LeakSignal

LeakSignal is a web app (with optional Slack/Teams alerts) that monitors for early signs of compromised employee credentials and exposed access tokens across paste sites, stealer-log dumps, and public breach aggregators. Instead of dumping raw “found emails” lists, it correlates findings to your identity provider domains, prioritizes by privilege (SSO admins, finance, production access), and generates actionable remediation steps: force reset, revoke sessions, rotate keys, and open a ticket with evidence. It also tracks whether the exposed password appears reused across multiple accounts (where signals allow) and flags high-risk patterns like newly created inbox rules or suspicious OAuth grants. This is not a magic “stop breaches” product—coverage depends on what becomes visible externally—but it gives small-to-mid security teams a realistic, continuous tripwire for the most common initial access path: stolen creds.