Getting started with Scryer

Before you begin

Choose a clear question for your first investigation. You might want to understand whether employee credentials have been exposed, whether your brand appears in underground discussions, or whether a supplier is named in a claimed breach.

Gather the identifiers relevant to that question, such as your primary domain, known company names, and approved subsidiary domains. Define which organizations and assets fall within your team’s remit. Assign an owner who can assess the findings and coordinate any response.

Begin with a focused search

Start with a known domain or organization name. Review the returned records for a clear connection to the asset you are investigating. A matching name may refer to another business, and a corporate email address may appear in a record from an unrelated service.

Expand your search using confirmed details from relevant findings. Related domains, account identifiers, and source references can help you follow the evidence while keeping the investigation focused.

Review the evidence

For each relevant finding, identify what was exposed, which asset or account it concerns, and where the information came from. Review the available dates and distinguish the date Scryer discovered a record from any date associated with the underlying event.

Record what the evidence supports and what still needs checking. A seller’s claim, an exposed credential, and confirmed unauthorized access are different findings and may require different responses.

Establish your review process

Agree who reviews new findings, how urgent cases reach the responsible team, and where investigation decisions are recorded. Define a review cadence that reflects the importance of the assets involved.

Complete your first review with a short record: the question investigated, the evidence found, the owner, and the next action. Use the search and findings guides to make that process consistent as your scope grows.