From exposure evidence to an investigation
Vuxep brings credential exposure evidence into a searchable workspace for authorized organization investigations. A finding connects an account with an observed service and the context available for review. Use it to decide what your team should investigate, rather than as an automatic verdict about an account or incident.
Records, accounts, and services are different measures
One account can appear in several records and alongside several services. A record count is not a count of people, devices, breaches, or working passwords. Repeated observations do not necessarily represent separate incidents.
The exposure metrics guide uses a fictional example to explain these distinctions. Read the unit, scope, and date beside a metric before comparing totals.
Website scope and work-email scope
A match against an owned website can concern an account on that service. A match against a verified work-email domain can reference an external service. These populations may overlap, and accounts on a company website are not necessarily employees. DNS verification authorizes organization scope; it does not validate the underlying incident attribution.
Dates describe observations
First indexed describes when evidence became part of the available index history. It is not an infection or breach date. Newly available findings can describe older exposures, and the original incident date may be unknown. Keep the indexing date separate from any independently established incident timeline.
Coverage and analysis limits
Coverage varies, and no exposure index can establish that every relevant incident has been captured. No match means no matching indexed evidence was returned within the selected scope. It is not a guarantee that the organization has never been exposed.
Some views use a sample or have analysis limits. Read the displayed coverage notes rather than treating every count as exhaustive. Dashboards and reports show their snapshot and reporting window; those dates may differ from a live search or the original exposure date.
Use a finding in an investigation
Review the account, observed service, available context, and indexing date. Compare them with your current directory, service ownership, and authorized identity/endpoint evidence. An exposed credential is not proof that it still works or that a service was breached. Vuxep does not attempt live authentication with exposed values.
See the illustrated investigation and sample report, stealer-log monitoring workflow, and research sources.