You do not need to be a large company to attract attention. A criminal can use public information to build a convincing phishing email, impersonate a vendor or identify an employee who handles payments.
Think of this as a 20-minute awareness exercise, not a promise that every exposure can be discovered in that time. Public research alone cannot establish whether your firewalls, endpoint protection, backups or internal permissions are secure.
1. Who works at your company?
Your website, LinkedIn profiles, staff directories and public announcements may reveal employee names, job titles and responsibilities. Criminals can use those details to tailor messages that sound like they came from an owner, manager or vendor.
What to do: Review public staff information and teach employees to independently verify unusual payment, password and account requests.
2. Have company email addresses appeared in a breach?
Public breach-notification services may show whether business email addresses have appeared in known incidents. An exposed address alone does not prove an account is compromised; an exposed password or reused credential is a different and more serious concern.
What to do: Check known exposures using reputable services, replace reused passwords and require phishing-resistant multifactor authentication where possible.
3. Could someone convincingly impersonate your email?
Public DNS records can reveal whether your domain publishes SPF, DKIM and DMARC email-authentication settings. Missing or weak settings can increase the chance of domain spoofing, although passing these checks does not stop every phishing attack.
What to do: Have your IT provider validate SPF, DKIM and DMARC, review DMARC reports and establish a process to verify financial changes by a trusted second channel.
4. What does your website reveal?
A public website may expose contact details, technology clues, outdated pages and documents containing unintended metadata. Some information is meant to be public; the question is whether it reveals more than necessary.
What to do: Review pages, files, forms, public subdomains and the software update process with an authorized IT professional.
5. Are old accounts and services still around?
Former employee identities, unused cloud accounts and forgotten online services can create risk. Outsiders may find references to these services, but cannot reliably determine access rights or whether an account is enabled without authorized internal review.
What to do: Inventory accounts and vendors, remove unused access and review administrator permissions and sign-in activity.
6. What leaks by accident?
Photos, shared documents, business listings and social posts can reveal office locations, routines, vendors, equipment or internal details. Most of this is harmless individually, but multiple small clues can make scams more credible.
What to do: Set sensible publishing rules, inspect public file-sharing permissions and train staff to avoid exposing confidential information.
7. What a stranger cannot see
An outside search cannot confirm whether your backups restore successfully, whether endpoint detection is active, whether every employee has appropriate access or whether someone would notice suspicious sign-ins. Those questions require an authorized security assessment.
A practical checklist for your business
- Review what your website and staff profiles publish.
- Check for exposed credentials and eliminate password reuse.
- Validate email authentication and MFA coverage.
- Remove former staff access and unused services.
- Review public documents and cloud-sharing permissions.
- Confirm patching, monitoring and backup-restore tests internally.
- Train employees to verify unexpected requests independently.
Find the risks before someone exploits them.
Phenicie Business Management helps Montana small businesses protect Microsoft 365, email, devices, networks and backups. Start with a conversation about the most important exposures for your organization. Technical testing and written findings are separately scoped.
Book a free 15-minute IT risk callBased in Polson, Montana · Contact PBM