Find relevant signals
Connect observed leaks to your domains and work credentials.
Data leak monitoring
BreachScan by rootzero
Data leak monitoring
BreachScan monitors leaks that concern your organisation: compromised credentials, internal documents, published secrets, databases resold on forums.
For security managers and teams responsible for workforce identities.
Decisions your team can make
Understand the exposure
Review the source, context and timestamped evidence.
Organise the response
Prepare checks and actions appropriate to each report.
01In short
Every alert comes with its source, timestamped evidence and the actions to take, so the team can reset, revoke or warn without redoing the investigation.
- Monitoring
- Continuous
- Evidence
- Archived and timestamped
- Alerts
- With context
- Getting started
- Historical report within 72 hours, then continuous monitoring
From traces to action
Public repository
API_KEY=••••••••••••••7QXSecret linked to your organisation
Revoke the keyExposed credentials
j.martin@example.com:••••••••Timestamped source and evidence
Reset access02How it works
What BreachScan does, step by step.
-
Forums and channels
Monitoring of underground forums and Telegram channels based on your domains and keywords.
-
Credentials
Correlation of work credentials, stolen sessions and exposed databases.
-
Published secrets
API keys, tokens and configuration files pushed by mistake to code hosting platforms.
-
Actionable alerts
Context, source, timestamped evidence and recommendations for every alert.
Use cases and deliverables
When to choose this product
- Investigate an alert about company credentials.
- Follow leaks involving your domains and brands.
- Prepare the necessary revocations, resets and checks.
What you receive
- Reports connected to the agreed scope.
- Context, sources and available evidence.
- Recommendations to start the response.
03Questions
Frequently asked questions
Who makes BreachScan?
BreachScan is a rootzero product. It is designed, built and run by the rootzero team in France.
How do I get started?
Historical report within 72 hours, then continuous monitoring. Write to us to arrange the setup.
What should I prepare for the first conversation?
Tell us the domains and brands to monitor and who handles alerts. Scope is confirmed before setup.
How do I get a proposal?
Describe your needs and scope. We agree arrangements, schedule and price with you before any commitment.
Further reading
The method, open to inspection.
Our public research and guides on these topics: the mechanisms, the evidence and the limits of each analysis.
Technical guide
Attack surface mapping: CT logs, forgotten assets and typosquats
Certificate Transparency, forgotten staging servers, open cloud storage, typosquats, SPF/DKIM/DMARC: what an attacker sees of you before you do.
Free tool
Evidence Sanitizer
Create a sanitised browser-only copy of requests, logs or report excerpts using stable markers and a summary that contains no original value.
Evaluate BreachScan on your scope.
Tell us the domains and brands to monitor and who handles alerts. Scope is confirmed before setup.
Request a demonstration+Same house
The other rootzero products
- SpectrAIAutonomous web and API pentesting
Automated web application and API pentesting
- DataShieldAttack surface management
Inventory of Internet-exposed services
- MailSentinelSuspicious email analysis
Suspicious email analysis