> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts and Notifications: Stay Ahead of New Exposures

> Every Leverage Cyber alert includes finding details, ALE impact, and a recommended first response, delivered the moment a new exposure is detected.

When a new exposure is detected, Leverage Cyber notifies your designated contacts immediately with full context: the finding, its Annual Loss Expectancy (ALE) impact, and a recommended first response. You never receive a bare notification that leaves your team scrambling to understand what happened or why it matters. Every alert is self-contained — actionable the moment it lands in your inbox or dashboard.

## Alert Channels

Leverage Cyber delivers alerts through multiple channels to match how your security team actually operates.

**Email (Default)**

Immediate notification is sent to all designated recipients the moment a finding crosses the severity threshold for real-time alerting. Email alerts include the complete finding summary, affected asset, ALE impact, and recommended immediate action. No login required to understand the situation.

**Secure Portal**

Every alert — regardless of severity — is logged in your Leverage Cyber dashboard with full details, status tracking, and audit history. The portal serves as the authoritative record of all findings, making it easy to search, filter, and export data for compliance or board reporting. Recipients who prefer to work from the portal can configure email to send a brief notification linking to the full record rather than the complete finding details.

**Executive Digest**

An optional weekly summary email gives senior leadership a high-level view of your security posture without routing every individual finding to the C-suite. The executive digest includes a count of new findings by severity, total portfolio ALE movement, and the top three findings requiring leadership awareness. Configure this for your CISO, CTO, or board liaison to maintain visibility without operational noise.

## Alert Severity Levels

Leverage Cyber assigns every finding a severity level based on the nature of the exposure and its potential for attacker exploitation. Severity determines delivery timing and escalation path.

| Severity | Trigger Example                | Response Time         |
| -------- | ------------------------------ | --------------------- |
| Critical | C-suite credentials leaked     | Immediate (\< 1 hour) |
| High     | New subdomain takeover risk    | Same day              |
| Medium   | Email security config degraded | Within 48 hours       |
| Low      | Minor third-party change       | Next weekly digest    |

Critical and High findings trigger immediate email notification in addition to being logged in the portal. Medium findings appear in the daily digest and the portal. Low findings appear in the weekly digest and the portal.

## What an Alert Contains

Every alert Leverage Cyber delivers includes the following fields so your team can assess and act without needing to pull additional context:

* **Finding type** — a plain-language description of the exposure category (e.g., "Leaked credential," "Subdomain takeover risk," "Email security misconfiguration")
* **Affected asset** — the specific domain, subdomain, email address, technology, or third-party relationship involved
* **ALE impact** — the estimated annual loss expectancy attributed to this finding, expressed in dollars, based on threat likelihood and potential business impact
* **Attacker opportunity** — a concise explanation of what an attacker could do with this exposure and what attack scenarios it enables
* **Recommended immediate action** — a specific, actionable first step your team can take right now to reduce exposure, even before a full remediation plan is in place

## Managing Alert Recipients

Alert recipients are configured during your engagement onboarding. To update the list of contacts who receive notifications — whether adding a new security team member, removing a departed employee, or adding an executive to the digest — contact your Leverage Cyber engagement manager directly or submit a change request through the secure portal under **Settings → Notification Preferences**.

Changes to recipient lists take effect within one business day. You can maintain separate recipient lists for different severity tiers — for example, routing Critical alerts to your on-call security engineer while sending the executive digest only to your CISO.

## False Positive Process

No automated intelligence system is perfect. If a finding does not accurately reflect a real exposure for your organization, flag it as a false positive directly from the finding detail view in the secure portal using the **Mark as False Positive** action.

When you flag a finding, Leverage Cyber's analyst team reviews it within one business day. If confirmed as a false positive, the finding is removed from your active portfolio and your ALE calculations are updated accordingly. A note is added to the finding record explaining the determination so the context is preserved for future reference and audit. If the analyst team disagrees with the false positive assessment, they will reach out to explain the reasoning before closing the review.

<Tip>
  Configure the executive digest for your CISO or CTO so leadership maintains weekly visibility into your security posture without being paged for every individual finding. Senior stakeholders get the risk summary they need for strategic decisions; your security team handles the operational detail without unnecessary escalation overhead.
</Tip>