> ## Documentation Index > Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt > Use this file to discover all available pages before exploring further. # Credential Hygiene: Responding to Leaked Passwords > Step-by-step response procedures for credential exposure findings in Leverage Cyber — contain the risk fast and prevent follow-on compromise. When Leverage Cyber surfaces a credential exposure finding, the response needs to be fast and structured. A leaked password is not a hypothetical risk — it is an open door, and adversaries actively monitor breach datasets and paste sites to exploit fresh credentials before organizations have time to react. This guide gives you the exact steps to contain the risk, verify there has been no unauthorized access, and put controls in place that prevent the same exposure from becoming a repeat finding. ## Immediate Response (First 24 Hours) Speed is the single most important variable in credential incident response. Every hour a compromised credential remains active is an hour an adversary can use it. Execute these steps in order and do not wait for steps further down the list before completing the ones at the top. Before you can contain the exposure, you need to know its blast radius. Pull up the account in your identity provider (Okta, Azure AD, Google Workspace, or equivalent) and document every application, system, and resource the account has access to. Pay particular attention to email, VPN, cloud consoles, administrative portals, code repositories, and any systems containing sensitive customer or financial data. This inventory drives every subsequent step. Do not wait for the user to reset their own password voluntarily — users take days, and you don't have days. Use your identity provider's admin console to force an immediate password reset. If the account uses a local password not managed by a central IdP, reset it directly. Set a temporary password that meets your complexity policy and confirm the user receives it through an out-of-band channel (phone or a separate verified email address, not the potentially compromised inbox). A password reset alone is not sufficient if the adversary already has an active session token or refresh token. Use your identity provider to revoke all active sessions for the account. In Google Workspace, this is "Sign out all sessions." In Azure AD / Entra ID, use "Revoke sign-in sessions." For individual SaaS applications that maintain their own sessions, log the user out from each application's admin panel. This step ensures that an attacker who was already authenticated cannot simply continue their session after the password is changed. If the affected account does not have multi-factor authentication enabled, enable it immediately — this is non-negotiable for any account found in a credential breach. Enroll the user in your organization's standard MFA method. If your organization does not yet have a universal MFA policy, this finding is your justification to create one. An account with a reset password but no MFA is only marginally more secure than it was before the reset. Pull the account's login history and audit logs for the past 30 to 90 days. Look for login events from unfamiliar IP addresses or geographic locations, successful authentications outside of the user's normal working hours, access to resources the user does not typically interact with, bulk downloads, email forwarding rule changes, or any administrative actions the user did not initiate. Document everything you find — even if nothing looks suspicious, record that the review was completed with no anomalies identified. Open an incident record in your ticketing or SIEM system. Document the finding ID from Leverage Cyber, the affected account, the services at risk, the steps taken and their timestamps, the findings from the log review, and the name of the person who performed each action. This documentation is your evidence of due diligence and will be required for any regulatory reporting obligations that may apply to the exposure. ## For Privileged and Executive Accounts Standard credential response procedures apply to all accounts, but privileged and executive accounts require a materially higher level of urgency and scrutiny. A compromised administrator, finance executive, or C-suite account can result in business email compromise, unauthorized wire transfers, or full domain takeover within hours of exploitation. Treat any privileged or executive credential leak as a potential active compromise — assume the worst until your investigation proves otherwise. The cost of a false alarm (minor disruption, a few hours of forensics work) is trivially small compared to the cost of treating an active compromise as routine and discovering the breach weeks later. In addition to the standard immediate response steps, take the following actions for privileged and executive accounts: Escalate the incident immediately to your most senior available security resource. Pull all available logs — identity provider, email, cloud platform, VPN, endpoint — for the affected account going back 90 days. Look for the full scope of any access that may have occurred using the compromised credential. Compromised privileged accounts are frequently used as a launchpad for lateral movement. Look for authentication events from the compromised account to other systems, new