Alert types
The alert type tells you what kind of thing was found.
| Type | What was found | Typical first step |
|---|---|---|
| Password | A plaintext password for one of your accounts. | Reset it and check for reuse. |
| Password hash | A hashed password. | Reset it. |
| API key | A key or token that grants access to a service. | Revoke and reissue. |
| An email address at your domain in a breach, with nothing else of yours. | Note it, and watch for phishing. | |
| Username | An account name tied to your organisation. | Check for reuse across services. |
| Sensitive data | Documents, records or other confidential material. | Assess what it contains and who is affected. |
| Third party | A finding about one of your third parties that concerns you. | Ask them what happened. |
| Ransomware | Your organisation or a third party named by a ransomware group. | Escalate within your organisation. |
| Dark web | A mention of your organisation on the dark web or a forum. | Read the evidence and assess whether it is credible. |
| Other | Anything that does not fit above. | Read the description. |
What these findings look like
Section titled “What these findings look like”- Password: someone has your actual password in readable form. Anyone who finds it can sign in as you.
- Password hash: a scrambled form of a password. It cannot be read directly, but weak scrambling can be undone, so treat it as exposed.
- API key: a code that lets software act on your behalf, without a login screen.
- Dark web: your organisation is being discussed on hidden sites. Typically this is your data offered for sale, someone asking to buy access to you, or a ransomware group announcing a breach.
- Ransomware: a criminal group has publicly claimed an attack on you or on one of your third parties, usually on their own leak site. Either they are threatening to release the stolen data unless they are paid, or they have already released it.
Every alert comes with evidence
Section titled “Every alert comes with evidence”Each alert shows you what was exposed, where it was found, a description of the finding, the impact on you and a suggested remediation. Where it is technically possible, Oko includes a screenshot of the source, for example the forum post.