This week
Zero-access security intelligence · Evidence-grade · Human-verified

Attackers read businesses with AI. LeakTrace reads them first.

Attackers use AI to find a way in. LeakTrace finds it first, proves it and re-checks until it is closed.

Use your work email at that domain. We send one confirmation link there and your reading goes to that address only.

See a sample reading Or tell us about your firm first
Zero access Evidence for every finding Every assessment human-verified Continuous exposure watch
Reading · your-firm.comIllustrative
Ways in open
3
Each with its evidence
Open: 3Closed: 0
Email sent in your nameDelivered
Discoverno rule refuses it
Addresses in breach databases3 found
Validatesource and date on each address
Website software1 open
Closeexact fix written, re-checked until closed
Look-alike domainsMonitored
Monitorre-read every hour
Illustrative firm · read-onlyHuman-verified
The AI agent era

Four ways AI is used against your firm.

The swarm

It attacks at scale.

Attackers run AI agents in swarms: many at once, each trying the combinations against any firm it can read. They work through combination after combination, around the clock, until one finds an opening to exploit.

The research

It researches you.

An attacker’s AI agent reads your website and staff pages to learn who approves payments and who your suppliers are.

The message

It writes the fraud.

Fake invoices, cloned voices and messages that sound like you, tailored from what is public about your business.

The answer

It answers for you.

Attackers manipulate AI answers to send your paying and enquiring clients to their own look-alike page, web address, sign-in page, phone number or email.

A penetration test or a red team tests your firm for a week or two a year, on dates you book, with your permission.

An attacker’s AI agents need no permission and keep no schedule. They read your firm every day, work through every combination and need to be right only once.

Attackers read businesses with AI. LeakTrace reads them first.

Business email compromise (BEC)
$3,046,598,558

Reported losses to business email compromise in the United States in one year: a scam that uses a hijacked or imitated business email account to get a payment sent. 24,768 complaints, 2025.

Source: FBI IC3 2025 Internet Crime Report, 2025. Reported losses only.

Request your firm’s reading

Security has always faced inward. LeakTrace is the AI layer that faces the attacker.

More than one door

Watch one forged invoice: how an attacker’s AI builds it, the openings it used and how each one gets closed.

Words on screen, no voice. Illustrative firm.

Read the transcript
  1. Attackers now send AI agents.
  2. An attacker’s AI agent: Find firms to impersonate. Thousands of firms read. Pick a firm. (harbourview-llp.example) Set up a copy of their address. (harbourview-llp-pay.example) Write invoice in the partner’s style. Send. (Illustration.)
  3. Invoice 2217: new bank details. From [email protected]. Paid · $48,200. Your firm never sent it.
  4. How did they get in?
  5. Copy of your address: set up. (harbourview-llp-pay.example) Mail from it looks like yours.
  6. Staff emails in leaked lists from hacks.
  7. A remote-access door, open to the internet.
  8. A private file, readable online.
  9. Software with a public weakness.
  10. Email anyone can fake.
  11. Six ways in.
  12. Attackers’ AI agents: Check every door.
  13. At every firm.
  14. LeakTrace checks from outside.
  15. Never your email or files.
  16. LeakTrace finds each one.
  17. The exact fix for each one. Step by step.
  18. Checks again from outside: closed.
  19. A copy isn’t yours to switch off.
  20. LeakTrace watches it, and every new one.
  21. LeakTrace checks for new copies every hour.
  22. Attackers read businesses with AI. LeakTrace reads them first. See what’s open at your firm. getleaktrace.com
The good news

What an attacker can see, LeakTrace finds first. Then it gets closed.

Attacks still start with something anyone on the internet can see: a mail setting that lets forgeries through, staff addresses in breach data, a look-alike domain, an open sign-in page.

5 min Every 5 minutesMail settings on monitoring and new certificates for your domain and its look-alikes within minutes
24 h Every dayEverything else, with an alert the same day
1 day Within a dayNewly exploited flaws matched to your website’s software
What changes on your external layer

Your firm keeps changing. So does what an attacker can see.

