Share on social
Nov 4, 2026
Lorem ipsum
Searchlight Monitor now displays an email’s full breach and infostealer timeline on a single page, grouping all detections on a single page, so SOC teams can respond faster.
What’s new
Searchlight Monitor now groups every breach and infostealer detection for an email address into one Email Exposure History view, so analysts can triage, contain, and investigate faster, without having to manually piece together information.
Credential abuse remains a significant route into organizations. Verizon’s 2026 Data Breach Investigations Report found that identity-related initial access accounted for 13% of breaches in 2026, and compromised credentials can be reused long after initial exposure. By having every detection for exposed emails in a single view, it’s now easier to view where breaches originated and take action on all of them from one place.
The Email Exposure page includes
All information is presented in a single view, to help teams know what needs resetting.
- Overview Metrics: Total exposure counts, breakdown of breaches and stealers, and count of exposed passwords.
- Password Details: View all passwords that have been compromised or stolen in plain text and masked.
- Associated Attributes: The origin of each exposure and any related subdomains.
- Linked Actions: A pre-filtered view of related Actions, so teams can manage and execute them in bulk.
- Export Actions: CSV export of email exposure data for external reporting and processing.
Where you can find it
Searchlight Monitor users can view the Email Exposure page on all Leaks and Stealer actions, within their Credential Actions. To view a single record, simply open the action and click on the Email address at the top of the page.
