We show you what anyone can already see about your business from outside, and the fix for each item. Read-only, from public sources, reviewed by a person before release.
This is not a compliance checkbox. Every finding shows how anyone can check it, with a step-by-step fix your IT provider can follow.
Cybercriminals now use AI to generate phishing emails in bulk, spoof invoices with plausible signatures, spin up lookalike domains, and personalize spear-phishing at scale. A firm without its own security team rarely sees that view the way an attacker does. LeakTrace reads it from public sources, a person reviews every finding, and you receive three documents and a signed summary inside 72 hours of confirmation, with the first 30 days of daily re-checks included.
177 organisations were listed on criminal leak sites in the last 7 days, by 43 different groups. Of these, 46 were in the United States and 5 in Canada.
Source: public ransomware leak-site listingsA former U.S. Army soldier was sentenced to 70 months in prison for hacking into the databases of at least 10 organizations, including telecommunications companies, and attempting to extort over $1 million. The threat …
Health P.E.I. announced that personal information belonging to approximately 234,000 individuals was compromised in a data breach. The incident occurred through service provider Maximus Canada, where an unauthorized person accessed a...
An individual was scammed into paying a ransom after receiving a phone call featuring an AI-generated deepfake voice impersonating his brother. The caller claimed the brother had been kidnapped, leading the victim to pay …
Public breach reference. If your business connects to any of these vendors, suppliers, or platforms, review your exposure below.
The scouting, credential checks, infrastructure mapping and staff profiling happen from outside, long before any alert fires.
One employee reuses a password from an old breach. An attacker tests it at 3am. It works. They're in your email system, reading client files, forwarding invoices, before anyone notices anything unusual.
Your CFO is on LinkedIn. Your domain is publicly registered. An AI tool drafts a convincing spoofed email in under a minute. No hacking involved, just your publicly available information, used against you.
By the time ransomware appears, the attacker has been inside for months, mapping your infrastructure, confirming your backups, and sizing the ransom demand before making a move.
The tools your business relies on, spam filters, employee training, perimeter firewalls, were designed for a threat landscape that no longer exists. AI has fundamentally changed how attacks are constructed. Most defenses haven't been updated to match.
We read your domain the way an attacker would. Every finding is documented, scored, and paired with a specific action, and every finding carries the command or public source that proves it, so anyone can re-run it. Leadership gets plain language. Your IT contact gets technical detail.
No jargon in the Owner Summary and Action Brief. Shareable with leadership, your insurer, or your regulator. The first 30 days of daily re-checks are included.
LeakTrace is independent. We sell no remediation or implementation, so we have no stake in what we find.
After delivery you receive access to a private dashboard with your documents and findings. For the first 30 days your domain is re-checked daily from outside, with an alert the day something changes.
A dated, signed record that you looked at your outside view and acted on what it showed answers the security question a client, an insurer or a regulator asks.
The signed summary delivered with every audit, alongside the three documents. It states what was assessed, when, from which public sources, and what was found. It is the one document written to leave the building.
If your business holds client data, financial records, health information, or privileged communications, your exposure profile is a target. LeakTrace works across every professional services vertical.
Privileged client communications are your liability. One breach, a leaked file, a spoofed email, an exposed login, and you're explaining it to the Law Society and your clients simultaneously.
A PIPEDA or HIPAA violation triggers mandatory disclosure, potential fines, and the kind of press coverage that follows a practice for years.
You hold banking credentials, SINs, financial statements, and CRA correspondence for dozens of clients. That concentration of data is what makes a practice worth targeting.
One spoofed email redirecting closing funds is enough. The transaction looks normal until the money is gone. Your domain and your people can be mapped from public records.
Securities regulators scrutinise cybersecurity practices as part of advisor oversight. A breach does not just cost money, it puts your license to operate at risk.
You hold client risk profiles and financial information. Regulators expect you to demonstrate the same security practices you recommend to your clients. LeakTrace gives you documented proof.
LeakTrace publishes quarterly threat intelligence based on real observations across owner-run firms in North America. Free to read. Journalist inquiries welcome.
Client identities remain confidential.
The preview is the private brief we send you before you order. This is a standing guarantee, not a limited-time offer. The terms are written into our refund policy.
Assessment requests are reviewed and confirmed within one business day. All communications are confidential. An NDA is available before any work begins.
Tell us about your organization. We will review and respond within one business day.
Our assessment team will review your request and follow up within one business day to confirm scope and next steps.
No automated activity will be run on your domain until you authorise it.
We would like to use Google Analytics to count visits and see which pages are read. It stays off unless you accept. Cookie policy