New capability securely indexes ransomware leak-site file trees into Searchlight's Cerberus investigation platform, accelerating incident response even when organizations aren't the primary victim of a ransomware attack.

Portsmouth, UK, January 22, 2026

Searchlight Cyber today announced the release of Ransomware File Explorer, a new capability within its Cerberus investigation platform that provides direct, searchable visibility into file-tree data published on ransomware leak sites.

This feature allows analysts to quickly determine whether sensitive documents, personally identifiable information (PII), or intellectual property have been exposed. Crucially, it supports pre-emptive detection, helping organizations uncover third-party or supply-chain exposure even when they are not the direct victim of a ransomware attack.

“Our research shows that the ransomware threat facing organizations continues to grow, with more active groups, victims, and a tougher landscape to monitor,” said Dr. Gareth Owenson, CTO and Co-Founder of Searchlight Cyber. “By adding the ability to instantly search the file trees of data published on ransomware leak sites, we're giving security teams the power to detect when they've been exposed in the blast radius of a ransomware attack and take action, even when they are not the direct target. It's a continuation of why we created Searchlight Cyber: to stop criminals acting with impunity and help defenders stay ahead of external threats.”

Ransomware File Explorer enables security and incident-response teams to rapidly identify potentially compromised files without needing to access or process malicious archives themselves, thus helping organizations act faster and reduce operational, legal, and reputational risk.

Turning Leak-Site Data into Actionable Intelligence

While ransomware leak sites are publicly accessible, searching through, identifying and interpreting their file structures is time-consuming for internal teams. Ransomware File Explorer eliminates this friction by securely ingesting and indexing file-tree data directly into Cerberus, enabling analysts to:

• Save time identifying and accessing file trees across inconsistent ransomware group leak sites
• Pre-emptively detect leaked PII and intellectual property through rapid filename search and automated alerting
• Accelerate incident response by assessing exposure early—even when a partner, supplier, or affiliate has not disclosed a breach

Built for Enterprise and MSSP Incident Response Teams

Ransomware File Explorer is designed for enterprise security teams and managed security service providers (MSSPs) that require fast, reliable insight during high-pressure investigations. By providing searchable access and alerts on organization-specific file-naming patterns, the capability supports a pre-emptive, intelligence-driven approach to ransomware defense and supply-chain risk management.

About Searchlight Cyber
Searchlight Cyber was founded in 2017 with a mission to stop threat actors from acting with impunity. Its External Cyber Risk Management Platform helps organizations to identify and protect themselves from emerging cybercriminal threats with Attack Surface Management and Threat Intelligence tools designed to separate the signal from the noise. It is used by some of the world's largest enterprises, government and law enforcement agencies, and the Managed Security Service Providers at the forefront of protecting customers from external threats. Find out more at www.slcyber.io.