Access-path context

Identity Exposure

Compromised credentials and sessions connected to the portals and relationships that could make them operationally useful — not a flat list.

Book a demo Explore the platform

Evidence-backedAnalyst-reviewedNo actor engagement

The screen

What your team sees.

Built on the same preserved evidence as every alert and perspective. Open the live demo

Screenshot: the Identity Exposure evidence table — identities, their relationship, the portals they reach, compromise date and confidence.

Capability architecture

The identities that open doors.

Stealer logs and credential dumps are matched to your monitored identifiers, then tied to the portals, roles and relationships that decide whether an exposure matters.

Why it matters

A leaked password for a disused account and a live single sign-on session for a finance contractor look the same in a dump. They are not the same risk.
Third-party and contractor identities are routinely the hop an adversary uses, and they rarely appear in your own directory.
Credential monitoring that validates logins or probes your systems creates risk of its own.

ThreatCanary approach

Stealer logs, credential dumps and session material are collected, preserved with provenance and matched to your monitored identifiers.
Each exposed identity is connected to the portals it reaches, its relationship to you and the compromise date, with a confidence rating.
Monitoring domains are identifiers only — adding one never triggers DNS lookups, discovery, scanning, credential validation or contact with the organisation.

What you see

An evidence table of identities, their relationship, the portals they reach, compromise date and confidence.
An evidence-safe detail view for each identity that never renders images from collected content.
The identities that appear as hops in your adversary perspective and alerts.

Evidence produced

Identity exposure records with source provenance and compromise date.
Portal and relationship context for each identity.
Recommended defensive moves — revoke sessions, reset credentials — tied to the evidence.

Common questions

Questions teams ask before they commit.

Direct answers on scope, evidence, safety controls and how ThreatCanary differs from tools you already run.

Does Nullstar test whether a leaked credential still works?

No. Credential validation is one of the actions Nullstar never performs. Exposure is assessed from the preserved evidence — where the material appeared, when, and what it reaches — and the recommended defensive validation is for your team to run.

Which identities are covered?

Identities matching the monitoring identifiers configured for your tenant — your own domains and the contractor, supplier and partner identities you ask Nullstar to watch. Each is shown with its relationship to you so third-party exposure is not lost.

Will adding a domain cause any traffic to it?

No. Monitoring identifiers are matching keys only. Adding one never triggers DNS lookups, discovery, scanning or contact with the organisation.

Evaluate the capability

See this capability work against your attack surface.

Book a product walkthrough

One system from discovery to evidence.

Three product pillars. One offensive engine. Plus the adversary’s view.

AI Offensive Security

Exposure Intelligence

API Security

Nullstar

Validated exposure for high-consequence environments.

More sectors

By team

Use cases

Research, guidance and proof.

The people, principles and proof behind ThreatCanary.

Identity Exposure

What your team sees.

The identities that open doors.

Why it matters

ThreatCanary approach

What you see

Evidence produced

Questions teams ask before they commit.

Does Nullstar test whether a leaked credential still works?

Which identities are covered?

Will adding a domain cause any traffic to it?

See this capability work against your attack surface.

Identity Exposure

What your team sees.

The identities that open doors.

Why it matters

ThreatCanary approach

What you see

Evidence produced

Questions teams ask before they commit.

Does Nullstar test whether a leaked credential still works?

Which identities are covered?

Will adding a domain cause any traffic to it?

Continue exploring ThreatCanary

If We Targeted You Today

Intelligence command centre

Nullstar overview

Live demo

See this capability work against your attack surface.