  • 01A new vendor or tool is allowed to send as youOne more sender an attacker can pose as.
  • 02Your mail moves to a new providerThe records that refuse forged mail can break in the move.
  • 03A new portal or subdomain goes liveA new sign-in page anyone can reach.
  • 04A certificate lapsesBrowsers warn your clients and a copy looks as trustworthy as you.
  • 05Your addresses turn up in a fresh breachReused passwords become a way into the mailbox.
  • 06A look-alike of your name is registeredSomeone can now write to your clients as you.

The first month of monitoring comes with the assessment.

Capabilities

Everything an attacker's AI agent can read about your firm. Read first.

LeakTrace reads your firm externally, the way an attacker's AI agent reads it. Nothing inside your firm is logged into, installed or touched. Each finding we show carries the record behind it and a check anyone can re-run, your insurer included.

Counted from our own records as of 12 Nov 2026, 13:18 UTC, refreshed hourly. Illustrative items are labelled.
Every finding, proven.
1.1M

Look-alike domains checked

New look-alikes of your name looked for every hour on monitoring.

420.4K

Certificate records read

New host names on your domain found within minutes of being certificated, on monitoring.

5,107

Firms read externally

Each read externally, the way an attacker’s AI agent reads it. Nothing logged into.

1 click per stepTo protect your name against forged mail, where we can reach your DNS host
Newest on the exploited list
Barracuda Networks Multiple Produ…Added 10 Nov · Barracuda Networks Multiple Products OS…
Openwave Messaging Limited Webtop…Added 10 Nov · Openwave Messaging Limited Webtop Media…
Barracuda Networks Barracuda Emai…Added 10 Nov · Barracuda Networks Email Security Gatew…
1 dayTo match a newly exploited flaw to the software a monitored firm’s site shows
up to 4,247attack-surface checks: every opening an attacker could use, each one checked
Routes
16attack routes: the combinations of those openings that lead to your firm's money, its data, its clients, its accounts and its name
72 hFrom confirmation to a human-verified assessment
Look-alikes
up to 350look-alike names an attacker could register from yours, each one looked up. On monitoring, re-checked every hour for new ones.
What AI assistants answer about your firm
6assistants checked for what they answer about your firm: Claude, ChatGPT, Gemini, Perplexity, Grok and CopilotAttackers manipulate AI answers to send your paying and enquiring clients to their own look-alike page, web address, sign-in page, phone number or email.
Public sources only
Your websitepages, certificates and the software it showsPublic
Your mail setupSPF, DKIM, DMARC and MX recordsPublic
Your domain recordsDNS, registration and transfer lockPublic
Certificate logsevery host name issued a certificatePublic
New registrationsweb addresses registered to look like yoursPublic
Breach listingsaddresses at your own domainPublic
0Log-ins to any client system. Each check is a public lookup, like this one.
5,442Public disclosures indexed, each with the way in. Updated daily
See every capability
Zero access

We hold no keys to your firm.

A provider that holds logins to many firms is one target that opens all of them. So we hold none.

  • No login to your systems.

    We never log in to anything of yours and we never keep a key.

  • Nothing installed on your machines.

    No agent, no software and nothing to update.

  • No access to your mailboxes.

    We read the public records about your email, never the email.

The only change we can make is to your firm’s email records and only when you approve it. No key is kept afterwards.

Why it matters: government cyber agencies warn that attackers break into providers to reach the firms they serve. Source: joint cybersecurity advisory AA22-131A, 11 May 2022, CISA, NSA and FBI with the Canadian Centre for Cyber Security and the national cyber centres of the UK, Australia and New Zealand. Read the advisory.

The outside record of trust

Every way in, found first and closed.

Agent against agent: attackers point AI at firms and LeakTrace reads them first. The external layer, AI-driven, in four stages: Discover, Validate, Close and Monitor.

What each AI agent does and what it can never do Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.

4 steps · click each
1 Discover1 Discover

Discover every way in

Found the way an attacker’s AI agent finds it.

