Understanding your findings

Identify what the record shows

Start with the type of evidence. A credential record, a forum post advertising data, and a threat actor’s breach claim each support different conclusions.

Describe the finding precisely. For example: an employee address appears in a credential record; a seller claims to hold customer data; or a post names a supplier as a victim. Keep the observation separate from any conclusion about current access or business impact.

Review the source and timing

Consider where the information appeared and how much supporting context is available. Original material, copied listings, and unsupported claims may require different levels of validation.

Review the dates shown and what each one represents. Discovery, publication, collection, and the underlying compromise may have occurred at different times. If the event date is unknown, record that uncertainty. A newly discovered record may describe an older exposure.

Follow related evidence

Use Scryer’s AI-assisted context and related findings to guide your review. Check important connections against the underlying records before relying on them for a response decision.

Look for agreement across identifiers, source material, and internal evidence. Several copies of one listing should be treated as a shared source unless there is a reason to consider them independent.

Assess the potential impact

Consider the importance of the account or asset, the sensitivity of the information, and whether there is evidence of ongoing misuse. An exposed privileged account may warrant a different response from an old record associated with an inactive account.

Confirm what you can with the responsible internal team. External intelligence can point to an exposure; identity, endpoint, and application records can help establish what happened inside your environment.

Choose and document the next action

Assign an owner and explain why the finding requires action, further validation, or continued review. Record the evidence behind that decision and any information that could change it.

A useful assessment allows the next person to understand what is known, what remains uncertain, and what should happen next.

Next guide: Responding to exposed credentials