What we never store
- Passwords or secrets. The tool never asks for them and never stores them.
- Anything from try-it mode. It saves nothing. Your map lives only in the open browser tab and is gone when you close it.
Free tool
See how one stolen account could open the rest.
Your email, phone number, bank and business tools quietly depend on each other. The account takeover map shows how, so you know which account to protect first. You list your accounts. You never enter a password.
The free tool is opening soon. This page shows how it works with a sample.
Example
A sample map for a two-person design studio.
These eight accounts are made up. Choose a situation to see how far one stolen account reaches. Reach counts the account itself plus every account it unlocks.
Accounts
- Mobile number Receives text codes
- Password manager Authenticator app
- Main email Text message codes
- Bank Text message codes
- Accounting software No second step
- Website and domain No second step
- Cloud storage No second step
- Payroll Email codes
How they connect
- Mobile number unlocks Main email: codes by text
- Mobile number unlocks Bank: codes by text
- Main email unlocks Bank: recovers by email
- Main email unlocks Accounting software: recovers by email
- Main email unlocks Website and domain: recovers by email
- Main email unlocks Cloud storage: recovers by email
- Cloud storage unlocks Payroll: stores the password
- Everything The whole map. Each arrow points from an account to one an attacker could reach once they control it, and its label says why. The main email recovers four other accounts, two accounts rely on text message codes and three have no second step. The password manager stands apart from the rest.
- If the main email is taken over Four accounts recover by email, so the attacker can reset their way into the bank, the accounting software, the website and domain, and the cloud storage. Payroll falls too, because its password is saved in a file in the cloud storage. The mobile number and the password manager stay out of reach.
- If the phone number is taken over A SIM swap moves a phone number to a criminal’s own phone, so text message codes arrive there. Those codes open the main email and the bank, and the email opens the rest. Only the password manager, which uses an authenticator app, is left.
- After the fixes The main email and the website use a security key, the bank and the accounting software use an authenticator app, text message codes are gone, and the password file has moved out of the cloud storage into the password manager. Taking over the main email now reaches 2 of 8 accounts, and taking over the phone number reaches only itself. Cloud storage is the one account still on the to do list.
How to use it
Three steps, no passwords.
List your accounts
Add the accounts that matter: your email, phone number, bank, business tools, admin and IT tools, password manager and security keys. You add names only, never passwords.
See the map
For each account, note how it is recovered, how you sign in and what the second step is. The map shows how taking over one account leads to others, and how many accounts one takeover reaches.
Work through the fixes
A hardening guide lists the fixes in plain steps, such as switching a text message code to an authenticator app. Mark each one done, or skip it.
Your privacy
What we store, and what we don't.
What we keep, if you ask us to
- A saved map stays with your account. Other people at your company cannot see it. Northridge Cyber can open it to go through it with you.
- You are in control. You can delete your account and your map.
The details
Tech specs
Account types
- Phone number
- Bank
- Business tools
- Admin and IT tools
- Password manager
- Security keys
What you note for each account
- Recovery. How the account is recovered if you lose access: a recovery email or a recovery phone number.
- Sign-in. How you sign in to the account.
- Second step. None, text message code, email code, authenticator app or security key.
Why accounts are linked
- Recovers by email. One account is the recovery email for another.
- Recovers by phone. A phone number is the recovery phone for an account.
- Codes by text. An account sends its second step code to a phone number.
- Codes by email. An account sends its second step code to an email account.
- Stores the password. A password manager or a file holds the account's password.
Reach
Reach is the number of accounts, including the first one, that taking over a single account unlocks by following the links above.
Risks the map flags
- One account that unlocks everything.
- Text message codes as the second step.
- No second step.
- Two accounts that recover each other in a loop.
- Accounts that share one recovery path.
Hardening guide
A list of fixes for the risks found, each marked done or skipped by you.
Privacy
- No passwords or secrets are entered or stored.
- Try-it mode saves nothing. The map exists only in the open browser tab.
- A saved map belongs to the account that made it. Other people at the owner's company cannot see it. Northridge Cyber can open it to review it with the owner.
- You can delete your account and your map.
Get your own map, free.
The free tool is not open yet. Leave your details and we will let you know when it opens.
What comes next
The map shows the risk. Managed security watches it for you.
A map is a snapshot of how your accounts connect. Managed security from Northridge Cyber watches your business accounts for signs of takeover, such as suspicious sign-ins and hidden inbox rules, and a real person helps if something happens. No service can promise to stop every attack.
See managed security