The Exposure Review.
A fixed-scope assessment of your current position, built on three practical questions: what can be found, what can be reached, and how the two combine. Grounded in current threat intelligence and delivered in plain language.
Three questions, in order.
The review is built on how targeting actually happens. Each question narrows the last, so the output is a short list ranked by consequence, not a hundred findings of equal weight.
What can be found
Data brokers, public records, breach corpuses, and the social footprint of you and your family. What an outsider can assemble before making contact.
What can be reached
Personal devices, the home network, accounts and their recovery routes, and the people around you. The overlooked items are old accounts and shared logins.
How it is used
Findings weighed against how threat actors operate today, so a long list of observations becomes a short list of scenarios worth your attention.
A written report, and a call to walk through it.
Noise is filtered out before delivery, so what remains is action items rather than raw output.
Written report
Detailed findings with a summarized review at the front, ordered by what reduces the most exposure first.
Live readout
A private call and walkthrough with Matt Cooper covering what was found, what it means, and what to do first.
Act now. Live and usable.
Act soon. Not immediate.
Close on a normal timeline.
Good posture. No concern.
Afterward. Findings are yours to act on. Many clients work through the report themselves; others keep standing counsel.
Generally. Wider exposure takes longer, and you hear that at scoping rather than discovering it late.
Quoted after the scoping call, once the shape of the work is clear, and agreed before anything begins.
Scope
A confidential intake to agree who and what is in scope.
Collection
Open-source, broker, breach, and dark web intelligence. Passive throughout.
Analysis
Found and reached combined into ranked scenarios.
Readout
The report, delivered and walked through directly.
The Exposure Review
What the report looks like.
Below is a specimen page. The findings are composites written to illustrate the format and the reasoning, not extracts from any engagement. Real reports run longer and name specific accounts, hosts, and records.
-
01
Credentials from a 2023 infostealer set remain valid on a personal cloud account
Critical- Found
- A personal address appears in a credential set circulating on two forums. The recorded password matches the convention still in use on a personal cloud-storage account.
- Reached
- That account syncs to a laptop also used to read board material. Recovery is a secondary address with no second factor.
- Used
- Access yields document history without touching corporate systems, so nothing raises an alert on the company side.
Action Rotate the credential, add a hardware key to the account and its recovery address, and unlink sync from any device holding company material.
-
02
A storage device management interface is reachable from the open internet
Significant- Found
- The residential address resolves to a static IP presenting a storage-device login. The banner discloses firmware two major versions behind current.
- Reached
- The same address answers on a second port used by a camera recorder, indicating both were forwarded manually rather than by a default configuration.
- Used
- An authentication bypass affecting that firmware is publicly documented. A foothold reaches interior camera history and household file shares.
Action Close both inbound rules, place management behind a VPN, and patch. Camera retention should be reviewed separately.
-
03
Home address resolvable through six brokers, two only via a relative
Advisable- Found
- The current address appears on six aggregator sites. Two of those entries are reachable only through an adult child's profile, not through any record naming the client.
- Used
- The address is the pivot both for physical approach and for the knowledge-based questions still used to verify identity at some call centers.
Action Submit removals across all six. Handle the family as a unit, since clearing the client's own records leaves the relative-linked path intact.
-
04
Dormant account under a former surname
Housekeeping- Found
- An account inactive since 2016 carries photographs that establish two prior addresses and a vehicle no longer owned.
- Used
- Little on its own. It matters as corroboration, giving an outsider confidence that other records refer to the same person.
Action Archive anything worth keeping, then close the account. No urgency.
Specimen document. Composite findings, no client data. Ares Dynamics — aresdyn.com
Know where you stand.
The Exposure Review is the usual first step, and a straightforward way to decide whether this practice is the right fit for you.
Request the Exposure Review