Request demo

Executive Threat Monitoring

Know When Leadership Accounts Turn Up in Leaked Data.

Executive Threat Monitoring lets your team mark accounts as executive or VIP once Cyber Threat Intelligence finds them in breach or leaked credential data.

From then on, the breaches and leaked credentials on a flagged account carry the flag, so leadership exposure is one filter away instead of buried in the full queue.

Request demoPlatform guide: Executive flag

Query

  1. flag is_executive = trueset from the account’s title
  2. flag vip = trueon breached accounts
  3. sort -last_breach_date

  • Chief Financial Officer

    c.@acme.example · last breach 2026-09-14

    is_executiveCritical

  • Board member

    b.@acme.example · last breach 2026-08-30

    vipHigh

  • Chief Executive Officer

    a.@acme.example · last breach 2026-07-02

    is_executiveHigh

  • Engineer

    e.@acme.example

    Medium

  • Support agent

    s.@acme.example

    Low

  • Marketing manager

    m.@acme.example

    Low

Some Accounts Carry More Weight.

A leaked password is a leaked password. Whose it is decides how far it reaches.

Access

Broad Permissions

An executive’s mailbox and single sign-on session reach approvals, finance workflows and board material. One credential opens more than most.

Visibility

Public Names

Names and titles are on the company website and the email format is easy to guess. Building a target list takes no special access.

Reuse

Personal and Corporate Overlap

A password shared between a personal service and a corporate login turns someone else’s breach into your incident.

Flag the People, Then Follow Their Exposure.

  1. 01

    Find

    Cyber Threat Intelligence lists the employee accounts on your domains found in breaches and leaked credential data, with name, title and department where known.

  2. 02

    Flag

    Mark the executives and VIPs among them: is_executive on compromised employee accounts, vip on breached accounts. One update per person.

  3. 03

    Filter

    Filter compromised employee accounts by executive flag, title or department, and breached accounts by the VIP flag. Leadership exposure becomes its own list.

  4. 04

    Close

    Work each leaked credential to a state: resolved, risk accepted, ignored or false positive. Any decision can be reverted later.

Where to Look for Each Flagged Person.

The flag adds no new source. Breaches and leaked credentials filter on it directly; devices and the dark web are checked by the person’s address or name.

Email breachesvip · The known breaches that contain the address, with its date and the data types it exposed. Employee Email Breach Monitoring
Leaked credentialsaccount.is_executive · Each leaked login: the site it was used on, the account, and the password’s strength and reuse. Compromised Employee Device Monitoring
Risk levelis_executive · Critical, High, Medium or Low per account, which the platform describes as a composite of credential, role and recency. Cyber Threat Score
Infected devicesaccount.email · Infostealer infections on devices that hold the person’s credentials, with password, cookie and sensitive-cookie counts. Compromised Employee Device Monitoring
Dark webName or address · On-demand searches across forums, markets, paste sites, chats and leaks. Dark Web Search

Leadership Exposure Is One Filter Away.

The flags are ordinary fields. Set one with an update call when a leadership account appears, and filter on it wherever you would filter on an email address or a domain.

Breached accounts take filters on the query string, so the VIP view is a single request your team can run on any schedule it likes.

Breached Account List reference
curl "https://api.deepinfo.com/v1/cti/email-breaches/accounts?vip=true&ordering=-last_breach_date" \
  -H "apikey: YOUR_API_KEY"

What Teams Do With the Flagged List.

Reset Before It’s Used

Filter the exposed credentials of flagged accounts, reset the ones still active, and record the state so the next review starts from a clean list.

Use case

Brief the Person

Show an executive which of their accounts appeared in which breaches, and what data went with them. It makes the case for a password manager better than a policy does.

Report Upward

Export the flagged accounts with that filter for a leadership briefing. For the wider picture, the CTI Email Breach Summary runs on demand or on a daily, weekly or monthly schedule.

Protect Named Individuals

Pair the flagged list with dark web searches on names and addresses when a protective team needs a fuller picture.

Use case

The Data Behind the Flagged List.

CTI Employee Email Breach Monitoring Every corporate address found in a known breach. Read CTI Compromised Employee Device Monitoring Infostealer infections on the machines your people use. Read CTI Dark Web Search Search forums, markets and leaks on demand. Read

Query This Data Through the API

Credentials and dark web findings stay in the platform. The domain and vulnerability data around them is open through the API.

Questions About Executive Threat Monitoring

Who counts as an executive?

Whoever your team flags. Most teams start with the C-suite and the board, then add people with privileged access or a public profile, such as finance approvers, executive assistants and spokespeople.

Can we see whether a flagged person’s exposure is growing?

Yes. Each compromised employee account shows its first and last exposure dates, the days since the last one and whether new exposures are becoming more frequent.

Does it cover personal email addresses?

Breach and credential monitoring follows the addresses on your organization’s domains. A personal address, or a name, can be checked on demand with Dark Web Search.

Does this cover impersonation of executives?

Lookalike domains built on your brand are handled by Brand Risk Protection. This capability focuses on the exposure of the people themselves: their breached accounts and leaked credentials.

See Which Leadership Accounts Have Already Leaked.

Book a walk-through on your domain and see how flagged accounts, breaches and leaked credentials come together in one list.

Request demo