Research
We scan entire sectors the way anyone on the internet could see them — externally, and without logging into anything — then publish what we found, how we found it, and what it does not prove. Each study describes one scan run on one day.
43 UK airport-operator websites and 51 of their suppliers · scan of
43 UK airport-operator websites covering 54 airports, and 51 organisations those airports depend on, scanned from the outside on one day. Ten exposed staff credential records sit with the operators; 1,152 sit with the suppliers.
380 UK charitable organisations · scan of
Nearly half of best-known charities, and six in ten of the largest by income, have staff email addresses in infostealer credential collections across every period on record. None of the 380 organisations showed any sign of having been compromised.