Appearance
How Exploit Shield works
Exploit Shield finds leaked credentials and sensitive values for your organization.
You review them in Reports and Exposures.
You set False positive or Remediated when you finish a row.
Vendor Monitoring is a separate view for supply-chain vendor risk. It is not a step after every report.
When a report meets a rule, the product sends HTTP POST to the webhook destinations on Alerting.
An admin adds those destinations: Discord, Microsoft Teams, Google Chat, SIEM, CTI, or Other.
Lifecycle
text
Leak → Exposure → Report → Remediate| Stage | Where you see it | What it is |
|---|---|---|
| Leak | Exposures | An exposure is a leaked credential or sensitive value: password, secret, token, PII, PHI, credit card number, or similar. Severity is 0–10. |
| Exposure | Exposures | File and repository for that value |
| Report | Reports | Suspected potential impact through a first-party or third-party leak. Includes ownership. |
| Remediate | False positive / Remediated | You set the status. Hidden rows stay out of the default list |
Two lists and Vendor Monitoring
| List | When you use it |
|---|---|
| Exposures | Leaked credential or sensitive value (password, secret, token, PII, PHI, credit card number) |
| Reports | Suspected potential impact to your organization through a first-party or third-party leak |
| Vendor Monitoring | Supply-chain vendor risk. Separate from the report path. |
See Objects and terms and Scoring and attribution.
Who does each step
| Step | Who |
|---|---|
| Add domains, vendors, integrations | Admin |
| Add users and roles | Admin |
| Add alert destinations and rules | Admin |
| Pending to Active | Exploit Strike review. Status becomes Active when the term belongs to this client. |
| Read Reports, Exposures, Vendors | Any signed-in user |
| Set False positive or Remediated | Signed-in user |
| Change a role | Another admin. Leave your own role unchanged. |
How you investigate
Use the investigation playbook.
The short path: