A leaked password is not an exposure. A working one is.
Every security team now receives a steady stream of leaked-credential alerts: dark web dumps, infostealer logs, combo lists, paste sites. Most of these alerts end the same way, in a queue nobody has time to work through.
The problem is not a lack of data. It is a lack of context. A leaked credential tells you that something exists somewhere. It does not tell you whether that identity still has a door to open in your environment, whether that door is locked twice, or what sits behind it.
Attackers do not need to break in when they can log in. That is why exposure management has to become identity-centric, and why identity-centric exposure management only works when you triangulate.
Three signals, each blind on its own
Most organizations already collect the three signals that matter. They just keep them in separate tools, owned by separate teams.
- Threat intelligence tells you what the outside world knows about you: leaked credentials, stolen session tokens, infostealer infections, and actor chatter that names your domains. On its own, it cannot tell a dead account from a live one.
- Network and identity context tells you what is true inside: which users are active in the directory, which devices they use, which groups they belong to, and what they can reach. On its own, it has no view of what has already leaked.
- Attack surface tells you where an attacker would actually use that identity: VPN gateways, SSO portals, exposed RDP, cloud consoles, legacy web apps that bypass modern authentication. On its own, it maps doors without knowing who holds the keys.
Each signal answers one question. None of them answers the only question that matters to the board: can this be used against us today?
Validating credential exposure: three questions per identity
Turning a leaked credential into a validated exposure means answering three questions about the identity behind it.
- Is the user active in the network? Match the leaked identity against the live directory. A disabled account, a departed employee, or a stale alias is hygiene work. An active account that logged in this week is a live risk.
- How is the login protected? Check whether that identity is enforced with MFA, which methods it uses, and whether any exposed service still accepts password-only authentication. A strong credential behind phishing-resistant MFA is a very different finding from the same credential reaching a legacy VPN.
- What is the permission level? Determine what the identity can do once inside: standard user, local admin, privileged group member, service account, or cloud administrator. Blast radius is defined by privilege, not by the leak.
An active privileged account, reachable through an exposed service without MFA, with a credential seen in a recent infostealer log, is not an alert. It is an incident waiting for a timestamp.
Full triangulation is the point
The value is not in any single signal. It is where all three intersect: what has leaked, who is active and privileged, and which exposed doors will accept that identity. When the three are triangulated, exposure management changes in practical ways:
- From volume to validation. Thousands of leaked-credential hits collapse into a short list of identities that are confirmed active, weakly protected, and highly privileged.
- From severity to exploitability. Priority is set by whether an attacker can actually use the identity against a reachable asset, not by a generic score.
- From findings to action. Each validated exposure points to a clear owner and a clear fix for your team: reset and revoke sessions, enforce MFA, close the legacy entry point, or reduce excessive privilege.
- From reporting to evidence. CISOs can show leadership a measurable number, validated identity exposures over time, rather than a count of alerts processed.
This is the shift Continuous Threat Exposure Management was designed for: scoping what matters, discovering it, prioritizing by real attack paths, validating, and mobilizing remediation. Identity is where that cycle delivers the fastest reduction in real risk.
How we approach it at RedRok
RedRok's CTEM platform is built around this triangulation. Our agents correlate external threat intelligence with internal identity and network context and with the live attack surface, so every credential exposure is validated against three facts: the user is active, the login is or is not protected, and the permission level defines the blast radius.
The result is a short, defensible list of identity exposures that matter, each pinpointing exactly what your team should fix first.
If your team is still triaging leaked credentials one alert at a time, it is worth asking a different question. Not "what leaked?" but "what can still be used?"