Executive Exposure Checklist

Who this is for

Executives, board members, senior professionals, HNW individuals, and anyone who wants a clear picture of what a targeted adversary can assemble about them from public and semi-public sources. No technical background is required — each check is something you can run yourself, and most take only a few minutes.

What you gain from working through it

• Visibility into your own exposure. The ten categories below mirror the order a professional reconnaissance workflow follows in practice — brokers first, then breaches, filings, family, dark-web credentials, social-engineering surface.
• Lower personal discoverability. Each listed action removes a pretext ingredient an attacker would otherwise build on. Fewer ingredients mean fewer usable attack paths against you and the people around you.
• A harder target for targeted fraud. Whaling, CEO fraud, SIM-swap, and vishing all depend on cheap background research. Remove the raw material and the economic return on targeting you drops sharply.
• A repeatable baseline. Exposure drifts — new breaches, new people-search hits, new filings. Re-run the checklist every six to twelve months to catch drift before it turns into an incident.

How to judge what you find

Three questions decide what a finding is worth, and they matter more than how alarming it looks. Work them in this order.

The first question is the hardest to ask about yourself. You know why a detail exists and what it meant at the time, so it reads as ordinary. Someone assembling a profile has none of that context and reads the same detail for what it gives them. The gap is structural rather than a matter of effort, and a self-audit reaches the visible layer but not the outside judgement of it. Where that judgement matters more than the inventory, an Online Reputation Analysis is the outside read of what your findings say about you.

Two decisions, then a follow-up

A useful review ends with a next step, not a severity label. First decide whether a finding can be removed or reduced, or whether it has to be controlled around. Then decide whether it needs watching because it can return, or revisiting only if it connects to something else. The tag on each category below is the response its findings usually need — the individual finding still decides.

Why removability drives the order: removal reduces exposure, but it needs verification and recurrence checks rather than trust. Gueorguieva, King, Panidapu, and Ho’s 2026 assessment of 522 registered data brokers found that only 9% were fully compliant with transparency requirements; in an audit of 250 request processes, 43% made it impossible to exercise all privacy rights and 64% introduced substantial friction. Consumer Reports’ 2024 Data Defense field test followed 32 volunteers in California and New York across 13 people-search sites and found that manual opt-outs removed about 70% of listings after four months, while paid services varied widely. Sources: Privacy Without Remedy; Consumer Reports, Data Defense, Yael Grauer, 8 August 2024. PI analysis: Best data broker removal services in the US.