Features

One console, one API, your whole exposure.

Cockpit, three Insights, monitors, reports, and an API that exposes everything the interface shows.

[ 01 ] Cockpit

An explained exposure score, not a black box.

Six weighted factors, each clickable down to the credentials involved. You know what carries the risk, and you can act on it.

  • [✓]Internal and external exposure, infostealers, perimeter coverage, recency
  • [✓]Recent activity on a sliding window
  • [✓]Drill-down from the figure to the credential
app.stealed.io
Stealed cockpit: risk score and six factors
A customer's cockpit: score 80, six weighted factors, recent activity on the three Insights.
[ 02 ] Anti alert-fatigue

Fewer alerts, better prioritised.

A credential seen fifteen times is one leak, not fifteen alerts. And when you must choose where to start, circulation metrics and filters do the sorting.

Deduplication before notification

Every occurrence is attached to its credential. A known leak that resurfaces never comes back as something new.

Combinable filters

New only, source type, internal or external, domain, period: the list narrows down to what you are looking for.

Sort by circulation

Distinct sources, occurrences, first and last seen: priority credentials surface on their own.

app.stealed.io
Leak list: filters, sources, occurrences, first and last seen
The leak list: active filters, sources and occurrences columns, and the five occurrences of one credential expanded.
[ 03 ] Alerting

From alert to remediation, every action timestamped.

You configure what should alert you, receive the alert in your tool, handle the incident and leave with an exportable log.

01 · Configure

One monitor per topic

Perimeter, severity, threshold, frequency: you decide what deserves an alert.

02 · Deliver

Where they work

A webhook is enough: the output format is the API's.

03 · Handle

Without losing history

What is handled leaves the active views, never the history.

app.stealed.io
Creating a monitor: query, window, threshold, severity
Creating a monitor: perimeter, evaluation window, threshold and severity.
Alert
critical · 147 leaks · acme.com
  • Slack
  • Microsoft Teams
  • E-mail
  • Signed webhook
  • Scheduled report
  • SIEM
  • SOAR
  • ITSM
The webhook carries the API format: SIEM, SOAR and ITSM with no custom development.
One alert, not fifty

A known credential that resurfaces in a new source does not notify you twice.

Audit log: every action timestamped and signedExportable as PDF, CSV or through the API.
  1. 14:02
    Trigger

    147 unique leaks detected on acme.com

  2. 14:02
    Notification

    #sec-ops on Slack, SOAR webhook

  3. 14:04
    Assignment

    John D., status "in progress"

  4. 14:16
    Action

    Forced reset, 147 accounts

  5. 14:35
    Closure

    Incident resolved, history kept

[ 04 ] API and integrations

The console is a client of the API. Not the other way round.

Every view, every filter, every export maps to a documented call that the interface generates for you. What the screen shows, your code gets.

  • [✓]The API call generated from any view, in Bash, Python or JavaScript
  • [✓]Scoped keys, IP restriction, revocable from the console
  • [✓]Signed webhook in the API format: SIEM, SOAR, ITSM with no custom development
  • [✓]Public documentation, updated with the product
Integrates with
  • Splunk
  • Microsoft Sentinel
  • QRadar
  • Elastic
  • SOAR
  • ITSM
  • Webhook
  • Slack
  • Teams
API documentation All integrations
app.stealed.io
API call generated from the leak view
The call generated from the leak view, ready to copy.
GET /v1/leaks/details200 · application/json
{ "total": 147, "items": [ {
    "login": "[email protected]",
    "url": "https://vpn.acme.com/sslvpn",
    "type": "infostealer", "malware": "lumma",
    "sources": 4, "occurrences": 5,
    "first_seen": "2026-03-06T14:39:18Z",
    "last_seen": "2026-04-14T09:04:20Z"
  } ] }
The same view, as JSON
[ 05 ] Reporting

An exposure report, ready to send.

Generated in one click or through the API. Aggregates, never a credential or a password: the report circulates safely, even in pre-sales.

  • [✓]Risk score and its breakdown
  • [✓]Impacted users, internal and external
  • [✓]White label for partners
app.stealed.io
Exposure report: risk score and breakdown
Page 2 of an exposure report: score and breakdown.

Go further

How it works

The engine, the three correlation angles, the single output format.

›

Collected data

Source types, leak types and the data each one contains.

›

Security and guardrails

A protection tool compliant with French law, hosted in France.

›
Next step

A demo on your perimeter, not on a demo dataset.

Console tour, API integration, leaks detected on your domains, live.

  • [✓] No NDA
  • [✓] No commitment
  • [✓] No installation
Book a demo Check my domain