digital identity protection
What the digital identity protection service is.
Our monitoring service checks in real time whether company email addresses are exposed on the Deep and Dark Web. It identifies sensitive information that may be publicly available or in compromised databases, giving a precise overview of the data that may be accessible.
Why the digital identity protection service.
Monitoring online exposure helps protect company information from unauthorized use. Awareness of compromises lets companies take timely countermeasures and strengthen data security, following best practices in digital risk management.
Benefits of the digital identity protection service.
Receiving detailed weekly reports keeps data exposure under constant control. This proactive approach reduces the risk of targeted attacks and helps safeguard the company’s reputation and resilience.
Note: Digital Identity Protection monitors compromised credentials (breaches of accounts and digital identities). Protection of the domain’s email identity, against spoofing, BEC fraud, DMARC issues and lookalike domains, is a dedicated component of the ecosystem: Defensio Identity Shield.
What do we detect?
- Signs of exposure that could threaten company security.
- Information associated with compromised company email addresses.
- Data available in Deep and Dark Web environments.
How does it work?
- Detection of exposure through continuous monitoring of Deep and Dark Web sources.
- Practical guidance to prevent further exposure and manage the risks identified.
What is digital identity protection?
It is the surveillance of company accounts and credentials outside the perimeter: in breaches of third-party services, in the markets where credentials are resold, in domains registered to imitate yours. It serves to discover a compromise before it is used.
Why credentials leaked elsewhere are your problem
Because passwords are reused. A company account that appeared in a breach of an external service becomes a key to try on your systems, and it is one of the cheapest ways in, because it requires no exploit at all.
What to do when something is found
In this order: force a password change, check whether the account has been used (this needs log analysis), enable the second factor where it is missing. Monitoring without a response procedure is just one more notification.
What it is NOT
It is not access to non-public data, nor an intrusion: the work is done on accessible sources, as in OSINT. It does not remove data already circulating, nobody can do that. And it does not protect the mailbox: that is the job of email security. Glossary.
How we find out that a credential is exposed
Company credentials almost always end up in circulation because of third parties: an external service suffers a breach, and among the leaked data there are @yourdomain addresses with their passwords. Monitoring compares your domain with archives of known breaches and reports new matches.
Why it matters even if the password belonged to another service
Because people reuse passwords. A credential leaked from a forum or an online store becomes a key to try on company email and the VPN. No exploit is needed: someone tries to log in, and sometimes it works. It is one of the cheapest ways in, and it is why a second factor is worth more than any complexity policy.
What to do when an alert arrives
In this order: force a password change, check whether the account has already been used (log analysis of logins and forwarding rules set up), enable the second factor where it is missing. Monitoring without a response procedure only produces one more notification.
What is NOT possible
Removing data already circulating. No provider can do it, and anyone who promises it is selling something they cannot deliver. What can be done is to notice early and make the credential useless. Glossary.