In short: usecure uBreach is a dark web monitoring product that checks staff email accounts against a database of known breaches and shows what was exposed and where. uBreach Starter is included in the usecure plan; uBreach Pro adds monitoring of every address on your domains, a wider breach database, alerts and remediation tracking.
Why breach monitoring belongs in an awareness programme
Security awareness is usually about what people do today: clicking a link, approving a prompt. But some of the biggest human risks come from what happened years ago. If someone used their work email address to sign up to a service that was later breached, and reused the same password, an attacker may already have working credentials for your systems.
Breached personal details also make phishing far more convincing, because the attacker knows which services a person uses. That is why usecure includes breach exposure as one of the signals in its human risk score, alongside training and phishing simulation results. For the general picture of how credential leaks are found and used, see Forever Group's guide to dark web monitoring.
How uBreach works
- Users' email accounts are checked against usecure's database of recent breaches, with accounts scanned automatically every week
- Each exposure is shown with its source and the type of data involved, such as passwords, names or addresses
- With uBreach Pro, securely redacted snippets of the leaked data, such as part of an email and password pair, help you judge whether the exposure is still dangerous
- With uBreach Pro, admins and managers receive breach alerts when new exposures are found, and affected users can be notified too
- With uBreach Pro remediation tracking, the incident is tagged as resolved once the account is secured, which gives you an audit trail and is reflected in the risk score
Staff can also see breaches linked to their own account in the usecure End User Portal, which turns a worrying alert into a clear task: change the password, stop reusing it and switch on multi-factor authentication.
uBreach Starter and uBreach Pro
| uBreach Starter | uBreach Pro | |
|---|---|---|
| How you get it | Included in the core usecure plan | Add-on, priced by domains monitored |
| Who is monitored | Email accounts of enrolled users | Every email address under your domains, across multiple domains |
| Breach sources | A database of recent breaches | A larger, continually updated set of dark web sources, including dumps, forums, paste sites and marketplaces |
| What you see | Breach source and data types, user and company reports | Adds redacted snippets of exposed values and advanced reporting by user, domain and resolution status |
| Alerts | Reports and dashboards | Instant alerts to admins and managers, optionally to users |
| Remediation | Exposure history | Remediation tracking and exports |
Domain-wide monitoring matters because attackers do not limit themselves to the people you enrolled in training. Addresses that are not enrolled, such as shared mailboxes or accounts left behind by leavers, can still appear in breach data. For licensing detail on the add-on, see usecure uBreach Pro licensing.
What to do when an exposure appears
A breach alert is only useful if someone acts on it. A simple response routine:
- Check whether the password is current: an exposure from many years ago may already have been changed, but confirm it
- Reset and revoke: change the password, sign the user out of active sessions and check for suspicious mailbox rules
- Enforce MFA on the account if it is not already on; see Cisco Duo MFA for a stronger option beyond basic codes
- Coach the person: a short conversation about password reuse and password managers works better than a warning
- Close the record in uBreach so the trail shows what was done and when
If exposures keep appearing for the same person, it is worth looking at whether they hold privileged access. That is exactly the kind of combination usecure uHealth is designed to surface.
Who uBreach suits
uBreach Starter suits any organisation already using usecure for training: it costs nothing extra and adds a meaningful signal. uBreach Pro is worth considering if you:
- Have several domains, or a history of mergers and rebrands that left old addresses behind
- Use shared mailboxes for finance, sales or support that are attractive targets
- Need to show insurers or auditors that you monitor for leaked credentials as part of cyber insurance evidence
- Want breach findings tied into the same risk score as training and phishing results
How we help
We switch on uBreach as part of your usecure set-up, review the first scan with you and agree who should receive alerts. Where you choose uBreach Pro, we add your domains and include breach findings in our monthly review, with a clear list of accounts to secure.
Contact us to find out what a first scan of your organisation shows.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between uBreach and uBreach Pro?
uBreach Starter, included in the usecure plan, checks enrolled users' email accounts against known breaches. uBreach Pro adds every address under your domains, a wider breach database, partial views of exposed data, breach alerts and remediation tracking.
Does uBreach show the actual leaked password?
No. uBreach Pro shows securely redacted snippets of exposed values, enough to judge whether the exposure is still a risk without revealing the full password.
Is uBreach included with usecure?
uBreach Starter is included in the core usecure plan. uBreach Pro is an add-on priced by the number of domains monitored, so ask us for a quote.
What should staff do if their email appears in a breach?
Change the password on the breached service and anywhere else it was reused, use a password manager, and make sure multi-factor authentication is switched on for their work account.