Exposed Credentials data: view and understand the results

Ingrid

Exposed Credentials data lists the breaches in which a company’s credentials were exposed, along with the number of exposed records. You view it in the Risk Vectors page of the Bitsight application you use. Admin and Group Admin users can also download it from the Security Posture Management application.

This article explains how to find Exposed Credentials data in the Risk Vectors page, what each field and disclosed attribute means, and how to preview Identity Intelligence data. It also covers who can download the data and where the download is available.

Availability

Security Posture Management (SPM) application
Continuous Monitoring (CM) application
Cyber Insurance application

Requirements

To download data or preview Identity Intelligence data, you need the Admin or Group Admin role. See Permissions.

What is Exposed Credentials data?

Exposed Credentials is a risk vector. Its data lists each breach event in which the company’s credentials were exposed. Each entry shows the source of the exposed data, the relevant dates, and the record counts.

In the Exposed Credentials section of the Rating Details page, select the Details button to see the data.
Admin and Group Admin can download Exposed Credentials data for your My Company and My Subsidiary in the Security Posture Management application.

How do I view Exposed Credentials data?

In the Security Posture Management application

Select Organization
Select Risk Vectors.
In the Exposed Credentials section, select the Details button.

In the Continuous Monitoring application

Select Vendor Risk
Select Risk Vectors.
In the Exposed Credentials section, select the Details button.

In the Cyber Insurance application

Select Client Risk
Select Risk Vectors.
In the Exposed Credentials section, select the Details button.

How do I see records for a single breach?

Open Exposed Credentials data as described above.
Find the breach you want to examine.
Select View Details for that breach.

How do I download Exposed Credentials data?

Admin and Group Admin users can download Exposed Credentials data for My Company and My Subsidiary. The download is available only in the Security Posture Management application.

Field	What it shows	CSV column
Account		`account`
Breached site	The location where the exposed data originated.	`breach_name`
Description	Information about the breach event or record source. Links to the original source report appear where available.
Domains	The current domains of the company that are affected.
Exposure date	The date when the records were exposed.	`event_date`
Observation date	The date Bitsight observed the data.	`observation_date`
Records	The total number of the company’s exposed credential records. This count includes duplicate emails when additional unique data, such as distinct passwords, is available. Full details are in Identity Intelligence.
Record count	The number of times unique data, such as distinct passwords, was exposed in a breach. Full details are in Identity Intelligence.	`record_count`

Which disclosed attributes can appear?

Disclosed attributes are types of sensitive details found in compromised sources. Bitsight does not display the contents of these attributes, in line with the Bitsight Privacy Policy.

Attribute	What it means
Date of birth	Demographic details about the account owner. Organizations often use this value for identity verification.
Email addresses	Email addresses linked to the disclosed account, typically used for sign-up or notifications.
Gender	Demographic details about the account owner.
Hashed passwords	The source stored passwords as hashes, such as SHA-1, without a salt. Hashing hides the original password, but unsalted hashes are vulnerable to dictionary attacks.
IP addresses	Network addresses the account owner used to sign in to the compromised source.
Known languages	Demographic details about the account owner.
Name	Typically the real-world name of the account owner.
Password hints	Text the user stored to help remember a password.
Passwords	The source stored passwords without encryption.
Personal phone numbers	Personal contact details for the account owner.
Physical address	Typically the mailing address of the account owner.
Physical characteristics	Free text, typically from social networking or dating sites.
Race	Demographic details about the account owner.
Relationship status	Demographic details about the account owner.
Salted hashed passwords	The source hashed passwords with a salt, a modifier that makes the stored password very difficult to guess.
Security questions	Questions, and sometimes answers, that the user supplied for verification.
Sexual orientation	Demographic details about the account owner.
Social network accounts	Other social network sites on which the account owner has accounts.
User photograph	Typically an image of the account owner.
Usernames	Usernames linked to the disclosed account.
Work phone number	Contact details for the account owner.

What is Identity Intelligence?

Identity Intelligence is a premium product offering from the Cyber Threat Intelligence (CTI) product suite. A preview (of the aggregated data Identity Intelligence provides) is presented in the new Identity Intelligence preview card in the Exposed Credentials section of Rating Details.

Identity Intelligence automatically and continuously searches underground sources for compromised and exposed credentials. These sources include data dumps from known breaches, unattributed or anonymous leaks, underground chatter, stealer logs from private sources, and compromised credentials sold on log markets.

Identity Intelligence includes the following capabilities:

It sends alerts when new credentials are discovered.
It provides details about credentials that belong to your organization and may have been compromised.
More credentials than the standard Exposed Credentials data.
It offers password policy filtering, email exclusions, and correlation with identity providers (IdP).
It identifies credentials that leak repeatedly.

Access for sale is an Identity Intelligence capability. It shows compromised devices, often infected through stealer malware, that are offered for purchase in underground markets. This data covers only the domains and IP addresses in your organization’s attack surface.

How do I preview Identity Intelligence data?

Only Admin and Group Admin users can preview Identity Intelligence data.

The preview is available only for your own organization, through the Security Posture Management application. See Permissions.

Instructions

In the Security Posture Management application, select Organization.
Select Risk Vectors.
In the Exposed Credentials section, find the Identity Intelligence preview card.

What do the Identity Intelligence metrics mean?

The Identity Intelligence card compares Premium numbers, which come from Identity Intelligence data, with Standard numbers, which come from Exposed Credentials data. The Premium numbers may use a sample of your organization’s domains. In that case, the card can show less data than exists. The card is for illustrative purposes only.

Metric	What it counts
Access for sale last year	Accounts with access for sale in the last 365 days. This capability exists only in Identity Intelligence, so the Standard value is always “-”.
Detected in the last 7 days	Individual credentials across leak events detected in the last 7 days, measured from the observation date.
Detected in the last year	Individual credentials across leak events detected in the last 365 days, measured from the observation date.

Publish Date or Recent Edits

October 21, 2026: Ratings Details renamed to Risk Vectors.
March 25, 2026: Security Posture Management rebrand.
September 10, 2025: Record count.
April 11, 2025: CSV column names.
March 25, 2025: Identity Intelligence Preview.
January 14, 2024: Access clarifications.