# Monday morning employee breach exposure briefing in Slack > Every Monday, automatically find which employee accounts on your company domain turned up in data breaches and get a plain-English briefing in Slack. - Workflow type: agent - Services: Have I Been Pwned, Slack Bot - Categories: Operations, Engineering - Published: 2026-07-17 ## What it does - Scans your verified company domain every Monday morning to find employee accounts caught up in known data breaches. - Groups the results by employee and ranks them by severity, flagging any breach that leaked passwords or financial details. - Calls out accounts that are newly exposed since last week so you can see what changed at a glance. - Posts a clear, non-technical briefing to your security channel in Slack with recommended next steps. ## What you'll need - A Have I Been Pwned subscription with your company domain verified in their dashboard. - A Slack workspace with a bot that can post to your security channel. - The name of the Slack channel where the briefing should be posted. ## Prompt Every Monday at 8:00am, run an automated breach exposure audit for our company and post a plain-language security briefing to our security channel in Slack. Use a cron trigger for the Monday 8am schedule. First, call Have I Been Pwned's Get Breached Email Addresses for a Domain against our verified company domain. This returns every breached employee alias on the domain together with the breaches each alias appears in. Our domain must be verified and subscribed in the Have I Been Pwned dashboard for this search to return data. If Have I Been Pwned responds with a 404 and an empty body, treat that as 'no exposure found', not as an error. For the notable breaches in those results (the recurring ones and anything that looks serious), enrich them with Get a Single Breach to pull each breach's full details: what happened, when it was added, how many accounts it affected, and which data classes were exposed. Use Get All Data Classes to translate the raw data-class labels into readable descriptions, so the briefing can explain in plain words what kind of information leaked, for example email addresses, passwords, physical addresses, or payment details. Group all findings by employee. Skip any employee who has no breaches; only include people who actually appear in a breach. Rank the affected employees by severity, most exposed first. Flag as high priority any breach that leaked passwords or financial or payment data, since those carry the most immediate risk. Remember which employees and breaches you reported on each run. On every new run, compare against the previous week's record and clearly call out any accounts or breaches that are newly exposed since the last briefing, so the reader instantly sees what changed this week. Deliver the summary to our security channel using Slack Bot's Send a Message operation (use the slackbot integration, not the plain Slack one). Write for a non-technical manager: open with a short headline giving how many employees are affected and how many are newly exposed this week, then a ranked list grouped by employee, each with a one-line plain explanation of what was exposed and a simple recommended action such as resetting a password or turning on two-factor authentication. Avoid technical jargon. If the domain comes back clean, still post a brief all-clear so the team knows the check ran. ## How to customize - Change the schedule, for example run it daily or on a different morning. - Point the briefing at a different Slack channel or send it as a direct message. - Adjust what counts as high priority, such as always flagging breaches that leaked passwords or payment data. ## Example output Weekly Breach Exposure Briefing (Monday) 3 employees affected, 1 newly exposed this week. 1. jane@company.com (HIGH): appeared in the LinkedIn breach. Exposed: email addresses and passwords. Action: reset her password and turn on two-factor authentication. 2. sam@company.com (HIGH, NEW): appeared in a retailer breach that leaked payment card details. Action: alert Sam and watch for unusual charges. 3. alex@company.com (LOW): appeared in a marketing-list breach. Exposed: email address only. No urgent action needed. Employees with no breaches were skipped. Nothing else changed since last week. ## FAQ ### Do I need a paid Have I Been Pwned account? Yes. Whole-domain searches require a Have I Been Pwned subscription, and your company domain has to be verified in their dashboard before it will return results. ### What happens if no one on my domain was breached? You still get a short all-clear message in Slack so you know the check ran and nothing new turned up. ### Will it tell me if something new happened this week? Yes. The briefing highlights any employee accounts or breaches that are newly exposed since the previous week's run. ### Is the briefing readable for a non-technical manager? Yes. It is written in plain language, grouped by employee, and includes simple recommended actions like resetting a password or turning on two-factor authentication. ### Can I change when it runs or where it posts? Absolutely. You can adjust the schedule and choose which Slack channel or person receives the briefing. Use this prompt in General Input: https://www.generalinput.com/prompts/monday-morning-employee-breach-exposure-briefing-in-slack