HRS Exposure — User Guide

Version 1.9.0 · updated September 2026

HRS Exposure shows you what an attacker sees when they look at your organization from the outside — your people, your brand, your domains and the suppliers you depend on — before that information is used against you. A free scan needs nothing installed and no access granted. A monitored organization gets the full cycle: continuous discovery, prioritization by how an attacker would actually use each weakness, AI agents that do the first pass on every scan, tickets and alerts that move the work, and a re-scan behind every claimed fix. It runs that loop on its own and asks a person only for the decisions that need one. This guide covers both.

Contents

1. What HRS Exposure is
2. The exposure-management cycle
3. Running a free scan
4. Your exposure snapshot
5. The full report
6. Reading your grade
7. The nine exposure modules
8. Findings and severity
9. Continuous monitoring
10. Using the console
11. Fixing, and proving it
12. Tickets, alerts and integrations
13. Look-alike takedowns
14. AI agents and automation
15. Your account: MFA, SSO and sessions
16. For MSPs
17. How exposure feeds your Human Risk Score
18. Privacy and how it works
19. FAQ
20. Glossary

1. What HRS Exposure is

Most security tooling looks inward — at the endpoints, mailboxes and networks you control. HRS Exposure looks the other way. It answers the questions an attacker asks first:

• Whose credentials have already leaked, and are any sitting in active infostealer logs?
• Which executives are easy to research and impersonate?
• Can someone send email that passes as your domain?
• Are look-alike domains registered to imitate you, and are they set up to send mail?
• What is exposed on your public web servers and hosts, and does any of it carry a known, exploited vulnerability?
• Which outside companies hold a piece of your domain — your DNS, your mail, the right to send as you?
• Have credentials of yours been published in public source code?
• For a connected directory: which accounts can be signed in to with a password alone?

Each scan produces an exposure grade (A–F) with a 0–100 posture score behind it, a grade for every module, and specific findings with the evidence behind them.

2. The exposure-management cycle

A one-off scan tells you where you stand today. Exposure management keeps it that way, and HRS Exposure runs every stage on its own: Automation in the console shows what it did and sets what it may do without asking (section 14). The console is organized around the five stages of that cycle, and every page shows which stage it belongs to:

The free scan sits at Discover: it is the snapshot. Monitoring is the loop.

3. Running a free scan

Anyone can run a free scan from the HRS Exposure home page — no account required.

1. Enter your domain (for example yourcompany.com). You can also paste a work email; its domain is used.
2. Complete the brief anti-abuse check, where one is shown.
3. The scan runs and your snapshot appears, usually in well under a minute.

The free scan runs seven modules: credential, executive, email spoofing, look-alike domains, web & TLS, external surface and third parties. Leaked source-code credentials and identity posture need a monitored organization (section 7). Free scans are rate-limited per network, and domains that resolve to private addresses are refused.

4. Your exposure snapshot

The snapshot tells you how exposed you are without printing exploitable specifics on a page anyone can open.

• The headline and gauge. What your grade means in one line — low, moderate or high exposure — with the grade letter and posture score, and a count of findings by severity.
• Exposure by area. A tile for each area — email security, brand protection, web exposure, executive exposure, credential exposure — marked Protected, At risk or Exposed. Person-level areas say In full report.
• How this could be used. The route an attacker would take: a spoofed or look-alike sender, a phishing email to your staff, stolen credentials, account access. A stage is marked observed only when this scan found evidence for it. A scan cannot see a phishing email being sent or an account being entered, so those stages are never marked observed.

If a check could not complete, the snapshot says the scan was partial and that the grade is an upper bound — the real grade can only be the same or worse.

5. The full report

From the snapshot, choose Email me the full report and enter your work email. You receive a private link to the complete report as a PDF.

• The link is private and expires after 14 days. It cannot be guessed from your scan, and only a fingerprint of it is stored. Treat it like any other sensitive link.
• The report adds the evidence behind every finding, written as consequence rather than protocol — what an attacker could do, not just which record is missing — with each area’s findings listed most severe first.
• Signed-in users download the report for any completed scan from its scan page.

6. Reading your grade

The posture score runs 0–100, and higher is better: it measures how little an attacker has to work with.

