EnterpriseSecurity

Employee Monitoring

Alert employees when their corporate email addresses turn up in external data breaches.

Start with 500 free creditsDocumentation

Email breaches · 1 credit per lookup · no monthly fee

li@corp.com
ben@corp.com Alerted
ivy@corp.com

The problem

Employees reuse corporate emails on third-party sites, and those sites get breached. Every leaked corporate credential is a phishing template and a potential VPN login, and security teams usually find out from the incident, not the breach.

With Encrata

Monitor your corporate addresses on a schedule. When an employee's work email surfaces in new breach data, security gets the alert with breach details attached, which service, what leaked, and can force a reset before the credential gets tried against your SSO.

How it works

1

Send the address

Call the breach endpoint with an email address, one-off for a signup check, or on a schedule for monitoring.

2

We check known breaches

Encrata searches disclosed breach data and returns every breach the address appears in, when it happened, and what leaked.

3

Respond to exposure

Alert the user, raise a risk score, force a reset or require MFA, the full breach history is one credit away.

One call, structured answer

Employee Monitoring runs on the email breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • Full breach history, names, dates and exposed data classes per breach
  • 1 credit per check, so continuous monitoring stays affordable
  • New-breach detection turns a public leak into a same-day security response
  • Works for one address or your whole domain
Terminal
curl -X POST "https://encrata.com/api/agent/breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "sam@corp.com"}'
response.json
{
  "email": "sam@corp.com",
  "breached": true,
  "breach_info": {
    "breach_count": 2,
    "services": [
      { "name": "LinkedIn", "breach_date": "2012-05-05",
        "data_types": ["Email addresses", "Passwords"] }
    ],
    "exposed_data": ["Email addresses", "Passwords"]
  },
  "credits": 1
}

Weekly sweeps into the queue

Sweep the corporate directory weekly and route new exposures into your security queue with the breach detail attached. Integrate with your IdP so a password-exposed hit can trigger an automatic reset flow for that employee. Prioritize by exposed data class, password leaks get same-day action, email-only appearances get the newsletter treatment.

Time to reset is the metric

The metric that matters is time-to-reset after public disclosure: attackers weaponize dumps within hours, so a weekly sweep plus automated reset beats a quarterly audit by orders of magnitude. The alert conversation also normalizes security hygiene, employees who get a specific 'this service leaked your work email' note stop reusing corporate addresses on third-party sites.

More email breaches use cases

View all

New breach: DataCo

Your email was exposed · just now

Secure account

Breach Alerts

Warn users the moment their email address shows up in a newly disclosed data breach

CybersecurityMonitoring

Identity risk

78/100
4 prior breaches · manual review

Risk Scoring

Raise risk scores for identities with prior breach exposure before approving transactions

FintechRisk
Breach affects 3 users
Password resets sent

Password Reset

Trigger targeted password resets when a breach relevant to your users becomes public

SaaSSecurity
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'