Breachgrid

Small software teams own domains, employee addresses, support identities, payment links and delegated subdomains but rarely have staff to interpret large threat feeds. The supplied research confirms several commercial and public data sources and an enterprise-oriented competitor, suggesting room for a smaller, lower-noise workflow. Cheap aggregation alone is not enough: breach data is sensitive, source licenses differ and a match may be stale, misattributed or already remediated.

Breachgrid begins with verified asset ownership and explicit monitoring authority. It stores the minimum identifiers needed to query permitted sources, normalizes source, observation time, affected asset, exposure class and confidence, then correlates findings to the customer's product graph. The system surfaces a small queue of actions with evidence and uncertainty rather than thousands of raw records. It does not display recovered passwords or test credentials.

Observation, triage, customer acknowledgment, containment, provider request, provider acknowledgment, public readback and closure remain separate. A credential mention does not prove account compromise; an impersonating domain does not prove malicious control; a takedown draft is not an accepted request.

The first release should support verified domains and work email aliases from a small set of licensed sources. Its trust advantage comes from authorization, data minimization, source provenance and useful remediation states, not from claiming total dark-web coverage.

Founder, technical lead or security owner at an independent software company with a small team and several public-facing domains or support identities