How the grade is built:

• Every module starts at 100 and loses points per finding by severity. The composite is a weighted average of the modules that ran; the person-level modules (executive, leaked source-code credentials, credential, identity) weigh most.
• Read the modules, not just the headline. A strong composite can hide one weak module.
• “Not assessed” is not “clean”. A check that could not run costs nothing and earns nothing, and it is reported by name. The absence of evidence is never credited as safety.

7. The nine exposure modules

Each finding says what it means in practice and what to do about it. The usual first moves: reset and protect accounts with infostealer activity; move DMARC to p=quarantine then p=reject; watch or take down look-alikes that can send mail; revoke any credential published in code; retire forgotten hosts.

8. Findings and severity

Severity is set in one place, by rule, never by a person’s mood or a model’s guess:

• Fresh infostealer activity is critical. An infostealer hit first seen within the last 90 days means someone may be able to sign in as that person today.
• A breach that included passwords is at least high.
• Exploit intelligence. Where a finding names a CVE, HRS Exposure checks two public feeds. A CVE on CISA’s Known Exploited Vulnerabilities catalog makes the finding at least high, and shows a KEV badge. An EPSS probability of 10% or more — a meaningful chance of exploitation in the next 30 days — raises it one step, and the percentage is shown. The two do not stack beyond one step past high.

Attack paths go one step further: they chain open findings into the routes an attacker would take, and show the fixes that break each route. A path appears only when the findings that start it are present.

9. Continuous monitoring

• Verify the domain. Add a TXT record at your domain root with the value HRS Exposure gives you (it looks like hrs-verify=…). An unverified domain is never monitored, and person-level detail is never shown for it.
• Choose a cadence. Daily, every 3 days, weekly (the default), every 2 weeks or monthly. You can also scan now at any time.
• Discovery. Subdomains are found from Certificate Transparency logs and checked for liveness, so new hosts join the inventory as they appear. Each host has its own page and can be scanned on its own.
• Alerts. A critical finding that is new since the previous scan emails your admins and analysts straight away.
• Weekly digest. Once a week, and only when something changed: what is new, what was proved fixed, what is late, and where you stand.

10. Using the console

The sidebar follows the cycle:

• Overview — the console home: your posture, score, the most severe attack path, and the next actions ranked by what they would improve. MSPs also see their client portfolio here. Automation sits beside it: what the platform did on its own in the last 30 days, what it may do without asking, and the AI agents’ proposals waiting for a decision (section 14).
• Scope & discover — Domains, Asset inventory, Third parties.
• Prioritize — All exposures, Attack paths, Recommendations, AI briefs, and a page per area: email security, brand protection, executive and credential exposure.
• Validate & mobilize — Remediation and Reports.

What you can do depends on your role:

Everything you see is scoped to your own organization.

11. Fixing, and proving it

Every finding moves through a simple lifecycle: new → acknowledged → verifying → resolved.

• Acknowledge a finding to own it. A due date follows from its severity: critical 7 days, high 14, medium 30, low 90.
• Fixed — verify queues a targeted re-scan of that module. Only that re-scan can mark the finding resolved. If the finding is still there, it goes back to acknowledged and the reopen is counted.
• False positive and risk accepted are human judgements. They are recorded against your name and do not trigger a re-scan.

A module that did not run, or errored, never resolves anything: a fix is proved only by a scan that looked and did not find it.

12. Tickets, alerts and integrations

Admins connect these under Settings. Every credential you give HRS Exposure is encrypted at rest and never shown again — only whether one is set.

• Ticketing — Jira, ServiceNow, GitHub Issues, ConnectWise. A ticket opens for each new critical finding. For Jira, ServiceNow and GitHub the sync runs both ways: when the ticket is closed as done, HRS Exposure re-scans and writes back whether the fix was confirmed or the finding reopened. A closed ticket never marks a finding fixed by itself.
• SIEM and chat — Splunk HEC, JSON webhook (HMAC-signed), CEF, Slack, Microsoft Teams. Scans completed, changes since the last scan, new criticals and remediation outcomes. Each destination can be test-sent.
• Identity provider — Okta, Microsoft Entra. From a credential finding, an analyst can revoke a person’s sessions and optionally force a password change. Always a person’s decision. An Entra connection also enables the identity posture module.
• API. Read-only REST endpoints for findings, impersonation, domains and a summary, with API keys you create in Settings. Reference: /docs/api.

13. Look-alike takedowns

For a look-alike domain that is live, an analyst can send a takedown request to the registrar’s abuse contact.

