Everywhere a person has been — breaches, platforms, the corners they'd rather you didn't find. Assembled from one email. On-prem.
The attacker does open-source reconnaissance on your team before they ever send a payload. You should do it first.
Credentials are involved in the large majority of web-application breaches.
— Verizon DBIR 2025
Social engineering remains a top initial-access vector — and it begins with public profiling of a specific human, not a piece of malware.
Executives, admins, and IT staff are scattered across breaches, social platforms, and data brokers. That footprint is the attacker's starting kit.
You can't reduce what you can't see. xposeTIP assembles your team's footprint the way an attacker would — so you can shrink it.
Give xposeTIP an email, username, or phone number for a person you're authorized to assess. It resolves the public exposure tied to that identity:
An 11-axis behavioral fingerprint clusters and corroborates the findings. Every result carries its source, a confidence tier, cross-verification status, and first-seen / last-seen timestamps.
Your analysts validate every data point — which source, what confidence, when first seen. Attribution of an unknown actor is a human-in-the-loop judgment we support — never an automated claim we make for you.
179 sources, in parallel — not a checklist, a widening surface.
An email or username fans out across social platforms, developer and forum sites, breach databases, archives, and people-search engines — all at once. Each pass widens the next: usernames found in the first wave are re-scanned in the second.
Once a name resolves with high confidence, go deeper — on independent layers.
Only after a name is established do the name-based sources run: news and media, sanctions and PEP watchlists, corporate registries, and court records across the US, France, and the UK. The layers are independent by design — an error in one never cascades into the others.
From findings to a person — an 11-axis behavioral signature, not a list of indicators.
The graph links accounts, breaches, domains, and locations into personas. Exposure and threat are scored separately. Every finding carries its provenance — source, confidence, first and last seen.
Exposure work touches your most sensitive people. So the engine is built to run where you do — and to stay deterministic where it counts.
The exposure enrichment behind a SOC lookup is fully deterministic: sourced evidence and corroboration counts, with no language model anywhere in the path. Nothing is inferred — everything is cited.
Any model-assisted extraction runs inside your environment, on local inference — identity data is never sent to a third-party LLM API. On-prem deployment means you can verify that in your own environment.
Every finding is surfaced to your analysts as evidence to validate — corroborated, sourced, timestamped. We never auto-resolve an identity or auto-action a result.
Map a leader's public attack surface before a board appointment, a public role, or an acquisition. What's findable — breached credentials, exposed accounts, leaked PII — with a plan to reduce it.
See what an attacker could assemble on your privileged users: reused handles, breach exposure, leaked contact points. Assess your own team to shrink the surface before it's phished. Consent-based and defensive — never employee surveillance.
Deliver productized exposure audits to your clients' leadership. A sourced report you can put your name on — depth over volume, days not weeks.
Have a known indicator from your logs? Get sourced public context on the identity behind it, fast. Attribution stays a human-in-the-loop judgment your analysts make — we surface the evidence, not a verdict.
Identity-intelligence reports delivered as a service — for security teams and the MSSPs that serve them.
Pricing on application · capped at 4 engagements / month
Prefer to run it yourself? xposeTIP Cloud — self-serve scans, your own workspace. Paid tiers are in early access. Join the waitlist →
An executive before a board appointment. A privileged user after an anomaly. Your client's leadership team as part of an engagement. We return a sourced exposure report — days, not weeks. Engagements are capped: depth over volume.