Overview
Every scan generates an Exposure Report. Whether you ran a free scan or have a paid report, this guide walks you through each section so you can take action quickly.
Report Header
The top of every report shows:
- Target domain — the domain that was scanned
- Report ID — a unique identifier (first 8 characters displayed)
- Generated — when this report was created (e.g., "2h ago", "3 days ago")
- Previous report date — for Pro Guard users with multiple reports, shows when the last report was generated
If you have a paid (full) report, an "Export PDF" button appears in the header. Free reports show an "Unlock Full Report — from $249" button instead.
Security Health Score
The risk severity rating summarizes the overall threat level for your domain:
| Score | Label | Meaning |
|---|---|---|
| ≥ 70 | Critical | High volume of recent exposures. Immediate remediation is required to prevent unauthorized access. |
| ≥ 40 | High | Significant exposures across multiple sources. Review and rotate affected passwords promptly. |
| ≥ 20 | Medium | Moderate exposure detected. Review recommended. |
| < 20 | Low | Minimal exposure detected. Continue monitoring. |
The score factors in the total number of exposures, the recency of the data, and the diversity of sources where credentials were found.
Key Statistics Panel
Three stats are displayed alongside the risk score:
- Total Exposures — the number of unique credential records found across all sources
- New Since Last Report — how many new exposures appeared since the previous report (Pro Guard only). Shows "—" for first-time reports.
- Data Freshness — when the most recent exposure in this report was last seen in our sources (e.g., "Today", "3 Days Ago", "Jan 15, 2026")
Key Findings (Analytics)
Below the statistics, a Key Findings section highlights patterns and insights:
- Distribution of exposures by severity level
- Most common breach sources (stealer logs, combo lists, breach databases)
- Trends compared to the previous report (more or fewer exposures)
- Summary of the most affected email accounts
This section only appears when analytics data is available.
Exposure List
The main body of the report. Each entry includes:
| Field | Free Report | Full Report |
|---|---|---|
| Email address | Partially masked | Fully visible |
| Source URL | Hidden | Fully visible |
| Password | Hidden | Fully visible |
| Leak source type | Visible | Visible |
| Detection date | Visible | Visible |
Full reports display all credentials with no redaction. You can scroll through the list — entries are paginated for performance.
Remediation Card
Below the exposure list, the Remediation Card provides actionable steps:
- Force password resets for all affected accounts — prioritize admin and privileged accounts
- Enable multi-factor authentication (MFA) on all corporate services
- Scan endpoints for malware — stealer log entries suggest an infected device
- Audit credential reuse — check if exposed passwords are used on other services
- Implement continuous monitoring for ongoing protection
Compliance Card
The final section maps credential exposure to compliance frameworks:
- SOC 2 — credential monitoring as part of the Trust Services Criteria
- ISO 27001 — information security management requirements
- GDPR — personal data breach notification obligations
- PCI-DSS — payment card industry data security standards
This helps security teams justify remediation actions and monitoring investments to leadership.
Related Articles
- Masked vs. Full Reports — what's visible in each tier
- Risk Severity Scores — deep dive into scoring methodology
- Unlocking a Full Report — how to access all credential data