To check company credential exposure, first establish which domains your organization controls and which account populations you need to review. Then verify that scope, search the available evidence, and separate what the records show from what still needs confirmation.
This approach makes a review repeatable. It also prevents a common mistake: treating a company website search and an employee email search as if they answer the same question.
1. Write down the scope before searching
List the primary business domain, active subsidiary domains, and any separately operated domains that your team is authorized to investigate. Include a short explanation of who owns each domain and what it is used for.
Separate website scope from account scope. A hostname such as accounts.example.com identifies a service. A work address such as [email protected] identifies an account string. A result involving one does not necessarily involve the other.
For acquired companies or external partners, establish authorization before adding their domains. A shared brand, similar spelling, or business relationship is not the same thing as control over the domain.
2. Verify the domain in your workspace
In Vuxep, an organization administrator adds a domain in the Organization settings. The platform provides a DNS TXT challenge at _vuxep.<domain>. The person responsible for DNS publishes that exact challenge, then the administrator requests verification.
If verification fails, compare the requested DNS record with the record that was actually published. Check the hostname, record type, and value, and allow for the DNS provider's update behavior. Keep the domain unverified until the platform confirms it; adding the name alone does not unlock its search scope.
Verification before broad domain searches is an established approach: Have I Been Pwned's domain-search guidance also requires verifying the domain before reviewing its results.
3. Review services and work addresses separately
Use a website domain search to examine records associated with your organization's websites and subdomains. Use an exact-host search when the question concerns one specific application. Use a work email-domain search to investigate addresses belonging to the organization, including observations associated with external services.
A practical first pass has three parts:
- Review the dashboard to understand the available totals and most affected hosts.
- Search an important company hostname to inspect representative evidence.
- Search the work email domain and open relevant employee exposure profiles.
These are different views of the same research problem. Do not add their totals together without checking overlap, and do not label every account on a public company service as an employee.
4. Check what an individual finding means
For a representative result, confirm the account identifier, observed service, available source information, and indexing context. Ask whether the address still belongs to your organization and whether the service is recognizable. Your current directory and service inventory can help answer those questions.
An exposure record does not verify current account ownership, present employment, or successful unauthorized access. It also does not prove that an observed password remains valid. Use authorized internal evidence for those assessments; attempting to sign in with exposed credentials is not part of a normal monitoring review.
Read stealer logs versus breach data when the source's meaning is unclear.
5. Set priorities that your team understands
Organization administrators can identify critical services and exact privileged work email addresses in Vuxep. Those rules make the reason for attention visible alongside evidence. Reviewers can also inspect password-reuse signals and newly indexed findings.
Use labels that reflect your environment. A service is critical because of the access or business function it provides, not because it has the largest result count. A small number of relevant records can deserve closer attention than a large historical compilation.
Give viewer access to colleagues who need to inspect dashboards, findings, reports, and settings without changing organization configuration. Keep administrator access with the people responsible for domains, users, and notifications.
6. Share a summary with the right boundaries
A management summary should identify verified coverage, the reporting window, the number and type of findings, and the limitations of the evidence. Vuxep's PDF reports provide redacted summaries and label indexing windows; they are distinct from detailed search exports.
Avoid including credentials in presentation slides, general chat channels, or contact forms. Match the level of detail to the audience and use the organization's approved handling process for sensitive findings.
Password hygiene remains a separate operational consideration. For systems following NIST's authentication guidance, verifiers must check proposed passwords against a blocklist of commonly used, expected, or compromised values when establishing or changing a password. That check supports account protection; it does not replace investigating exposed records.
For the concepts behind this workflow, read what credential exposure monitoring does. Contact Vuxep to discuss your domain coverage.