Overview
When Verusight's continuous monitoring detects new credential exposures for one of your monitored domains, a multi-step alert process is triggered to ensure you're informed and can act quickly.
The Alert Flow
1. Detection
The background worker scans for new exposures every 30 minutes. When it finds credentials that weren't in the previous scan — whether from a fresh stealer log dump, a new breach disclosure, or a dark web marketplace listing — they're flagged as new findings.
2. Email Alert
If you have "New Breach Alerts" enabled in your notification preferences, an email is sent to your registered email address. The alert includes:
- The affected domain
- The number of new exposures detected
- A link to view the details in your dashboard
If "Critical Only" mode is enabled, alerts are only sent when the new findings push the severity score to Critical (≥ 70).
3. Dashboard Updates
New exposures appear immediately in your Dashboard → Exposures page. You can:
- Filter by date to see only recent findings
- Search by email address to identify affected employees
- Export to CSV for your incident response team
- Click any exposure for full details in the slide-out panel
4. Monthly Report
At the end of the billing month, all new findings are consolidated into the monthly report. The "New Since Last Report" metric shows exactly how many additional exposures were detected, making it easy to track trends.
Recommended Response
When you receive an alert about new credentials:
- Identify affected accounts — review the exposed email addresses to determine which employees or services are compromised
- Force password resets — prioritize admin accounts, VPN/remote access, email, and critical SaaS platforms
- Revoke active sessions — log out all compromised users from active sessions
- Check for unauthorized access — review login logs and audit trails for the affected accounts
- Enable MFA — if not already enforced, enable multi-factor authentication on all affected services
- Investigate the source — stealer log entries suggest malware on a device; run endpoint scans
For a comprehensive response framework, see our Breach Response Playbook.
Alert Timing
| Event | Timing |
|---|---|
| New exposure detected | Within 30 minutes of data ingestion |
| Email alert sent | Within minutes of detection |
| Dashboard updated | Immediate |
| Monthly report | End of billing month |