1. Collect evidence. Registration, DNS, mail and certificate facts are gathered into an evidence pack, including the registrar’s abuse contact from RDAP. The pack is also a branded PDF, for registrars that want a web-form upload.
2. Review. You see the exact message that will be sent and where replies will go (to you).
3. Send. It goes only after you confirm, and only if the message is exactly what you reviewed. Nothing is ever sent on a schedule.
4. Record the outcome — acknowledged, taken down, declined or no response. HRS Exposure re-checks the domain hourly and closes it once it has stopped working on two checks in a row.

14. AI agents and automation

HRS Exposure is agentic first: after every monitored scan, AI agents do the first pass of the work an analyst would do, and leave it ready for a person to decide. They propose; people decide. No agent changes a finding, opens a ticket, sends anything or starts a scan itself; the only shortcut is the one an admin chooses under Automation, below.

• Triage agent. Reads the domain’s open findings, the attack paths and the scan context. It writes a plain-language explanation on the findings that matter, proposes triage decisions (acknowledge, false positive, or — rarely — risk accepted, always with its reasoning), and ranks the open work in the order to do it.
• Remediation agent. Runs for the worst findings that have no fix plan yet, or when you press Plan the fix with an agent on a finding. It writes the exact fix (the record, header or setting), checks live DNS, and proposes either a ticket in your ticketing system or, when the fix already looks live, a verification re-scan.

Everything they propose waits under AI agents in the console. Each proposal says what approving would do and why the agent thinks so; an analyst approves or rejects it. Approving runs exactly what the button would — the same disposition, timeline entry and audit record, with the approver as the actor and a note that it came from an agent. A proposal the world has moved past (the finding was closed, or already has a ticket) is not forced through.

What the agents cannot do, by design:

• Change a severity. Severity stays rule-set; agents explain and rank.
• Mark anything fixed. Only a verification re-scan does that, as for people.
• See people or secrets. Before anything reaches the model, who is affected (names, addresses, accounts) and every credential are withheld. Agents see finding codes, counts and technical evidence.
• Reach beyond your organization. An agent works on one domain of one organization, and can look up DNS only for that domain.

Every run is recorded: open it from the AI agents page to see each tool the agent called, what it sent and what came back. Admins can switch agents off for the organization under Organization; with them off, nothing is sent to a model by an agent.

Automation. The Automation page counts what the platform did on its own in the last 30 days, in the order the loop runs: what it watched, what it found (new hosts, look-alike domains, new breaches of watched addresses), what the agents reviewed after scans, what it did (alerts, tickets for new criticals, escalations, automatic fix checks) and what it proved or reopened by re-scan. Work a person started is not counted. Below that, an admin chooses what may run without waiting for a person:

• Re-scan to check a fix an agent believes is live. The re-scan starts at once, and only the scan decides. If the problem is gone, the finding is resolved with the scan as proof. If it is still there, the finding goes back exactly as it was: nobody is made its owner and no failed fix is counted against anyone.
• Tickets never run automatically. An agent-drafted ticket goes into your own systems, so a person reads it first. Tickets for new critical findings are still opened as soon as they are found, from a fixed template.
• Triage decisions never run automatically. Acknowledging, false positive and accepted risk are judgement, and always wait for a person.

Automation acts for the admin who switched it on, through the same checks as the Approve button; the audit log shows their name, marked as automatic. If that admin leaves or stops being an admin, it pauses, the page says why and your admins are emailed, until another admin saves the settings. It does at most 25 things a day; anything over that waits for a person. It is off until an admin turns it on.

15. Your account: MFA, SSO and sessions

• Two-step verification. Enroll any authenticator app from your profile; you receive ten single-use recovery codes. Your organization can require it, in which case you are asked to enroll at sign-in.
• Sign in with Microsoft is available where your organization has it set up.
• Sessions end after 2 hours idle (with a warning first) and after 12 hours regardless.
• Protection against password guessing. After five wrong passwords from one place, sign-in pauses — 30 seconds at first, doubling with each further try — and the page tells you how long. Many failures from one address across different accounts are blocked too. An account that keeps failing from many places is locked for 15 minutes; you and your admins are emailed, and an admin can unlock it early under Users. Wrong two-step codes count the same way.

