This comprehensive security analysis report reveals critical trends and escalating risks across key security domains, highlighting a significant elevation in our organization's risk profile. Actionable insights are provided for security leaders to maintain a resilient posture.
Compromised Email Addresses
Weekly Security Events
Content Index
Executive Summary: Critical Risk Elevation
Threat Volume Trends: The Dramatic Surge
Critical Threat Breakdown: Attack Vectors
Spam and Graymail: The Productivity Crisis
Dark Web Compromises: Confirmed External Exposure
Targeted Users: Convergent Internal and External Risk
Emerging Threat: Google Drive Data Loss Prevention
Immediate Actions: Critical Remediation Roadmap
Strategic Recommendations: Building Resilience
Security Risk Profile Analysis
This report presents a comprehensive analysis of our organization's security posture for the period December 2024 through November 2025, revealing critical trends across key security domains.
Threat Detection & Monitoring
We uncover critical trends in threat detection, showcasing our continuous efforts to monitor systems for vulnerabilities and suspicious activities, ensuring robust and proactive defenses.
Dark Web & Data Breaches
Our analysis investigates dark web compromises and confirmed data breach discoveries, synthesizing weekly security intelligence to identify and mitigate emerging risks effectively.
Targeted Attack Patterns
We depict and analyze patterns of targeted attacks, providing detailed security analysis to anticipate and neutralize sophisticated threats before they can impact our operations.
By integrating weekly security intelligence with confirmed data breach discoveries, this report delivers actionable insights vital for security leaders to maintain a resilient security posture.
Executive Summary: Critical Risk Elevation
The organisation has experienced a dramatic escalation in security risk over the reporting period. Total security events have surged from an average of 500 weekly detections in early 2025 to a sustained rate exceeding 3,500 events per week by mid-year, representing more than a 600% increase in threat volume.
The risk landscape is characterised by three converging factors: massive growth in detection volume, persistent targeting of specific users, and confirmed external data exposure. Most critically, 98 email addresses associated with the domain have been discovered on dark web combolists, with some users appearing in up to nine separate breach incidents.
The combination of high-volume email threats and confirmed credential compromises creates a critically vulnerable environment that requires immediate executive attention and coordinated remediation efforts.
Threat Volume Increase
Growth in weekly security events from baseline
Compromised Accounts
Email addresses found on dark web
Current Weekly Events
Sustained high detection rate
Threat Volume Trends: The Dramatic Surge
The organisation's security event volume demonstrates two distinct operational phases that fundamentally altered the threat landscape. Understanding this transition is essential for contextualising current risk levels and resource allocation decisions.
Phase 1: Baseline Period
December 2024 – April 2025
Weekly detections ranged from 276 to 804 events, averaging approximately 550 events per week. This represented a manageable, low-to-moderate threat environment with predictable patterns.
Phase 2: Elevated Threat Period
May 2025 – November 2025
A dramatic inflection point occurred in May, with weekly detections surging to between 3,300 and 4,400 events. This sustained elevation represents the new normal threat environment.
The transition between phases suggests either a fundamental shift in attacker tactics, expanded detection capabilities, or both. The persistence of elevated levels through November indicates this is not a temporary spike but rather a structural change in the threat landscape requiring corresponding adjustments to security operations and staffing.
Critical Threat Breakdown: Attack Vectors
Analysis of the threat composition reveals distinct attack patterns across multiple vectors. Understanding the relative weight and evolution of each threat type is essential for prioritising defensive investments and operational focus.
Spam Volume
Dominant threat category, peaking at 993 events weekly
Phishing Attacks
Sophisticated credential harvesting attempts
Malware & DLP
Lower frequency but high-impact events
Phishing: Persistent and Targeted
Phishing attacks demonstrate concerning sophistication and targeting precision. The highest single-week count reached 236 events (5-12 June 2025), with another significant spike of 189 events in early April. Weekly averages consistently exceed 100 attempts during the elevated threat period.
Attack themes predominantly exploit urgent, high-trust scenarios including financial services impersonation, major platform notifications, and business opportunity lures. Documented campaigns include MetaMask wallet suspension warnings, Facebook security alerts, and DocuSign review requests.
Malware: Low Volume, High Risk
Malware detections remain relatively low but represent the highest-severity threat class. The peak of 8 detections occurred during 10-17 July 2025. Several incidents involved malicious JavaScript attachments designed to bypass traditional signature-based detection.
The low detection count may reflect either effective perimeter defences or sophisticated evasion techniques that avoid detection. Given the confirmed dark web compromises, the possibility of undetected malware-based credential theft cannot be dismissed.
Spam and Graymail: The Productivity Crisis
Spam volumes have demonstrated explosive growth, particularly in the fourth quarter of 2025. The most recent weekly snapshot recorded 993 spam events, representing the highest single-week volume across the entire reporting period and nearly quadrupling the baseline December rate of 253 events.
