Email exposure checks work best when you separate conservative confirmation from deeper exploration. The first job is to decide whether there is enough signal to keep going at all.
Recommended sequence
- Start with a conservative breach check such as Have I Been Pwned to confirm whether the email appears in known public breach collections.
- If the address is business-related, use Hunter or domain-level context to decide whether the email plausibly belongs to the organization in question.
- Only move into deeper search tools such as Intelligence X when the case justifies broader historical or leaked-data pivots.
- Document the source of every exposure claim and note whether the result is direct evidence, secondary reporting, or tool-generated interpretation.
Where this goes wrong
Old exposure data gets treated like fresh compromise, typoed addresses create false positives, and people confuse an exposed email address with a confirmed account takeover.
Before you publish
Say what was found, where it was found, and what remains unknown. Exposure, compromise, and operational impact are not interchangeable terms.