# Executive Threat Monitoring

URL: https://www.deepinfo.com/platform/cti/executive-threat-monitoring/

## Know When Leadership Accounts Turn Up in Leaked Data.

Executive Threat Monitoring lets your team mark accounts as executive or VIP once Cyber Threat Intelligence finds them in breach or leaked credential data.

From then on, the breaches and leaked credentials on a flagged account carry the flag, so leadership exposure is one filter away instead of buried in the full queue.

[Request demo](https://www.deepinfo.com/request-demo/) · [Platform guide: Executive flag](https://docs.deepinfo.com/guide/cti/compromised-employees/#edit-an-employees-details)

### Some Accounts Carry More Weight.

A leaked password is a leaked password. Whose it is decides how far it reaches.

Access

#### Broad Permissions

An executive’s mailbox and single sign-on session reach approvals, finance workflows and board material. One credential opens more than most.

Visibility

#### Public Names

Names and titles are on the company website and the email format is easy to guess. Building a target list takes no special access.

Reuse

#### Personal and Corporate Overlap

A password shared between a personal service and a corporate login turns someone else’s breach into your incident.

### Flag the People, Then Follow Their Exposure.

1. **Find**

   Cyber Threat Intelligence lists the employee accounts on your domains found in breaches and leaked credential data, with name, title and department where known.
2. **Flag**

   Mark the executives and VIPs among them: `is_executive` on compromised employee accounts, `vip` on breached accounts. One update per person.
3. **Filter**

   Filter compromised employee accounts by executive flag, title or department, and breached accounts by the VIP flag. Leadership exposure becomes its own list.
4. **Close**

   Work each leaked credential to a state: resolved, risk accepted, ignored or false positive. Any decision can be reverted later.

### Where to Look for Each Flagged Person.

The flag adds no new source. Breaches and leaked credentials filter on it directly; devices and the dark web are checked by the person’s address or name.

- **Email breaches**: `vip` · The known breaches that contain the address, with its date and the data types it exposed. [Employee Email Breach Monitoring](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/)
- **Leaked credentials**: `account.is_executive` · Each leaked login: the site it was used on, the account, and the password’s strength and reuse. [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/)
- **Risk level**: `is_executive` · Critical, High, Medium or Low per account, which the Deepinfo Platform describes as a composite of credential, role and recency. [Cyber Threat Score](https://www.deepinfo.com/platform/cti/cyber-threat-score/)
- **Infected devices**: `account.email` · Infostealer infections on devices that hold the person’s credentials, with password, cookie and sensitive-cookie counts. [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/)
- **Dark web**: Name or address · On-demand searches across forums, markets, paste sites, chats and leaks. [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/)

### Leadership Exposure Is One Filter Away.

The flags are ordinary fields. Set one with an update call when a leadership account appears, and filter on it wherever you would filter on an email address or a domain.

Breached accounts take filters on the query string, so the VIP view is a single request your team can run on any schedule it likes.

[Breached Account List reference](https://docs.deepinfo.com/reference/cti/breached-account-list/)

VIP breaches:

```bash
curl "https://api.deepinfo.com/v1/cti/email-breaches/accounts?vip=true&ordering=-last_breach_date" \
  -H "apikey: YOUR_API_KEY"
```

Flag an executive:

```bash
curl -X PUT \
  "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ACCOUNT_ID" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"is_executive": true, "title": "Chief Financial Officer"}'
```

### What Teams Do With the Flagged List.

#### [Reset Before It’s Used](https://www.deepinfo.com/solutions/use-cases/credential-exposure-management/)

Filter the exposed credentials of flagged accounts, reset the ones still active, and record the state so the next review starts from a clean list.

#### Brief the Person

Show an executive which of their accounts appeared in which breaches, and what data went with them. It makes the case for a password manager better than a policy does.

#### Report Upward

Export the flagged accounts with that filter for a leadership briefing. For the wider picture, the CTI Email Breach Summary runs on demand or on a daily, weekly or monthly schedule.

#### [Protect Named Individuals](https://www.deepinfo.com/solutions/use-cases/executive-threat-protection/)

Pair the flagged list with dark web searches on names and addresses when a protective team needs a fuller picture.

### The Data Behind the Flagged List.

- [Employee Email Breach Monitoring](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/) (CTI): Every corporate address found in a known breach.
- [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) (CTI): Infostealer infections on the machines your people use.
- [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) (CTI): Search forums, markets and leaks on demand.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Executive Threat Monitoring

**Who counts as an executive?**

Whoever your team flags. Most teams start with the C-suite and the board, then add people with privileged access or a public profile, such as finance approvers, executive assistants and spokespeople.

**Can we see whether a flagged person’s exposure is growing?**

Yes. Each compromised employee account shows its first and last exposure dates, the days since the last one and whether new exposures are becoming more frequent.

**Does it cover personal email addresses?**

Breach and credential monitoring follows the addresses on your organization’s domains. A personal address, or a name, can be checked on demand with [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/).

**Does this cover impersonation of executives?**

Lookalike domains built on your brand are handled by [Brand Risk Protection](https://www.deepinfo.com/platform/brp/). This capability focuses on the exposure of the people themselves: their breached accounts and leaked credentials.

### See Which Leadership Accounts Have Already Leaked.

Book a walk-through on your domain and see how flagged accounts, breaches and leaked credentials come together in one list.

[Request demo](https://www.deepinfo.com/request-demo/)