The sustained high volume of spam creates multiple organisational risks beyond immediate security concerns. Email fatigue reduces user vigilance, increasing susceptibility to sophisticated phishing attempts. Help desk resources become consumed with false positive investigations and user complaints. Legitimate business communications may be delayed or overlooked in the noise.
Graymail Explosion
Graymail volumes surged from negligible levels in Q1 (averaging 48 per week) to sustained levels exceeding 2,800 per week by Q4. This category includes newsletters, marketing emails, and automated notifications that users may have subscribed to but no longer actively want.
Policy Tuning Required
The dramatic increase suggests either expanded detection capabilities came online mid-year or a genuine surge in unwanted commercial email. Either scenario demands immediate policy review and tuning to reduce productivity impact whilst maintaining security visibility.
Organisations typically underestimate the cumulative productivity cost of email noise. With thousands of employees processing hundreds of emails weekly, even small improvements in signal-to-noise ratio deliver measurable business value. Current volumes suggest an urgent need for aggressive filtering policy optimisation and user education on subscription management.
Dark Web Compromises: Confirmed External Exposure
The Dark Web Compromise Report dated 6 November 2025 confirms 98 email addresses associated with the domain have been discovered in data breaches and on identity theft forum combolists. This represents a confirmed, active external threat that fundamentally alters the organisation's risk profile.
These compromises originated from various sources including documented data breaches, phishing campaigns, and keylogging operations. Compromised data includes email addresses, partial passwords or password hashes, and in some cases confirmed Personally Identifiable Information. The most recent compromise entry was dated 30 October 2025, indicating ongoing exposure and collection by threat actors.
High-Risk Users
flor@smileelite.com appears in at least 9 separate breach databases, representing the highest exposure level in the organisation. Multiple appearance indicates credentials likely available to numerous threat actor groups.
Widespread Exposure
mark.reuben@ (6 compromises), monique.field@ (5 compromises), and scott.good@ (5 compromises) represent the next tier of high-risk accounts with confirmed multi-breach exposure.
Credential Availability
Combolist presence means credentials are actively traded and tested across services. Threat actors routinely attempt credential reuse attacks against corporate systems, cloud platforms, and partner services.
The confirmed external exposure creates multiple attack vectors. Threat actors may attempt credential stuffing attacks against corporate systems, use compromised accounts for business email compromise campaigns, or leverage known vulnerabilities for spear-phishing. The presence of PII in some compromises enables sophisticated social engineering and impersonation attacks that traditional controls struggle to detect.
Targeted Users: Convergent Internal and External Risk
Analysis reveals concerning overlap between users experiencing high volumes of internal phishing attempts and those whose credentials appear in dark web databases. This convergence suggests either coordinated targeting or that compromised users are being deliberately selected for subsequent attack campaigns.
Consistently Targeted (Internal Reports)
- Monique Field – Appears frequently in weekly high-attack user lists
- Buta Deogun – Consistent presence across multiple reporting periods
- Denise Lewis – Regular appearance in targeted attack summaries
The persistent targeting of specific individuals across multiple weeks suggests either spear-phishing campaigns, role-based targeting (these users may have elevated privileges or financial authority), or configuration weaknesses that make their accounts more visible to attackers.
Confirmed Compromised (Dark Web)
- flor@smileelite.com – 9 separate breach entries
- mark.reuben@smileelite.com – 6 breach entries
- monique.field@smileelite.com – 5 breach entries
- scott.good@smileelite.com – 5 breach entries
The appearance of Monique Field in both lists is particularly concerning, suggesting a user under active, sustained attack who may already have compromised credentials circulating in threat actor communities.
The targeting pattern suggests several possible scenarios. Users with compromised credentials may be preferentially targeted because attackers know the account is vulnerable and hope for password reuse across systems. Alternatively, high-value targets (executives, finance personnel, IT administrators) naturally attract more attention and their past compromises simply reflect broader exposure over longer careers and more extensive online presence.
Regardless of causation, the convergence demands immediate, individualised response. These users require mandatory password resets, MFA enforcement, enhanced monitoring, and targeted security awareness training focused on their specific threat profile. Generic organisation-wide communications will prove insufficient for users under active, persistent attack.
Emerging Threat: Google Drive Data Loss Prevention
While email threats dominate the security landscape, Google Drive DLP incidents represent a concerning secondary vector that demands attention. These events, though lower in volume, involve the potential exposure of highly sensitive regulated data that could trigger compliance obligations and reputational damage.
27 Feb – 6 Mar 2025
First recorded incident: 1 Google Drive DLP event detected
8-15 May 2025
Significant spike: 10 events involving Australian tax file numbers and vehicle identification numbers
28 Aug – 4 Sep 2025
Secondary elevation: 6 Google Drive DLP events detected
25 Sep – 2 Oct 2025
Most recent incident: 1 Google Drive DLP event
The peak of 10 events during 8-15 May specifically involved Australian tax file numbers (TFNs) and vehicle identification numbers (VINs). TFNs are highly regulated under Australian privacy law, and unauthorised disclosure triggers mandatory breach notification obligations under the Privacy Act 1988. The detection of these events indicates either user behaviour creating exposure risk or legitimate business processes that lack appropriate controls.
