Investigate exposed credentials with source and session context.
Vigil matches collected stealer log, combolist and breach data with authorised domains and identities, helping security teams investigate affected accounts and prioritise response.
Credential-exposure scenarios to investigate
Stealer logs containing session data
Information-stealing malware can expose browser passwords, tokens and session cookies associated with VPN, e-mail and SaaS services, requiring both credential reset and session review.
Combolists associated with login services
Credential collections may be organised around particular services or domains and used in credential-stuffing attempts.
Third-party breaches involving corporate identities
Corporate e-mail addresses may appear in third-party breach data. Security teams can review the exposure and assess password-reuse or account-takeover risk.
How Vigil identifies and contextualises exposure
Collection is continuous; correlation is per organisation; delivery goes into the tools your SOC already runs.
- 01 · Collect
8.7B+ corporate credentials, ~7M/day new
Stealer log channels, breach dumps, combolists, paste sites and leaked repositories — 600+ live sources monitored continuously.
- 02 · Correlate
Matched to your domains and identities
Records are checked against authorised e-mail domains, identity lists, customer portals and VIP watchlists. Relationship analysis can show repeated exposure across collected datasets.
- 03 · Prioritise
Freshness, privilege and session data
Recent records containing session data can be prioritised above older, lower-context records. Analysts retain the evidence needed to review the score.
- 04 · Act
Reset, revoke, document
Findings can be routed to SIEM, SOAR, Jira or Teams to support credential reset, session revocation, user notification and investigation records.
Domain-wide search across 8.7B+ corporate credential records, stealer log sources, exposure relationships and the timeline for one organisation.
What changes for your team
Earlier review of account-takeover risk
Security teams can investigate a newly observed credential or session exposure and initiate proportionate response.
Less manual breach-data handling
Vigil supports collection, de-duplication and matching so analysts can focus on validation and response.
Evidence for security review
Findings retain available source context, timestamps and investigation history to support internal review and regulatory reporting processes.
Questions we get asked
Where is credential-exposure data processed?+
In an on-premises deployment, matching and storage take place in the customer-controlled environment using a customer-isolated database. Connectivity and data-flow requirements are documented during security review.
How fast is a new stealer log detected?+
Collection and matching are continuous. Depending on source availability and processing status, high-priority alerts can be generated within minutes of ingestion.
Can we search a single e-mail address?+
Yes — domain-wide or per authorised identity. Where supported by the source data and access controls, relationship analysis can show repeated exposure across datasets alongside an exposure timeline.
Review the credential-exposure workflow.
Review representative findings and the credential-exposure workflow. Customer-domain checks are performed only after scope and authorisation are confirmed.