In short: Check Point Leaked Credentials is an add-on to Check Point Email Security (Harmony Email and Collaboration). It continuously scans multiple deep and dark web sources for your users' compromised credentials, detects leaks in real time, creates a security event for each one, tracks past exposures and lets admins block users or force password resets.
Why leaked credentials matter
Stolen passwords are one of the most common ways into a business. They leak from breaches of other websites where staff reused a work password, from malware on a home computer, or from phishing pages. They are then traded or published on criminal forums and markets.
Once a working Microsoft 365 or Google Workspace login is in the wrong hands, the attacker does not need to break anything. They sign in, read mail, set up forwarding rules and send convincing invoices from a real account. Finding out that a credential has leaked, before it is used, gives you the chance to reset it and stop that chain at the start.
What the add-on does
Check Point's Leaked Credentials add-on for Harmony Email and Collaboration, now officially Check Point Email Security, covers:
| Capability | What it means |
|---|---|
| Continuous credential monitoring | Scans multiple deep and dark web sources for credentials belonging to your organisation, with real-time detection of leaks |
| A security event per leak | Each leak found appears as a security event in your Email Security console, alongside phishing and account takeover alerts |
| Historical exposure tracking | Shows past exposures, so you can judge which users and accounts carry the most risk |
| Remediation | Lets administrators act straight away, by blocking the user or enforcing a password reset |
| SIEM integration | Feeds events into your existing security monitoring workflows |
Check Point's Leaked Credentials page also describes real-time blocking of phishing sites and of corporate credentials being used on non-corporate sites, which is the browser protection covered below. For how the add-on fits into Check Point's current product names, see our Check Point Workspace Security page.
How it works with the rest of Check Point
Leaked credential alerts are most useful when they connect to the other controls that stop a stolen password being used:
- Account takeover detection. Both Advanced Protect and Complete Protect watch for anomalous sign-ins and mailbox behaviour. A leaked credential event tells you which accounts deserve extra attention.
- Password reuse protection. Harmony Browse can warn or block when staff type their corporate password into a non-corporate website, cutting off one of the most common sources of leaks.
- Phishing protection. The core email engines block the phishing pages that harvest credentials in the first place.
- Monitoring. If you use Check Point MDR, its analysts can act on identity events as part of round-the-clock monitoring.
Leaked credential monitoring is not a substitute for multi-factor authentication. Strong MFA means a stolen password alone is not enough to sign in; monitoring tells you when to reset and investigate. You need both.
What to do when a leak is found
- Confirm the account and whether the leaked password is current or old
- Force a password reset, or block the user while you investigate
- Check sign-in logs and mailbox rules for signs the account has already been used
- Make sure MFA is enforced on the account, and revoke active sessions
- Remind the user not to reuse work passwords elsewhere, and record the incident
Under UK GDPR, a compromised account that exposed personal data may need to be assessed as a personal data breach, and some must be reported to the ICO within 72 hours of you becoming aware. Acting quickly on a leaked credential event helps you stay ahead of that.
Leaked Credentials vs standalone dark web monitoring
Forever Group also offers standalone dark web monitoring that is not tied to an email product. The difference is mainly where the alerts land and what you can do with them:
| Check Point Leaked Credentials | Standalone dark web monitoring | |
|---|---|---|
| Where alerts appear | In the Check Point Email Security console, as security events | In a separate monitoring portal and reports |
| Built-in remediation | Block user or force password reset from the same console | Usually a manual step in your identity system |
| Requires | Harmony Email and Collaboration | No particular email security product |
| Best for | Check Point Email Security customers who want one console | Organisations on other platforms, or MSP-style reporting |
If you already run Check Point Email Security, the add-on keeps everything in one place.
Licensing and how we help
Leaked Credentials is licensed as an add-on to Harmony Email and Collaboration; the Harmony pricing guide explains how add-ons affect cost. Forever Systems can enable it, agree a response process with you for each alert, and check that MFA and password reuse protection are in place so that a leak does not become a breach.
Contact us for a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point Leaked Credentials?
It is an add-on to Check Point Email Security (Harmony Email and Collaboration) that continuously scans deep and dark web sources for your users' compromised credentials and raises a security event for each one, so administrators can block the user or force a password reset.
Where do leaked credential alerts appear?
Each leak creates a security event in Check Point Email Security, which you manage in the Check Point Portal alongside phishing and account takeover alerts. Check Point also describes integration into SIEM workflows.
Does leaked credential monitoring replace MFA?
No. MFA stops a stolen password alone being enough to sign in; leaked credential monitoring tells you which accounts to reset and investigate. Use both.
Is a leaked password a reportable data breach?
Not automatically. If the account was used to access personal data, you need to assess it as a possible personal data breach under UK GDPR, and report qualifying breaches to the ICO within 72 hours of becoming aware.