On a paid assessment, the Discover AI agent reads what your firm shows the public internet with fixed checks, records each finding with its evidence and chooses follow-up checks.

up to 4,247attack-surface checks in each assessment
5 minutesMail settings re-checked every 5 minutes, new look-alike certificates seen within minutes, on monitoring
What we monitor
Email impersonationEach gap in the records that say who may send mail as you, found and closed
Brand impersonationNew look-alikes of your name looked for every hour
Attack surface discoveryNew systems exposed on your domain, found as they appear
Exploited vulnerabilitiesFlaws attackers are actively using, matched to your website’s software within a day
Credential exposureAddresses at your domain in a new breach, flagged the day our daily re-check finds them
2 Validate2 Validate

Validate every finding

Every finding is kept with the record that proves it. A person reads the assessment before release.

EveryPaid assessment is checked by a person before release
Verify a record
Evidence behind each findingThe record, header or listing we read, shown beside the finding
Dated assessment recordDated, with a fingerprint anyone you hand it to can check
Tamper-evident recordEach approval, alert and DNS change is chained and verified daily, so the record cannot be quietly altered
Anti-impersonation checkAnyone can confirm in one step that a message really came from us
3 Close3 Close

Close each opening

Forged email is the opening we find most. Where we reach your DNS host, you approve each step with one click: reporting first, then refusing forged email, about four weeks in all.

Every other opening comes with its fix, step by step. Each is re-checked externally until it is closed.

On a paid assessment, the Close AI agent gives you the fix for each finding and, for an email record, sets the steps out with your DNS host's own screens where we hold its guide. When you mark a fix done, AI chooses when to re-check and only a fresh external read closes it.

1 clickProtects your name against forged mail, where your DNS host is one we reach
With evidencethe questions on your cyber insurance application that an external read can answer
How it works
Mail fix, one click per stepOr the exact records to publish, where we cannot reach your DNS host
Takedown request draftedFor a look-alike worth a look that you say is not yours, for you to send
Patch before it is usedNewly exploited flaws matched to your software, with the fix
Insurer questions answeredThe ones an external read can answer, each with its evidence
4 Monitor4 Monitor

Monitor every 5 minutes, hourly and daily

Email settings: every 5 minutes. New look-alike certificates: within minutes. The rest hourly or daily, with alerts the same day.

On monitoring, fixed checks re-check your email settings every 5 minutes, see new certificates for your domain and for look-alikes of your name within minutes, look for new look-alike registrations every hour and re-check everything else every day. The Monitor AI agent puts first the change that needs you, with a plain reason when it has one.

5 minEmail settings and new certificates for your domain and its look-alikes, alerts by email
DailyEverything else, alerts the same day
For businesses
Alerts within minutes to an hourEach alert says what opened, in plain words
By emailEach alert names the way in and links to the full detail on your dashboard
Board-ready summaryA monthly record of what opened, what closed and what is still open
Peer benchmarkYour exposure ranked against others in your sector, where 30 or more are measured

What each AI agent does and what it can never do

The latest · 11 Nov 2026

How they got in this week and what we watch for you.

GermanyPublic source9 Nov 2026The Record

Mittwald CM Service

Way in
Automated AI tools that work through many organizations at once.
Our check
The doors those tools look for first, read externally.
Full incident index →
LeakTrace Research

What anyone can see about professional businesses, measured.

See the research

  1. Nearly9 in 10

    dental practices we read have no published rule telling mail servers to refuse mail forged in their name.

    LeakTrace index, readings to 8 October 2026 · 88.4%, read from each firm's public mail records
Show allShow less

  1. Nearly9 in 10

    dental practices we read have no published rule telling mail servers to refuse mail forged in their name.

    LeakTrace index, readings to 8 October 2026 · 88.4%, read from each firm's public mail records

  2. Nearly5 in 10

    accounting firms have a look-alike of their domain registered and live.

    LeakTrace Research · measured 30 Sep 2026 · 46.4%, common misspellings checked in public DNS

  3. 3 in 10

    accounting firms have a shared address such as info@ in monitored breach databases.

