AD user account with compromised password

This detection identifies valid internal domain suffixes used in Entra user and tenant objects and checks whether any of these domains appear in known public breaches using the HaveIBeenPwned (HIBP) domain search API. Public email providers are excluded from the threat settings’ predefined list.

When a matching breach is found, Cayosoft Guardian evaluates only breaches that include compromised passwords, ensuring results are limited to cases where user credentials were actually exposed. For each affected user, Cayosoft Guardian compares the breach data with the date the user last changed their password. If the password has never been changed or was last changed before the breach date, an alert is triggered.

If internal domains are found in breach data containing compromised passwords, and affected users have not rotated their credentials since the breach, this represents a significant threat vector. Compromised credentials may be exploited for phishing, credential stuffing, or unauthorized access.

This detection enables organizations to proactively assess and mitigate domain-level exposure risks by identifying users whose passwords remain vulnerable after a known breach.