A useful credential exposure report lets someone understand the organization's evidence without opening individual credential records. It answers a few concrete questions: what scope was reviewed, what was found, what the numbers measure, and which limitations affect the interpretation.
The report should be readable by a manager who did not run the searches. Define the terms that change the conclusion and remove details the audience does not need. More rows do not automatically make the summary more informative.
Start with the scope
List the organization's configured domains and make their verification status clear. A report covering one verified domain should not imply that every subsidiary, acquired business, and email domain has been assessed.
Separate company-operated services from work email addresses observed on external services. Both can be relevant, but they describe different populations. A public application may contain customer accounts; those accounts should not become an employee exposure count simply because the application belongs to the company.
For the setup behind that distinction, see checking credential exposure using verified domains.
State the window and the snapshot date
Vuxep offers PDF reports for 7, 30, or 90 day indexing windows ending at the latest available nightly dashboard snapshot. The selected window describes newly indexed evidence. Other totals and rankings describe the snapshot rather than only the selected period.
Keep the snapshot timestamp alongside the window. A report generated today may reflect an earlier snapshot, and readers need to know that before comparing it with a live search.
Avoid calling newly indexed evidence a new breach. An older collection can enter the index during the current reporting period. First indexed versus breach date explains why these dates need separate labels.
Give each number a unit
A record, an account, a service, and a source observation are different things. A single account can appear on several services, while several files can contain the same underlying record.
| Measure | Question it helps answer |
|---|---|
| Exposure records | How much distinct indexed evidence is represented? |
| Accounts | How many different account identifiers appear in the selected view? |
| Affected hosts | Which observed hostnames account for the findings? |
| Newly indexed evidence | Which records entered the index during the stated window? |
Keep related counts next to their definitions. Do not add a company-website total to a work-email total without accounting for overlap. Likewise, a higher record count does not by itself establish that more people were compromised.
Explain priority without overstating it
Priority context helps readers understand why certain evidence deserves attention. A configured critical service or privileged work email adds business meaning that a raw count cannot provide. Reuse signals and indexing context can add further reasons to inspect a finding.
Explain where the reason comes from. A service marked critical reflects the organization's own configuration; it is not an independent assessment of the service. A reuse signal describes an observed relationship, subject to analysis limits, rather than proof that the shared password still works.
Read prioritizing exposed privileged accounts when defining that context for your organization.
Redact for the intended audience
Vuxep's branded PDF and its preview exclude passwords, account identities, original URLs, and custom priority-rule labels. Account rankings are anonymous. The report can still show affected hosts, aggregate evidence, priority context, and verified-domain coverage.
Redaction does not make every remaining detail public information. Organization names, hostnames, coverage gaps, and exposure totals can still be sensitive. Choose recipients according to the purpose of the report and your organization's handling practices.
Detailed search exports serve a different purpose and may contain credential records. Before attaching a file to a management update, confirm that it is the report you intended to share.
Check coverage and freshness before exporting
Review the preview first. Confirm the organization, selected indexing window, snapshot timestamp, and verified-domain coverage. Read any note identifying incomplete data or an older snapshot instead of hiding it in the accompanying message.
After verified scope changes, Vuxep waits for a matching dashboard snapshot before making the report available. This avoids producing a summary that silently mixes the new scope with older coverage. If the report is unavailable after adding a domain, check that condition before assuming the export failed.
Organization viewers can download reports as well as administrators. Export activity is audited, while permission to change organization configuration remains separate.
Add a short explanation when sharing
A useful introduction might say: “This report summarizes indexed exposure evidence for the listed verified domains. The new-finding window ends at the displayed snapshot time; original exposure dates and current credential validity are not established.”
Then point to the observations that matter for the audience. Keep any conclusions tied to the report's scope and definitions, and use the authenticated workspace for detailed investigation.
For ongoing visibility between reports, review how to configure exposure alerts. Contact Vuxep about reporting for your verified domains.