Digital exposure: how harmless information becomes a credible attack path

Professional profiles explain roles and responsibilities. Event posts reveal relationships. Images show locations, badges or suppliers. Calendars and absence messages provide timing. The combination can create a convincing pretext.

A credible message does not need to contain a secret. It only needs enough correct context to lower scepticism and create a plausible request.

1. 01
   Context

   Public information reveals a project, relationship or current event.

2. 02
   Authority

   The attacker imitates a person or supplier who appears entitled to make the request.

3. 03
   Timing

   Travel, absence or deadline information makes urgency believable.

4. 04
   Action

   The target is pushed towards payment, disclosure, access or a process exception.

Visibility is often intentional for leadership, sales, science or public engagement. The question is whether the organisation understands the exposure of its most attractive roles and has verification routines that match the risk.

• Executives and assistants with visible travel or calendar patterns.
• Finance, HR and procurement roles whose authority is easy to infer.
• Technical teams naming specific products, architecture or suppliers.
• Locations and events with publicly documented access routines or contacts.
• Family members or private profiles that unintentionally add context about exposed individuals.

A long list of public data creates alarm but little prioritisation. Start with a plausible action: what could someone attempt with the visible information, which role would be targeted, and which control should stop the attempt?

This turns collection into risk analysis. Document sources, recency and linkability, then prioritise only findings that materially strengthen a realistic attack path.

The strongest measures are often procedural rather than cosmetic. Sensitive changes should be confirmed through a known second channel, and unusual or urgent requests should never override established controls.

• Inventory public roles and information sources regularly.
• Remove unnecessary detail, old documents and avoidable metadata.
• Train exposed roles with relevant scenarios rather than generic phishing examples.
• Define verification rules for unusual, urgent or financially relevant requests.
• Repeat the review after leadership changes, major events or new partnerships.