Priority Investigation Required
The organisation must immediately investigate the specific circumstances of each DLP event to determine:
- Whether exposure was internal (inappropriate sharing within organisation) or external (sharing outside organisational boundary)
- The legitimate business justification for the data being in Google Drive rather than more controlled systems
- Whether detected incidents represent policy violations requiring disciplinary action or process gaps requiring remediation
Policy and Technical Controls
Google Drive sharing policies require comprehensive review and potential hardening. Current detection patterns suggest either overly permissive default sharing settings or insufficient user awareness of regulatory obligations. Technical controls should enforce:
- Default-deny external sharing for sensitive data classifications
- Mandatory review workflows for external sharing requests
- Automated classification and labelling of regulated data types
Immediate Actions: Critical Remediation Roadmap
The convergence of high-volume email threats, confirmed credential compromises, and emerging data loss vectors demands immediate, coordinated remediation. The following actions represent the minimum necessary response to address critical risk and should be treated as executive priorities requiring weekly progress reporting.
Emergency Password Resets
Force immediate password resets for all 98 email addresses identified in the Dark Web Compromise Report. Communicate urgency without creating panic. Provide clear instructions and dedicated support resources to ensure rapid compliance. Track completion rates daily until 100% achievement.
Multi-Factor Authentication Mandate
Require MFA for all compromised accounts immediately, with organisation-wide rollout within 30 days. Prioritise high-risk users (executives, finance, IT administrators) for immediate enforcement. Deploy phishing-resistant MFA methods (hardware tokens, biometrics) for users appearing in multiple breaches.
Enhanced Monitoring for High-Risk Users
Implement enhanced logging and alerting for the users appearing in both internal targeting reports and dark web compromises. Configure alerts for unusual login patterns, geographic anomalies, impossible travel scenarios, and bulk data access. Assign dedicated analyst review for these accounts.
Targeted Security Awareness
Deploy mandatory, individualised security refreshers for high-attack users focusing on credential harvesting, impersonation tactics, and social engineering. Move beyond generic training to address specific attack patterns these users face. Include simulated phishing exercises mimicking actual threats observed.
Google Drive Security Review
Conduct comprehensive investigation of all Google Drive DLP incidents to determine exposure scope and business justification. Review sharing policies organisation-wide and implement technical controls to prevent external sharing of regulated data. Provide user training on appropriate use of cloud storage for sensitive information.
Email Policy Optimisation
Address soaring spam and graymail volumes through aggressive policy tuning. Work with email security vendor to optimise detection rules and reduce false positives. Implement user education campaign on subscription management and email hygiene. Measure productivity impact before and after optimisation.
Strategic Recommendations: Building Resilience
Beyond immediate tactical responses, the organisation must address structural vulnerabilities revealed by this analysis. The sustained elevation in threat volume and confirmed external compromises indicate security operations are fundamentally mismatched to the current threat environment.
Security Operations Capacity
Current threat volumes demand reassessment of security operations staffing and tooling. Investigate whether the 600% increase in detections reflects expanded visibility (positive) or genuine threat growth (concerning). Either scenario requires corresponding increase in analysis and response capacity.
Threat Intelligence Integration
Formalise integration of dark web monitoring into security operations workflows. The current report represents a point-in-time snapshot, but organisations require continuous monitoring and automated alerting when new compromises appear. Integrate dark web intelligence with SIEM and identity management systems.
Zero Trust Architecture
The confirmed external credential compromises validate the zero trust security model. Organisations cannot assume network perimeter protects against threats when credentials are readily available to attackers. Accelerate implementation of zero trust principles including continuous authentication, least privilege access, and micro-segmentation.
Metrics and Measurement
Establish clear metrics to track remediation effectiveness and ongoing risk levels:
- Time to detect and respond to phishing attempts
- Percentage of compromised accounts remediated
- MFA adoption and utilisation rates
- Mean time to password reset after compromise discovery
- User-reported phishing attempt rates (measuring awareness)
- Repeat offender rates (users falling for multiple attacks)
Executive Reporting
Security leaders must translate technical metrics into business risk language for board and executive audiences:
- Potential financial impact of credential compromise
- Regulatory exposure from data loss incidents
- Reputational risk from potential breach disclosure
- Productivity cost of email threat volumes
- Comparative risk position relative to industry peers
- Return on investment for recommended security enhancements
The organisation faces a critically elevated risk environment requiring immediate action and sustained investment. However, with clear priorities, adequate resourcing, and executive commitment, the identified vulnerabilities are addressable. Success requires treating security as an ongoing operational discipline rather than a periodic project, with continuous measurement, adaptation, and improvement.
Your Security Risk Profile Analysis - December 2024 to November 2025