Most intrusions do not begin with a technical flaw. They begin with a person: an employee who receives a convincing message, a manager whose personal details are easy to find, a help desk that resets a password for a caller who knows enough to sound legitimate.
An exposure audit looks at that side of your organisation. It starts as open-source research, but its subject is people: who they are, what is known about them, how they relate to each other and how they could be approached. We gather that picture as an adversary would and show how it could be turned into an attack.
It complements a cybersecurity audit. One tests the systems, the other tests the way into them that passes through people.
What we look at
We start from the outside, with no inside knowledge, as an attacker would. From public sources we reconstruct who works for you, in which roles, and how to reach them. We do this with Durandir Intelligence, which keeps each piece of information tied to the source it came from and separates confirmed matches from people who only share a name.
For the people in scope we look for the information that makes an approach credible: corporate and personal contact details, accounts that appear in known breaches, what social profiles reveal about roles, habits and relationships, and documents that expose internal names and procedures.
We then identify who is most exposed and which roles give an attacker the most if they are deceived, such as finance, IT support and executive assistants.
Black, grey or white box
The same choice applies here. In a black box audit we start with only the name of the organisation, which shows what a stranger can assemble on their own. In a grey box audit you give us a list of the roles or people to focus on. In a white box audit we also review your internal procedures, such as how identities are checked before a password reset or a payment, and compare them with what an attacker could learn from outside.
Consent and limits
This audit concerns people, so its limits are strict. The scope names the organisation, the groups of staff included and the sources we may use, and it is agreed with you in writing before we begin.
We use information that is publicly accessible. We do not access private accounts or contact family members, and we collect only what is needed to show the risk.
Personal data is handled under data protection law, kept to the minimum, and deleted at the end of the engagement.
What you receive
A report that shows what is exposed, about whom, and where it comes from, ordered by the risk it creates for the organisation.
Concrete measures: which information to have removed and how, which accounts need new credentials, which procedures an attacker could exploit, and where awareness training would help most.
For information that should not be public, we can prepare the removal requests with Durandir Counterintelligence and check afterwards that the data is gone.
Findings about named individuals are reported with care and shared only with the people you designate.
We stay with you
Learning what is public about your own staff can be uncomfortable. We present the results to you in person or by call, explain what matters and what does not, and help you decide how to tell the people affected.
You have one person at Durandir to talk to throughout, and we remain available while you apply the measures, including for the staff members who want help reducing their own exposure.