A large number needs a clear unit
An exposure total is useful only when the reader knows what it counts. Records, account identifiers, services, and confirmed incidents describe different things. Comparing them as if they were equivalent can turn a useful signal into an unsupported claim.
This guide uses fictional example.com data. It is an explanatory example, not a production measurement, customer case study, or estimate of the wider threat landscape.
A fictional worked example
Suppose an authorized review contains 30 exposure records, 12 distinct work-account identifiers, and eight observed service hosts. Some accounts appear more than once and some appear alongside several services.
| Measure | Fictional total | What it tells the reviewer |
|---|---|---|
| Exposure records | 30 | The amount of evidence represented in this view |
| Work-account identifiers | 12 | Different account identifiers represented, not verified people |
| Observed service hosts | 8 | Hostnames appearing alongside the accounts |
| Confirmed incidents | Not established | An incident conclusion requires separate evidence |
Thirty records divided by 12 identifiers is an average of 2.5 records per identifier in this fictional view. It does not mean that each person suffered 2.5 incidents, that 12 people currently work at the company, or that eight services were breached.
Account counts are not headcounts
An address may belong to an employee, shared mailbox, former employee, test account, or another context. Several identifiers may belong to one person, and one identifier may have been used by more than one person over time.
Use the organization's directory and account ownership records to establish current relevance. Describe an unverified identifier as an observed account, rather than silently promoting it to a confirmed affected employee.
A referenced service is not a breach attribution
A hostname in a credential record describes an observed association. It does not by itself establish where the credential was obtained, whether the service still has that account, or whether the service's systems were compromised.
Subdomains can also represent related parts of one service. A report should state whether it counts hostnames or broader service groups before comparing the total with another view.
Scope changes the population
A search of accounts appearing on an organization's website answers a different question from a search of its work email addresses on external services. Website users are not automatically employees. The two populations can overlap.
State the verified domains and search scope alongside the number. Compare like-for-like views rather than treating a change in scope as a change in risk.
Dates change the meaning of a trend
Newly indexed evidence may concern older exposure. A reporting window describes the dates used by that report; it is not automatically a timeline of breaches or infections.
Keep the snapshot time visible. If a live search and a dashboard differ, check their scope, units, and dates before treating the difference as an error or a new incident.
Keep uncertainty visible
Some views have sampling or analysis limits. An observed relationship can be useful without being exhaustive. Repeated evidence may add context without establishing another affected person or incident.
A careful summary might read: “This fictional view contains 30 records associated with 12 work-account identifiers and eight service hosts. Original incident dates and current credential validity are not established.”
A checklist before sharing a total
- Name the unit: records, identifiers, hosts, or independently confirmed incidents.
- State the verified scope and distinguish website users from work accounts.
- Include the reporting window and snapshot time.
- Retain displayed sampling notes and other coverage limitations.
- Confirm current ownership and relevance through authorized organization records.
- Keep sensitive credential values out of general management summaries.
See the evidence guide, fictional sample report, and exposure-timeline guide for the next steps in an organization review.