VeriClouds Identity Threat Protection Platform

Cyber-crime threats such as data theft and ransomware are rising, with credential stuffing highlighted as the leading emerging threat. Recent breaches illustrate the scale and consequences: Eurostar reset customer passwords after an attack, and Cathay Pacific disclosed access to personal data for up to 9.4 million passengers. For organizations holding EU resident data, GDPR introduces significant financial penalties, reinforcing both legal and ethical obligations to reduce attack success—especially by strengthening credential security.

Most enterprises already deploy layered defenses (firewalls, intrusion prevention, access controls, encryption), so attackers commonly bypass them by obtaining “legitimate” access via stolen user credentials, aligning with the early stages of the cyber-kill chain. Phishing remains a common method to capture credentials or install malware, but a major accelerant is password reuse across personal and organizational systems. Because users struggle to remember complex passwords and manage many accounts, leaked credentials from breached consumer services are frequently reused, enabling criminals to test harvested passwords against corporate logins or compromise other personal accounts to plant malware.

Leaked credential databases are widely traded on the dark web, and many organizations’ password policies still focus on complexity and forced rotation, while failing to screen new passwords against known breached-password corpora as recommended in NIST SP 800-63B. Passwords therefore remain a high-risk factor—particularly for privileged access—until stronger authentication is adopted.

VeriClouds addresses this gap with CredVerify (API-based credential checking during login and password change) and CredMonitor (continuous monitoring of an organization’s domain on the dark web). It maintains a proprietary database exceeding seven billion leaked credentials, supports privacy-by-design via zero-knowledge approaches and secure enclaves, offers cloud and on-premises deployment, and integrates with select identity and security platforms. Key challenges center on broader integrations, especially with IDaaS and CASB ecosystems, and scaling adoption through partnerships.

• Credential stuffing is identified as the number one emerging threat.
• Eurostar reset customer passwords after a hack attack in October.
• Cathay Pacific reported personal data access affecting up to 9.4 million passengers in October.
• GDPR penalties can reach up to 4% of global annual turnover for relevant breaches involving EU residents.
• VeriClouds is headquartered in Seattle, Washington, USA.
• VeriClouds was founded in 2014 by Rui Wang and Stan Bounev.
• VeriClouds maintains a proprietary database of more than seven billion known leaked credentials sourced from the dark web.
• CredVerify performs credential verification inside an Intel SGX enclave.
• Compromised credentials in the VeriClouds database are encrypted using AES 256-bit encryption.
• The SaaS service is delivered and supported on Microsoft Azure cloud and Aliyun cloud.

• “Organizations have a moral and fiduciary responsibility to be vigilant and take appropriate precautions to reduce the risk of cyber-attacks being successful.”
• “They use a multi-stage approach known as the cyber-kill chain and the first objective of this is to obtain access to one end-user device or system within the organization.”
• “Once the attackers have obtained the credentials for a legitimate user account these give them access to all the systems available to that user and, at this point, it is very hard to distinguish the attackers from the genuine user.”
• “Passwords are widely used as a ‘something you know’ check on the authenticity of users.”
• “Databases of leaked credentials are widely available on the ‘dark web’ and are used by cyber criminals to target organizational users.”
• “Breached credentials are a major problem and until organizations implement other forms of authentication, passwords are a major risk.”
• “The product is designed and built using a privacy by design philosophy that neither VeriClouds nor its clients have visibility over data that does not belong to them.”
• “All the credential verification and comparison happen locally in client-side code.”
• “In general terms, the use of passwords alone to verify identity of an entity using an IT service provides only the lowest level of assurance in that identity.”
• “There will be no quantum leaps or exponential growth without partnerships.”