Matt Sherzay
Matt Sherzay founded LeakTrace and leads the company. LeakTrace Inc. is headquartered in Toronto.
Attackers read businesses with AI. LeakTrace reads them first.
Why he started LeakTrace
The company’s thesis puts it plainly: “The information exists. It never reaches the person it is about.” “If the information exists but never arrives, the useful thing to build is not more advice. It is delivery.”
What LeakTrace does
The goal is to help firms harden themselves against the threats they face now. LeakTrace shows a firm what an attacker's AI agents can read about it, gives it the steps for each way in and keeps reading as the threats change.
LeakTrace is zero-access security intelligence. The platform is an AI layer that reads an organization externally, as attackers' AI agents do, without access to any system. It covers the external attack path end to end: identity, mail, sign-in and payment.
It reads email sent in a firm's name, the look-alike domains an attacker could register from its name, staff addresses in breach data and the firm's website and services. It keeps reading after the assessment.
All of it is done externally. Nothing inside a firm is logged into, installed or touched.
Why now
Attackers run AI agents in swarms: many at once, each trying the combinations against any firm it can read.
We read for the combinations first.
Two documented cases show the shift.
AI on both sides
The swarms above are one side of it. The other runs through the answers people now ask for.
A client who asks an AI assistant about your firm trusts the answer it gives. Assistants build those answers from pages they crawl.
In 2025, asked for the sign-in pages of 50 brands, an AI assistant gave addresses the brand did not control one time in three. Netcraft research, read on 4 November 2026
assistants asked what they say about your firm, in each assessment
Inside LeakTrace, a model's sentence is kept only when its quote is in the record.
A person verifies every paid assessment before release.
How the company works with a firm
The assessment reads the firm once in full and is released inside 72 hours of confirmation.
Every finding is evidenced. Every assessment produces a dated, independently verifiable record.
Monitoring keeps reading: email records every hour, new look-alike registrations every hour and everything else every night.
With the firm's permission, a person at LeakTrace sends the takedown request for a look-alike in the firm's name. The registrar decides.
Who it serves
LeakTrace serves those who hold other people's money and confidences: lawyers, accountants, dental practices and clinics, advisers and wealth managers, insurance brokerages and real estate brokerages. It works with firms of any size in Canada and the US. The United Kingdom is next.
The platform in figures
- up to 4,247
- separate moves tried against a firm in one assessment, all externally. Only the checks with a fixed limit are counted.
- 75
- attacker techniques tested against a firm on every assessment
- 16
- routes to a firm's money, clients, accounts and name, each followed from start to finish
- up to 350
- possible look-alikes of a firm's web address checked for whether someone has registered them
- 1 h
- between each fresh read of a monitored firm's email records
- 1 day
- for a software flaw attackers have started using to be matched to the firms running that software
- 0
- log-ins to a firm's systems. Not one, on any assessment.
Security has always faced inward. LeakTrace is the AI layer that faces the attacker.
To reach a person, write to [email protected].