    LeakTrace Research · measured 30 Sep 2026 · 28.9%, shared addresses checked in monitored breach databases
The rules you answer to

Every finding, mapped to the rule you answer to.

Every assessment runs up to 4,247 attack-surface checks and follows 16 attack routes. We hand you the record your regulator, your insurer and your partners ask for.

FindingEmail forged in your name
RuleABA Model Rule 1.6(c), through your state barABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to keep client information from unauthorized access. Your state's own rules of conduct decide whether and how this duty applies to you.
You getThe dated record, the fix (one click per step on the DNS hosts we reach) and the re-check that confirms it closed.
Show allShow less

Law

FindingEmail forged in your name
RuleABA Model Rule 1.6(c), through your state barABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to keep client information from unauthorized access. Your state's own rules of conduct decide whether and how this duty applies to you.
You getThe dated record, the fix (one click per step on the DNS hosts we reach) and the re-check that confirms it closed.
FindingA web address registered to look like yours
RuleABA Model Rule 1.6(c), through your state barIt becomes a rule's concern only through its use: a payment sent to the wrong account, where who bears the loss is a matter of contract and payment law, or a password collected through it and then used on your mailbox, which can start the notice duties.
You getA person at LeakTrace sends the takedown request on your permission; the registrar decides.
FindingStaff addresses in breach databases
RuleABA Model Rule 1.6(c), through your state barIt is overseen by your state's highest court and its lawyer discipline office.
You getThe addresses we can name and the breaches they are listed in.
FindingAn exposed sign-in or software with a known flaw on your website
RuleABA Model Rule 1.6(c), through your state barIt is overseen by your state's highest court and its lawyer discipline office.
You getEach match comes with what we saw and the fix.

Accounting

FindingEmail forged in your name
RuleFTC Safeguards Rule, 16 CFR 314.4If the FTC Safeguards Rule covers your firm, it asks for multi-factor authentication for anyone signing in to your systems and an assessment of internal and external risks (written, once you hold information on 5,000 or more consumers). A breach of 500 or more customers' information is reported to the FTC within 30 days (16 CFR 314.4).
You getThe dated record, the fix (one click per step on the DNS hosts we reach) and the re-check that confirms it closed.
FindingA web address registered to look like yours
RuleFTC Safeguards Rule, 16 CFR 314.4It becomes a rule's concern only through its use: a payment sent to the wrong account, where who bears the loss is a matter of contract and payment law, or a password collected through it and then used on your mailbox, which can start the notice duties.
You getA person at LeakTrace sends the takedown request on your permission; the registrar decides.
FindingStaff addresses in breach databases
RuleFTC Safeguards Rule, 16 CFR 314.4It is overseen by the Federal Trade Commission.
You getThe addresses we can name and the breaches they are listed in.
FindingAn exposed sign-in or software with a known flaw on your website
RuleFTC Safeguards Rule, 16 CFR 314.4It is overseen by the Federal Trade Commission.
You getEach match comes with what we saw and the fix.

Wealth

FindingEmail forged in your name
RuleSEC Regulation S-P, 17 CFR 248.30As an SEC-registered firm, Regulation S-P asks for written safeguards and an incident response program. Customers must be told within 30 days when their sensitive information was, or is reasonably likely to have been, accessed without authorization (17 CFR 248.30).
You getThe dated record, the fix (one click per step on the DNS hosts we reach) and the re-check that confirms it closed.
FindingA web address registered to look like yours
RuleSEC Regulation S-P, 17 CFR 248.30It becomes a rule's concern only through its use: a payment sent to the wrong account, where who bears the loss is a matter of contract and payment law, or a password collected through it and then used on your mailbox, which can start the notice duties.
You getA person at LeakTrace sends the takedown request on your permission; the registrar decides.
FindingStaff addresses in breach databases
RuleSEC Regulation S-P, 17 CFR 248.30It is overseen by the Securities and Exchange Commission.
You getThe addresses we can name and the breaches they are listed in.
FindingAn exposed sign-in or software with a known flaw on your website
RuleSEC Regulation S-P, 17 CFR 248.30It is overseen by the Securities and Exchange Commission.
You getEach match comes with what we saw and the fix.

