Monitoring frequencies
What we analyse, and how often. It all runs automatically, with nothing to trigger on your side.
| What is analysed | Frequency | Detail |
|---|---|---|
| Accounts in public breaches | Daily | Your monitored addresses are compared against public breach databases. An alert goes out as soon as a new match appears. |
| External attack surface | Daily | Subdomains, exposed services, DNS configuration and certificates. A snapshot is kept so changes can be tracked. |
| Secrets in public code | Twice a day | Keys and credentials published by mistake in public repositories. Two automatic passes a day, twelve hours apart at most, from the Business plan up; on other plans you start the scan yourself from the dashboard. |
| Look-alike domains | Daily | New domains imitating yours, and their reputation. Certificates issued worldwide are reviewed daily. |
| On-demand scan | Immediate | You can re-run an analysis at any time from your dashboard, without waiting for the automatic pass. |
No analysis is "real time": we do not watch your systems continuously, we query public sources at regular intervals. That distinction matters, and we would rather write it down.
1. Exposure level and security score
The security score is the headline number on your dashboard. It reflects how exposed your company is right now β it is not a full cybersecurity audit, which would require internal technical testing.
Two different numbers, don't mix them up. The calculation below produces an EXPOSURE score: the higher it is, the worse the situation. The score shown on your dashboard is the opposite β a SECURITY score out of 100, where 100 is excellent. Mapping: exposure 0 β security 95; 1β20 β 80; 21β45 β 55; 46β70 β 35; 71β100 β 15.
General principle
Exposure rests on three things:
- The weight of active (unresolved) leaks relative to all detected leaks, weighted by severity and recency.
- Floors, so that one genuinely serious leak cannot be hidden behind many small resolved ones.
- A plain-language level, for readability.
Severity weighting
Each leak is given a weight based on its severity:
| Severity | Weight | Example |
|---|---|---|
LOW | 1 | Email address alone, no password |
MEDIUM | 2 | Email + non-sensitive personal data |
HIGH | 4 | Sensitive data, or a password likely to be reused |
CRITICAL | 8 | Clear-text password, or stealer malware |
Recency weighting
A recent leak is more dangerous than an old one, because the passwords are more likely to still work and the data is more likely to still be usable. Each leak is weighted by its original date:
| Age of the leak | Factor |
|---|---|
| Under 6 months | Γ1.5 |
| 6 to 12 months | Γ1.0 |
| 1 to 2 years | Γ0.7 |
| Over 2 years | Γ0.4 |
Formula
totalWeight = Ξ£ (severity Γ ageFactor) // all leaks activeWeight = Ξ£ (severity Γ ageFactor) for unresolved leaks exposure = (activeWeight / totalWeight) Γ 100 // Floors if β₯1 active leak with an exposed password β exposure = max(exposure, 75) if β₯1 active HIGH/CRITICAL leak, no password β exposure = max(exposure, 55) // Level shown exposure 0β20 β Low exposure 21β45 β Moderate exposure 46β70 β High exposure 71β100 β Critical // SECURITY score shown on your dashboard (100 = excellent) exposure 0 β 95 exposure 1β20 β 80 exposure 21β45 β 55 exposure 46β70 β 35 exposure 71β100 β 15
Worked example
A company has 3 leaks: (1) a password exposed 3 months ago (weight 8 Γ 1.5 = 12), (2) a HIGH leak 18 months ago, resolved (weight 4 Γ 0.7 = 2.8), and (3) a LOW leak 8 months ago, unresolved (weight 1 Γ 1.0 = 1).
Total weight is 15.8, active weight is 13 β an exposure of 82. Because a leak with an exposed password is active, the floor of 75 applies (already exceeded). The level shown is therefore Critical β that is, a security score of 15/100 on your dashboard.
The formula is published here in full: you can redo the calculation by hand on your own numbers. It may change, and every change is documented on this page.
2. Urgency levels (Urgent / Important / Monitor)
Every individual leak is sorted into one of three urgency levels. That classification drives the leaks table, the action groups and the email alerts.
| Level | Criterion | What it means |
|---|---|---|
| Urgent | Exposed password OR a stealer-type leak (infostealer, redline, raccoon, vidar, lumma) | Direct access is possible with those credentials until the password is changed. |
| Important | HIGH or CRITICAL severity with no exposed password | Sensitive data is exposed. The password may be reusable against your accounts. |
| Monitor | Any other leak | Personal information visible publicly. Main risk: targeted phishing. |
3. Average response time
Average response time (formerly MTTR, Mean Time To Resolve) measures the average delay between detecting a leak and marking it as handled.
averageResponseTime = average(resolvedAt β detectedAt) over leaks where resolved = true AND resolvedAt is set
This number only means something above a certain volume. With fewer than 3 handled leaks it is shown as "β" rather than as a potentially misleading value.
The colour thresholds shown on the dashboard are:
- Green β under 72 hours (fast reaction, aligned with the CNIL deadline)
- Amber β between 72 hours and 7 days
- Red β over 7 days
4. Sensitive account detection
KryptaScope automatically identifies high-value role mailboxes (management, finance, IT, and so on) so they can be monitored first. Detection is based on the local prefix of the address β the part before the @.
Recognised prefixes are grouped into 6 categories with business priorities:
| Category | Priority | Example prefixes |
|---|---|---|
| IT / Administration | 1 (highest) | admin, root, dsi, sysadmin, rssi, ciso, postmaster |
| Management | 1 | ceo, cto, cfo, pdg, dg, president, directeur |
| Finance / Accounting | 1 | finance, compta, daf, paie, facturation |
| Legal / Compliance | 2 | legal, dpo, rgpd, compliance |
| Human resources | 2 | rh, hr, recrutement, talent |
| Public contact | 3 | contact, info, support, sales, commercial |
Matching is deliberately conservative: an address is only flagged if the prefix matches exactly, or is followed by a separator (dot, hyphen, underscore), or appears as a separate token. Personal names (jean.dupont@) are never treated as sensitive, even when the first name contains a prefix from the list.
The full list of recognised prefixes is reproduced above. You can suggest additions from the contact page.
5. Known limitations and disclaimers
KryptaScope is an external monitoring tool. It does not replace:
- An internal technical security audit (pentest, ISO 27001 audit)
- A security policy and its enforcement
- Training staff on phishing and everyday digital hygiene
- Basic technical measures (two-factor authentication, password manager, antivirus)
- DPO support for organisations subject to GDPR
The data sources KryptaScope uses are public databases of known breaches. A leak can exist without appearing in them (private, undisclosed breaches). So finding nothing is not a guarantee that nothing is exposed.
For the full list of data sources and processing safeguards, see the Trust page.