Executive exposure checklist
Attackers research your leadership before they target your staff. This is the review I run first — passive sources only.
Updated
Digital footprint
- Personal email addresses and phone numbers exposed in public records, data-broker or people-search sites, or breach corpora.
- Credential appearances in known breach corpora.
- Personal social accounts revealing travel, family or routine.
- Home address inference from photos, registries or property records.
Organisational signals
- Org structure inferable from public profiles.
- Assistants and gatekeepers identifiable — prime pretexting targets.
- Supplier and tooling stack visible from job ads and public posts.
- Email naming convention derivable from public sources.
- Public speaking or interview footage assessed for how much audio/video material exists to source a voice-clone or deepfake pretext.
Response
- Removal or reduction requests filed where possible, with re-appearance checked on a recurring cycle — removed data-broker records commonly resurface within months.
- High-risk individuals moved to hardware-key or passkey authentication.
- Verification procedure for payment and access requests via a second, separately maintained channel — never the channel the request arrived on.
- Awareness briefing delivered using their own findings as examples.
Related
OSINT
Using open-source intelligence defensively: attack-surface discovery, executive exposure including AI-assisted pretexting, and awareness training that changes behaviour.
OSINT training
Open-source intelligence investigator training: collection methodology, verification, and lawful handling of personal data.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
OSINT exposure awareness
What OSINT reconnaissance actually finds about an organisation and its executives, how AI voice cloning changes the pretext, and the awareness training that measurably reduces exposure.
Disclosure as a control
Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.