Skip to main content

Credential Exposure Monitoring

The One Protect monitors for leaked credentials across known data breaches and alerts your team when client credentials are found, enabling rapid response before compromised credentials are exploited.

How It Works​

Credential monitoring operates on multiple data sources:

  1. Breach databases — Known breach datasets are checked against your monitored email addresses and domains
  2. Paste sites — Public paste sites are monitored for credential dumps containing your monitored addresses
  3. Dark web feeds — Threat intelligence feeds report newly discovered credential exposures

Monitoring runs continuously. New exposures are detected within hours of appearing in monitored sources.

Monitored Entities​

Credential monitoring covers the same domains and email addresses configured in Dark Web Monitoring. No additional setup is needed — enabling dark web monitoring for a domain or email automatically enables credential monitoring.

Exposure Alerts​

When leaked credentials are detected, an alert is created with:

FieldDescription
Affected AccountThe email address found in the breach
SourceThe breach or data dump where the credentials appeared
Exposure DateWhen the credentials were first detected
Data TypesWhat was exposed (email + password hash, email + plaintext password, etc.)
SeverityCritical (plaintext password), High (password hash), Medium (email only)

Integration with Security​

Credential exposure alerts can automatically create incidents in The One Security:

  1. Navigate to Protect → Settings → Integrations → Security
  2. Enable Create Security Incident on Credential Exposure
  3. Select the severity threshold
  4. Credential exposure incidents appear in the Security Command Center with full context

The Security incident includes:

  • The affected user account
  • The breach source and date
  • Recommended response actions
  • Link back to the Protect alert for detailed findings

User Notification Workflows​

Configure automated notifications when credentials are exposed:

Internal Notifications​

  • MSP security team — Immediate notification via email and Hub
  • Account manager — Email notification with client impact summary
  • Help desk — Auto-created PSA ticket for credential reset

Client Notifications​

  • Client admin — Notification via Portal with recommended actions
  • Affected user — Optional direct email notification (configurable per client)

Configure notification workflows in Protect → Settings → Notifications → Credential Exposure.

ℹ️Direct user notifications are disabled by default. Enable them per client if the client has approved direct communication with their end users about security incidents.

Response Actions​

When credentials are exposed, recommended response actions include:

  1. Force password reset — Via RMM integration or manual notification to the user
  2. Enable MFA — If not already enabled on the affected account
  3. Review account activity — Check for signs of unauthorized access
  4. Revoke active sessions — Force re-authentication on all devices
  5. Update related accounts — If the user reuses passwords, prompt them to change all related accounts

Reporting​

Credential exposure data is included in:

  • Client Reports — Monthly exposure summary per client
  • Compliance evidence — Credential monitoring status satisfies breach detection controls
  • Trend analysis — Exposure trends over time per client and across your portfolio