Audience views
Separate internal employees, customer accounts, and third-party SaaS exposure.
Platform · Incidents
Triage stealer-log exposure with intelligence
Internal, customer, and third-party accounts ranked by risk — filter by workflow status, reveal hashes, and alert affected users from one queue.
You're on the list. We'll reach out about enterprise access.
Preview
Incidents in BreachQuery
Features
What Incidents delivers
Risk scoring
Value scores prioritize accounts tied to VPN, admin panels, and high-impact services.
Workflow statuses
Move incidents through Open, Triaged, Mitigating, False positive, and Resolved.
Bulk reveal & export
Unlock password hashes in bulk for verified response workflows.
User alerting
Email affected employees or customers directly from an incident card.
Domain filtering
Scope the queue to one domain or review exposure across your full fleet.
How it works
Three steps on Incidents
New credential indexed
Monitoring pulls surface stealer-log matches tied to your domains.
Rank & filter
Risk scores and audience filters tell analysts what to handle first.
Respond & close
Reveal, alert users, update workflow status, and record resolution.
Use cases
Built for enterprise teams
Identity & access teams
Reset passwords for internal accounts found in infostealer logs.
Customer trust programs
Notify customers whose accounts appeared on your domains.
Third-party SaaS exposure
Track employee emails used on external services like GitHub or cloud apps.
SOC tier-1 triage
Clear false positives and escalate high-risk internal accounts fast.
FAQ
Common questions
What is an incident?
- A stealer-log credential match — URL, username, and optional password hash tied to your monitored domains.
How is risk calculated?
- Signals like target URL, account category, and password presence feed a value score.
Can I alert end users?
- Yes — send security notice emails with context from the incident card.
What's the difference from raw leak feeds?
- Incidents are scoped to your domains, deduplicated, scored, and tracked through workflow states.
Request enterprise early access
Join the waitlist — be first to run Incidents for your organization.