indexed files that reveal internal names, systems or processes
- Lookalike domains and impersonating accounts already in existence, with takedown packages
- A reduction plan, a briefing for your teams and a re-check at 90 days
How it runs
Researched like an attack. Delivered like a plan.
A standard assessment takes fifteen business days. After a live incident, we trace the lure first and deliver the wider assessment on the standard timeline.
-
01 / Scope
Days 1 to 2
We agree the entities, brands, sites and roles in scope, and the scenarios that worry you most.
-
02 / Collect
Days 2 to 9
Investigators research you as an adversary would, through non-attributable infrastructure. Passive collection only.
-
03 / Assemble
Days 8 to 13
Findings are combined into attack paths, ranked by ease and impact, and challenged by a reviewer who did not collect them.
-
04 / Reduce
Days 14 onward
We brief your teams, support removal and redaction, file takedowns and re-check at 90 days to measure what changed.
Tradecraft
The same sources an attacker reads, read first.
Exposure assessment uses the methods of our due diligence and investigations practices, turned on the client instead of a counterparty.
- Registries and filingsScanned filings, covering letters, officer changes and signatures across every registry where your entities appear.
- Disclosures and governanceAnnual reports, proxy statements and board changes that describe who approves, who signs and who advises.
- Roles, not private livesWhich roles an attacker can name and reach, from professional profiles, job advertisements and event programs. We record roles and published professional details only.
- Documents and metadataAuthor names, internal usernames, file paths, templates and revision histories in the files you publish.
- Search indexesWhat precise queries across several engines and regional indexes surface about you, including files you did not intend to publish.
- Domains and public internet recordsRegistration history, certificate logs and archived pages that reveal forgotten sites and lookalikes, read without touching your systems.
- Calendars and travelSpeaker lists, event announcements and posts that tell an attacker when decision makers will be hard to reach.
- Breach exposure, with restraintWhether corporate addresses appear in known breach notifications. We never access, buy or search the stolen contents.
Results
When the lure knew too much.
Across the 48 assessments we completed in 2026, clients closed or controlled a median of 71 percent of findings by the 90-day re-check.
Industrial manufacturing
The signature on file
A lure built from the client's own registry filings nearly moved $486,000. We rebuilt the attacker's research, mapped 38 lookalike domains and closed the gaps.
We thought we had been hacked. Aldervane showed us we had been read. Every detail in that email came from documents we had published ourselves, and now we know which ones.
Questions
Exposure assessment FAQ
Do you scan or test our systems?
No. An exposure assessment reads what is already public. We do not scan networks, attempt to log in, send test messages to staff or interact with anyone. Where our findings point to a technical weakness, we pass them to the people responsible for testing it, such as your penetration testers.
How is this different from protective intelligence?
Protective intelligence concerns named people, such as executives and their families, and the threats and exposure that affect them personally. Exposure assessment concerns the organization: its filings, documents, roles, domains and processes. Many clients run both, and the two teams work together.
Will you look into our employees?
Only as far as their roles are visible to an outsider. We record which roles can be identified and what is published about them in a professional capacity. We do not profile individuals or look at private accounts, and personal details found incidentally are not retained.
Can the exposure be removed?
Much of it. Documents and metadata on your own sites can be cleaned or withdrawn, lookalike domains can often be taken down and some filing practices can change. Some records are public by law. For those, we recommend controls that assume an attacker has read them, such as callback procedures and dual approval.
Do you use breach data?
We check whether corporate addresses appear in known breach notifications, which tells you about your own exposure without touching stolen data. We never access, buy or search breached contents, credentials or infostealer logs. Our reasons are set out in Why we do not search stolen data.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.