accounts or permissions granted by the account, changes to security configurations or audit logging settings, and access to credential stores or password vaults. Any of these indicators should escalate the incident to a full security incident response. If your log review reveals suspicious activity or you cannot rule out active compromise, consider temporarily disabling or isolating the account while the forensics review is underway. Work with the account holder to provision a clean temporary account for essential business functions. This is a disruptive step but may be necessary to prevent ongoing damage while you establish the full scope of the incident. A compromised privileged account that shows evidence of exploitation is a full security incident — not just a credential hygiene finding. Engage your incident response plan, notify your legal and compliance team of the potential obligation to report, and consider whether external incident response support is warranted. ## Preventing Recurrence Responding to a single credential exposure does not prevent the next one. Use each finding as an opportunity to advance your organization's overall credential hygiene posture. Deploy a company-managed password manager (1Password, Bitwarden, or equivalent) and make it the default tool for credential storage across the organization. Employees who rely on a password manager generate longer, more unique passwords and are significantly less likely to reuse passwords across services — the most common cause of credential exposure spreading beyond a single breached site. Enforce MFA at the identity provider level for all users — not as an opt-in, but as a mandatory control. Use conditional access policies to require MFA for all applications, particularly those accessible from outside the corporate network. An account whose password is leaked is substantially protected if MFA is in place. Standard TOTP codes and SMS-based MFA are vulnerable to real-time phishing attacks that relay both the password and the OTP to the attacker simultaneously. Phishing-resistant MFA methods — hardware security keys (YubiKey, Titan Key) or passkeys using the FIDO2/WebAuthn standard — are bound to the origin domain and cannot be relayed. Prioritize FIDO2 enrollment for all privileged and executive accounts first. Leverage Cyber continuously monitors dark web forums, breach databases, and paste sites for credentials associated with your domains. New credential exposures are surfaced as findings as soon as they appear, giving you the opportunity to respond before adversaries have had time to weaponize the data. Ensure your monitored domains include all domains used in employee email addresses, not just your primary domain. Credential exposure most commonly originates from phishing, malware, or password reuse on breached third-party sites. Regular, scenario-based security awareness training reduces the rate at which employees fall victim to credential-harvesting attacks. Prioritize training modules that address phishing recognition, password hygiene, and the safe use of personal devices for work accounts. Conduct a periodic audit of all accounts across your identity provider: identify accounts that have not logged in for more than 90 days and disable or remove them, identify accounts without MFA and enroll them, and review service accounts and API credentials for rotation compliance. Stale accounts are high-value targets because they're often forgotten — and forgotten accounts rarely have their passwords changed after a breach. ## Organizational Response Individual account remediation addresses the immediate risk, but a credential exposure finding should also trigger a review of the broader organizational context that allowed the exposure to occur. Communicate with affected employees clearly and promptly — explain what was found, what has been done to protect their account, and what they should watch for. Avoid language that creates panic, but do not downplay the seriousness of the event. Employees who understand what happened are more likely to remain vigilant and to report suspicious activity in the future. Review your security policies to identify any gaps the incident exposed. If the affected account lacked MFA, identify whether there are other accounts in the same situation and close that gap systematically rather than reactively. If the credential appeared in an external breach database, investigate whether any organizational practices — shared passwords, documented credentials in internal wikis, insecure off-boarding processes — contributed to the exposure. Finally, review your onboarding process to ensure every new account starts with strong credentials from day one: a password manager-generated password, mandatory MFA enrollment, and a documented access review as part of the standard onboarding checklist. The best time to establish good credential hygiene is at account creation. Once the affected account's password has been changed and MFA has been activated, Leverage Cyber will automatically update the finding status in your dashboard. Re-verification occurs at the next monitoring cycle — you do not need to manually close the finding. If you've completed remediation and the finding remains open beyond 24 hours, use the "Mark as Remediated" action in the finding detail view to trigger an out-of-cycle verification check.