16. For MSPs

• Client portfolio. Every client ranked by risk. Open a client to read, or act as the client to work in its console.
• Quarterly business review. A branded PDF for each client covering the last 90 days: the grade and its trend, posture by asset, attack surface and brand, and the top open exposures.
• White-label reports. The exposure report can carry your name and accent colour instead of HumanRisk Shield’s, with or without “Powered by HumanRisk Shield”.

17. How exposure feeds your Human Risk Score

HRS Exposure is the outside-in signal for the wider HumanRisk Shield platform. When you run it as part of HRS, findings are attributed to the people they endanger — a person in an active infostealer log, an executive who is easy to impersonate — and feed each person’s Human Risk Score. That is what turns a list of exposures into a closed loop: discover the exposure, attribute it to real people, and reduce it with training, controls and reinforcement aimed at exactly those people. Only complete scans feed the score, and no credential ever leaves HRS Exposure.

18. Privacy and how it works

• Outside-in only. Scans read what is already public. The only inside view is the read-only directory posture you choose to connect.
• No passwords, ever. A credential finding records that an account appears in a breach or stealer log — never the password. A secret found in source code is kept as a short fingerprint and its location, never the value, and is never tried.
• Your integration credentials are encrypted at rest, each readable only in the one place it is used.
• Honest about gaps. A check that could not run is reported as not assessed, and a partial scan says its grade is an upper bound.
• Person-level detail is gated behind domain verification. A public scan never shows another organization’s people.
• Email from us is opt-in, per kind. Product updates, the newsletter, and tips and offers are separate unticked boxes. We keep the address, what was ticked, when, and a hash of the network address it came from, and send it to our email provider (Resend) only once the address is proven to be yours. Addresses on your staff list or watch list are never added. Untick on Your account, or use the link in any email.

19. FAQ

Do I need to install anything?
No. A scan works from public sources. You point it at a domain.

Why does the snapshot hold details back?
So that scanning a domain doesn’t hand its exploitable specifics to anyone. The snapshot shows the grade and the shape of the exposure; the full report, sent to your email, has the evidence.

My grade is an A — am I safe?
An A means little is exposed from the outside. It says nothing about your internal controls. Read the modules, and keep monitoring: exposure changes every week.

Why does a finding say KEV or show a percentage?
KEV means the vulnerability is on CISA’s list of vulnerabilities being exploited right now. The percentage is EPSS: the estimated chance it is exploited in the next 30 days. Both raise the finding’s severity.

I fixed it. Why is it still open?
A fix is marked resolved only by a re-scan that no longer finds it. Choose Fixed — verify; if the re-scan still sees the problem, the finding reopens with the evidence.

Will an AI agent change anything without me?
No. Agents only propose. Every decision, ticket and re-scan waits for a person to approve it, and approving runs the same path as doing it yourself.

Can I see which employees are affected?
Yes, once your organization has verified the domain. Detail is gated by design, so no one can see another organization’s people.

A check says “not assessed”. What does that mean?
A source could not be consulted or a permission is missing. HRS Exposure says so instead of implying it is clean, and names what is needed.

20. Glossary

• AI agent — a model-driven assistant that investigates findings and proposes decisions, fixes and tickets for a person to approve.
• Attack path — a chain of open findings an attacker could use in sequence, with the fixes that break it.
• CTEM — continuous threat exposure management: scope, discover, prioritize, validate, mobilize.
• Disposition — where a finding is in its lifecycle: new, acknowledged, verifying, resolved, false positive, risk accepted.
• Domain verification — proving you control a domain with a DNS TXT record, which unlocks monitoring and person-level detail.
• EPSS — the Exploit Prediction Scoring System: the probability a vulnerability is exploited in the next 30 days.
• Finding — a specific, evidence-backed observation, with a severity.
• Grade / posture score — your exposure from A (best) to F, and the 0–100 number behind it; higher is better.
• Infostealer — malware that steals credentials and live sessions from a person’s device.
• KEV — CISA’s Known Exploited Vulnerabilities catalog.
• Module — one of the nine areas a scan covers.
• Snapshot — the immediate, summary result of a free scan.
• Takedown request — an abuse report to a look-alike domain’s registrar, sent only after a person approves it.
• Verification re-scan — the targeted scan that proves, or disproves, a claimed fix.

Questions or onboarding help: contact your HRS administrator or the HumanRisk Shield team.