Find out what attackers already have on you.

We point Overwatch at your domains, then send back what's already exposed, with sources.

Exposed credentials and compromised data

What's already circulating, and where.

Impersonation, executive exposure and merchant portfolio signals are part of the full Overwatch platform; the free assessment doesn't include them.

What we need from you: your domains and, if you issue cards, your BINs. Nothing from inside your network.

What you get back: a written analyst summary of what was confirmed, what wasn't, and what we'd do first, plus an optional 30-minute readout.

How long it takes: 5 business days from the point we have the list.

What happens to your list: it stays confidential and is deleted after 90 days.

What it costs: nothing, and there's no obligation to talk to sales afterward.

First page of a redacted Overwatch Intelligence Risk ReportSample reportSee a sample assessmentA redacted Intelligence Risk Report. 2 pages, PDF.

List your company's website and email domains, separated by commas. List only what follows the @ symbol, e.g. overwatchdata.ai, overwatchdata.io

If you issue cards, list your 6- or 8-digit Bank Identification Numbers (BINs), separated by commas.

Free Threat Assessment Terms

These terms apply when you request a free threat assessment from Overwatch Data, Inc. ("Overwatch") through our website. By checking the box on the request form, you agree to them on behalf of the organization you name.

  1. Who can request one. You must make the request on behalf of a business, public body or other organization, with authority to agree to these terms for it. Overwatch reviews each request and may decline or limit any assessment.
  2. What you give us. Your organization's domains and, if you choose, its card BINs. Only submit assets your organization owns or is authorized to have assessed.
  3. What we do. We search sources Overwatch can lawfully access, such as the open web, criminal forums, marketplaces and messaging channels, for information about the assets you submit. We don't connect to your systems, ask for credentials or install software, and we don't test or attack your infrastructure.
  4. What you receive. A written summary of what we found, sent to the email address on the request, usually within 5 business days. Findings reflect what we could see at the time, and we may not find every exposure. Sensitive data in the findings, such as credentials or card numbers, is masked.
  5. Confidentiality. We treat your submission and the results as confidential and use them only to prepare the assessment and to discuss it, and Overwatch's services, with you. The results are for your organization's internal use.
  6. Third parties. If we find an active threat to someone outside your organization, such as a card issuer, we may tell them about the threat without naming you.
  7. Retention. We delete the domains and BINs you submit 90 days after we receive them. We keep your contact details, and the record that you accepted these terms, as described in our Privacy Policy.
  8. No charge, no obligation. The assessment is free and creates no obligation to buy anything.
  9. No warranty. The assessment and results are provided "as is", for information only. They are not legal, security or other professional advice, and you decide what action to take.
  10. Liability. To the extent the law allows, Overwatch's total liability arising from the assessment is limited to one hundred U.S. dollars (US$100), and Overwatch is not liable for indirect or consequential losses.
  11. Other terms. These terms sit alongside our Terms of Use and Privacy Policy; if they conflict, these terms govern the assessment. Delaware law applies, as in the Terms of Use. We may update these terms, and the version in force when you submitted your request applies to it.

The same terms are on our Terms page.

By submitting, you agree to be contacted by Overwatch. See our Privacy Policy.

Thanks. An analyst will email you within one business day to confirm scope.Preview only: nothing was submitted.

Free threat assessment FAQs

What does the free threat assessment include?

The free dark web threat assessment shows what attackers already have on your organization. Overwatch points its collection at your domains, then reports what it finds: exposed credentials and compromised data. Impersonation, executive exposure and merchant portfolio signals are part of the full Overwatch platform, not the free assessment. Every item comes with its sources.

What do you need from us?

Your domains and, if you issue cards, your BINs. Nothing from inside your network and no software to install.

How long does it take?

Results arrive 5 business days after Overwatch has your list. An analyst emails within one business day of your request to confirm scope.