See Your Company the Way an Attacker Does: Reading the CxO Dashboard

Before an attacker targets a company, they do homework.

Not exotic homework. They assemble what is already public: which employee emails appear in which breaches, what leaked alongside them, which passwords might still work somewhere. It is boring, methodical, and effective, and the raw material is breach data anyone can query.

The CxO dashboard in XposedOrNot shows you the same picture, assembled the same way, for free. Setting it up takes ten minutes; this post is about what to do once you have it: how to read each panel, what “bad” actually looks like, and the monthly ritual that turns a dashboard into decisions.

Panel 1: The exposure overview. Establish your baseline, not your panic.

The first card, Exposure Overview, gives you three numbers: domains monitored, exposed emails, exposed records. The one to write down is exposed emails, the total breached addresses across your verified domains. Two things to know before reacting:

First, almost every company has a number here. Across our catalog of 776 breaches and 11.58 billion records (as of August 19, 2026, live API), corporate domains are everywhere, because employees sign up for things. A non-zero number does not mean you failed; it means your company exists.

Second, the number is a baseline, not a verdict. Its job is to be compared against: last month’s number, and the day a new breach adds to it. Write it down (or let the trend panel do it for you).

What bad looks like: not a big number. A big recent jump you cannot explain.

The VIP view: Executive Exposure

Directly under the overview sits Executive Exposure: three counts, for CxO, VP, and Director addresses found in breaches. Expect values here. Executives carry a long career’s worth of signups, conference registrations, and old vendor portals on their work address, so a read like the one below, a couple of CxOs, a handful of VPs, a dozen directors, is the common case at an established company, not the alarming one.

What earns this card its own tile is who the addresses belong to. A junior analyst’s leaked password is a problem; the CFO’s is a campaign, because executive addresses are where targeted phishing starts and where a single credential opens the most doors. So the counts here jump the queue: whatever the triage order further down says, executive resets and reuse checks happen first, this week, not this month.

One honest caveat: the dashboard can only count what appears under your verified domains. If an executive signs up for services with a personal address, that exposure lives outside this card, which is an argument for them running an individual check on that address too.

Panel 2: The yearly trend. Find out which decade your problem is from.

The Yearly Trend Of Exposed Emails chart plots those addresses by the year the breach happened.

Exposure concentrated in 2016-2019 with a quiet recent history is a very different situation from a spike last year. Old exposure mostly means: those passwords are long-dead if your rotation policies work, and the residual risk is reuse. Recent exposure means live credentials may be circulating.

What bad looks like: a recent-year spike. Nine times out of ten it traces to one breach in the table below, and now you know which vendor or service to have a conversation about.

Panel 3: The top breaches. Your talking points, pre-assembled.

Top 5 Data Breaches sits next to the trend chart: the handful of incidents responsible for most of your exposure. This panel converts “we should do something about security” into specifics:

• A big hit from a service your company officially uses? That is a vendor-risk conversation with receipts attached.
• A big hit from a consumer service (a streaming site, a forum)? That is employees using work email for personal signups, which is a policy-and-awareness conversation, not a firing offense. People do it everywhere.
• A hit from a service nobody recognizes? Sometimes an acquisition’s history, sometimes shadow IT. Either way, now you know to ask.
• A name like Collection-1 or AntiPublicCombo? That is not a service at all; it is a combolist, old credentials from many breaches bundled and re-traded. Nothing new leaked, but every address in it has been on the reuse market for years. The three leak types are explained here.

Panel 4: The per-email detail. Where the work order comes from.

Data Breaches Details For Verified Domains is the actionable layer: one row per address per breach, with the data types exposed, searchable, exportable, and paginated (ours runs to 231 pages). Triage order, same as I give individuals, adapted for orgs:

1. Current employees with leaked passwords. Reset, check reuse, done this week.
2. Anything tagged as a stealer log (AlienStealerLogs, RedLine, and friends). Different playbook: device scan first, sessions second, passwords third.
3. Shared and service accounts (info@, admin@, billing@). Often forgotten, often powerful.
4. Former employees’ addresses. Confirm the accounts are actually dead everywhere that matters, including as recovery addresses.
5. Marketing-list-only exposure: note it, move on.

(No verified domain yet? Your individual check still takes ten seconds: xposedornot.com.)

What this looks like on a real domain

I opened this one myself on August 19, 2026. It is a domain we monitor for real; for the screenshots I swapped the domain and the addresses for the examplecorp.com family, so the numbers you see in this walkthrough are the numbers I saw.

Three domains, 2,301 exposed addresses, and all of them on one of the three, which made the read simple. The trend line has two humps. The first tops out in 2016 at 426 addresses, the second in 2019 at 743, and between 2021 and 2023 the line barely leaves the floor. It picks up a little after that: 75 addresses in 2024, 59 in 2025. Of the five biggest sources, only Hurb (228) and Deezer (119) are services someone signed up for. AntiPublicCombo, 1.4BillionRecords and Collection-1, at 203, 202 and 168, are combolists.

The read took about four minutes. The two peaks explain themselves from the top-five table: 2016 to 2017 is AntiPublicCombo and 1.4BillionRecords, and 2019 is Hurb, Deezer and Collection-1, all dated that year. Old consumer signups plus the combolists that recycled them: noted, reuse-risk only, no fire drill. The 2024 and 2025 uptick is the part worth a look, and the detail table puts a name on the 2025 half: AlienStealerLogs (dated February 2025), email plus password, on a handful of addresses. Stealer log, so it is the device-first playbook for those people, not a bulk reset. And the alerts card carries the one 2026 event: Paidwork, July 25, one address, exposed with password, date of birth, phone and postal address, already acknowledged. One vendor-shaped conversation, one small stealer-log sweep, no panic. That is what a healthy use of this dashboard looks like.

Your first month: capture the baseline

Before the ritual can compare anything, month one just writes things down: the overview number, the top five breaches, and which panels you did not understand (that last list is usually the to-do list). Twenty minutes, once, and every month after is a diff against it.

The monthly ritual (15 minutes)

The dashboard earns its keep as a habit, not a one-time audit:

1. Compare the overview number to last month. Explainable?
2. Any new entry in top breaches? Read what leaked, run the triage order.
3. Any unacknowledged alerts in the Real-Time Breach Alerts card? Someone owns them, and that someone should be named.
4. One improvement action per month. Reset a batch, kill a dead shared account, one awareness nudge. Small and monthly beats heroic and never.

Fifteen minutes. The companies that get surprised by credential attacks are rarely missing tools; they are missing the habit.

Start with the ten-minute setup

If you have not verified your domain yet, that walkthrough is here. If you have: your first monthly ritual is fifteen minutes away, and the dashboard is at xposedornot.com/breach-dashboard.

And if a free attacker’s-eye view of your own company strikes you as the right default, drop us a star on GitHub. It helps others find the project, and honestly, it makes our day.

Appendix: Sources and references

• Dashboard: https://xposedornot.com/breach-dashboard
• Setup walkthrough: https://blog.xposedornot.com/free-domain-breach-monitoring/
• Leak types (breach dump, combolist, stealer log): https://blog.xposedornot.com/breach-dump-vs-combolist-vs-stealer-log/
• Individual triage order: https://blog.xposedornot.com/check-email-data-breach/
• Catalog scale: live at https://xposedornot.com/xposed

—