Review the output before booking a call
This worked example uses fictional example.com data. It illustrates the product's investigation and reporting concepts; it is not a customer case study, a screenshot of a live customer, or a claim about detected incidents. Actual totals depend on your verified scope and the available index.
1. Define the question
Example Company verifies example.com through DNS. An analyst checks accounts on its own service, portal.example.com, separately from work emails ending in @example.com. This prevents customer accounts on a public website from being counted as employees.
2. Connect the observations
The fictional work address [email protected] appears alongside three service domains. Two observations share a password value. An employee profile groups the observed services and explains the reuse signal without returning the password or hash. The analyst checks whether the work address and services are still relevant using the organization's own records.
3. Explain the priority
A rule configured by the organization marks one work address privileged. That provides a reason to investigate sooner. It does not independently discover permissions or establish account compromise. A first-indexed date establishes when the record entered the index, rather than the original incident date.
4. Share a management summary
| Report field | Fictional example | Interpretation |
|---|---|---|
| Verified scope | example.com | The assessed organization domain |
| Snapshot | 19 October 2026, 02:00 UTC | When the dashboard snapshot was built |
| New-evidence window | 30 days ending at the snapshot | Indexing activity, not breach dates |
| Distinct exposed account identifiers | 12 | Identifiers in the sample, not confirmed compromised people |
| Observed service hosts | 8 | Hostnames represented by indexed evidence |
| Priority reasons | Privileged work account; observed reuse | Reasons for review, not proof of intrusion |
Vuxep's management PDF redacts passwords, account identities, original URLs, and custom priority-rule labels. Detailed credential CSV export is a separate output. The illustration explains these boundaries rather than reproducing a full report or sensitive record.
5. Route new evidence
An administrator can connect Slack, Teams, Discord, email, or a signed webhook to a verified domain or targeted rule. The notification points the team back to the authenticated workspace. Generic webhooks carry a match count and workspace link; chat/email can include account-and-host examples without passwords.
An evaluation checklist
- Can the team inspect both website scope and work-email scope?
- Are indexing dates, snapshot dates, and incident dates distinguishable?
- Does an employee profile show sampling and explain reuse groups?
- Can a viewer investigate while configuration remains with an administrator?
- Does the management output redact the values the audience does not need?
- Does a notification reach the intended destination with an appropriate payload?
Book a walkthrough using your evaluation questions, or read the methodology and security overview.