Medical

FindingEmail forged in your name
RuleHIPAA Security Rule, 45 CFR 164.308If HIPAA covers your practice, it asks for an accurate and thorough risk analysis and security measures that reduce risks to a reasonable level (45 CFR 164.308); a phished mailbox holding patient records can start breach notice duties.
You getThe dated record, the fix (one click per step on the DNS hosts we reach) and the re-check that confirms it closed.
FindingA web address registered to look like yours
RuleHIPAA Security Rule, 45 CFR 164.308It becomes a rule's concern only through its use: a payment sent to the wrong account, where who bears the loss is a matter of contract and payment law, or a password collected through it and then used on your mailbox, which can start the notice duties.
You getA person at LeakTrace sends the takedown request on your permission; the registrar decides.
FindingStaff addresses in breach databases
RuleHIPAA Security Rule, 45 CFR 164.308It is overseen by the HHS Office for Civil Rights.
You getThe addresses we can name and the breaches they are listed in.
FindingAn exposed sign-in or software with a known flaw on your website
RuleHIPAA Security Rule, 45 CFR 164.308It is overseen by the HHS Office for Civil Rights.
You getEach match comes with what we saw and the fix.

Shown for the United States. Which one applies depends on your business and your briefing names it.

The rules pages, each rule quoted from its source

All rules we map
SEC Regulation S-PUS

SEC-registered advisers and broker-dealers: an incident response program, oversight of service providers and notice to affected customers no later than 30 days after becoming aware.

FTC Safeguards RuleUS

Tax preparers, mortgage brokers and other financial institutions: multi-factor sign-in and notice to the FTC within 30 days of a breach of 500 or more people.

HIPAAUS

Covered clinics: protect patient health information and tell patients within 60 days of discovery.

State breach notification lawsUS

Notify affected people when personal information is exposed. Timing varies by state.

201 CMR 17.03US

Anyone holding a Massachusetts resident's data: review the written security program every year.

PIPEDACA

Safeguards appropriate to the sensitivity of the information. Notify of a breach that creates a real risk of significant harm and keep a record of every breach for 24 months.

Alberta PIPACA

Prompt notice to the Commissioner where harm is a real risk.

BC PIPACA

Reasonable security arrangements against unauthorized access.

PHIPACA

Ontario health custodians: protect patient information and notify the Information and Privacy Commissioner of breaches.

We list a rule only where we can say honestly whether it applies to you.

Who it is for

For those who hold other people’s money and confidences.

LawyersReal estate brokeragesInsurance brokeragesAccountantsAdvisers and wealth managersDental and clinics
Show allShow less
Law

Lawyers

Trust accounts, privileged files and the closing email a forged invoice copies.

For lawyers→ Real estate

Real estate brokerages

Deposits, closing funds and the message that tells a buyer where to send them.

For brokerages→ Insurance

Insurance brokerages

Policyholder records, renewals and the address clients trust.

For brokerages→ Accounting

Accountants

Client portals, tax season and the payment request that looks like yours.

For accountants→ Wealth and advisers

Advisers and wealth managers

Client money and the instructions that move it.

For advisers→ Dental and clinics

Dental and clinics

Patient records and booking email.

For dental practices→

LeakTrace reads firms in 55 lines of work. See every line of work

Go deeper
Questions

What owners ask before they request a reading.

Nothing of yours. We read what is public, the way an attacker’s AI agent would.

See your firm the way an attacker’s AI sees it.

Your reading: your email setup, your website, look-alike domains, staff addresses in breach data and your sign-in pages, each with its evidence; the fix steps and an AI security agent on your dashboard come with the assessment. Read-only and sent only to your work email.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Mutual NDAAvailable on request

A person reads every request. We reply within 4 business hours from [email protected]. Privacy · See a sample reading

The incidents that reach businesses like yours and what to check, in one email. Sign up