INTReputation and intelligence

Executives’ digital exposure: what the internet reveals about the people in charge and how to reduce it

Public registers, professional profiles, interviews, holiday photos, old data breaches: the internet says a lot about the people who run a company. What open sources reveal, why it matters and how to reduce the risk without disappearing.

Strategic editorial team 28 October 2026 8 min read

Cover: “The people in charge, as the internet sees them”, Reputation and intelligence

The internet says more about the people who run a company than you might think. Directorships and shareholdings appear in public registers. Careers and contacts are on professional profiles. Voices and faces feature in interviews and at conferences. Habits and places show up in their own photos and in those of their families. Email addresses surface in old data breaches. Put together, this information makes scam messages more credible, identity theft easier and attacks on the company more targeted. Executives’ digital exposure can be reduced with a method. It starts with a map of what is public, drawn up with the person’s consent and from open sources only. Then comes the removal of what serves no purpose, simple rules for what remains and periodic checks. The aim is not to vanish from the internet, but to decide what stays there.

Why does an executive’s exposure concern the company?

Because many attacks begin with a message. In the 2025 report of ENISA, the European Union Agency for Cybersecurity, phishing in its various forms, including deceptive phone calls, is the most common way in, at around 60% of the cases observed. The UK’s National Cyber Security Centre warns that criminals use a person’s digital footprint, meaning all the information about them online, to steal their identity or to make their messages more convincing.

Executives are especially rewarding targets. They can authorise payments and access, they are recognisable, and their name carries weight with staff. Information about them helps an attacker write to a supplier in the right tone, set up a fake profile in their name, predict when they will be travelling and out of reach, and prepare pressure in a negotiation or a campaign against their reputation. Interviews and videos also supply voice and image samples, which an impersonation can start from.

What can usually be found about executives?

Source	What it exposes	Why it matters
Companies register and public filings	Directorships, shareholders, stakes in other companies	A map of interests and relationships, useful to anyone preparing plausible requests
Company website, press releases, organisation charts	Names, roles, email address format	Makes it possible to guess addresses and write to the right office
Professional profiles	Career, colleagues, suppliers, events	A basis for fake recruiters and friendly approaches
Interviews, conferences, podcasts	Voice, face, projects, opinions	Material for impersonations and credible messages
Personal and family profiles	Home, schools, holidays in progress, sports	Physical security, predictable absences, answers to security questions
Past data breaches	Exposed email addresses and passwords	Access to accounts where passwords are reused
Articles, forums, reviews	Past events, opinions	Hooks for reputation campaigns

Some of this information is public by law. The visura camerale, for example, the company extract from the Italian companies register, lists directors, statutory auditors, holders of other offices and shareholders. It cannot be removed, but you can know that it is there.

There is also a limit that applies to everything. In 2022 the Court of Justice of the European Union declared invalid the provision that made data on companies’ beneficial owners accessible to anyone. The Court observed that once data has been made available to the public, it can be not only consulted but also stored and disseminated. What has been published once may live on in copies that nobody controls. That is why prevention matters more than removal.

How do you measure exposure without investigating people?

With a tight scope, written down before you start:

Only those who ask for it or agree to it. The map covers the executives who give their consent and cooperate, providing the names, addresses and profiles to start from.
Only open, lawful sources. You look at what anyone can find. There is no access to private profiles, no pretexting and no contact with third parties. In Italy, gathering information on behalf of private parties requires a licence from the prefect, the central government’s local representative, under Article 134 of the TULPS, Italy’s consolidated public security law. The exposure map is not an investigation and must not be turned into one.
Family members are not analysed. If open sources reveal content of theirs that exposes the executive, it is flagged to the executive, who decides with the family.
Data is kept to a minimum. The map is itself a processing of personal data. It needs a legal basis, a privacy notice, few recipients and deletion at the end of the work, with the data protection officer involved if one has been appointed.

The outcome is not a file on the person but a list of actions. Every item found goes into one of three columns: remove, manage, keep watching.

How do you reduce the risk?

Remove what serves no purpose. This means mobile numbers in old directories, home addresses, copies of documents and personal email addresses. You ask the sites that publish them to take them down and, where the conditions are met, you exercise the right to erasure under Article 17 of the GDPR. For search engines there is the right to delisting, meaning the link no longer appears when someone searches your name. The Court of Justice recognised it in 2014, and the European Data Protection Board has clarified it in its guidelines. Where available, Google offers a tool called “Results about you” to find phone numbers, home addresses and email addresses in its results and request their removal. It also has forms for document numbers, bank details, signatures and login credentials. But these only remove search results. The content stays on the site until whoever published it deletes it.

Protect the accounts. Turn on two-step verification on every account, personal ones included. Use a different password for every service and recovery addresses that are not public, and keep personal accounts separate from work ones. If an address appears in known breaches, change the related passwords at once. A reused password, as in the story of the digital decorator, opens more doors than you would think.

Set rules for what remains. Trips and absences are posted afterwards, not while they are happening. Photos do not show addresses, number plates or badges. Professional profiles do not list suppliers or the systems in use. Conference slides do not contain organisation charts with direct contact details. The company website publishes roles and department mailboxes, not executives’ mobile numbers.

Make impersonation useless. No request for a payment or a change of bank details is carried out without verification through a second channel that is already known, whoever the sender appears to be. Staff and key suppliers know which channels the leadership never uses to request confidential transactions.

Keep watch. Fake profiles in executives’ names are reported to the platforms, with the evidence preserved. The Digital Services Act requires hosting services to have mechanisms for reporting illegal content. If content is defamatory or a news story is wrong, lawyers come into play and, for the press, so does a request for correction. The map is repeated once a year and at the time of appointments, extraordinary transactions or periods of high exposure.

A typical scenario. An industrial group is about to announce its new chief executive. Before the announcement, with the new chief executive’s consent, the map is drawn up. Their mobile number appears in the public list of a sports club, their personal email address in two known data breaches and their home in some photos posted by a family member. The removal of the number is requested, the passwords are changed, two-step verification is turned on and the family agrees on what to leave visible. In the week of the announcement, a fake profile with the executive’s photo appears and writes to some suppliers about a “confidential” transaction. The suppliers had been warned. Nobody replies, and the profile is reported to the platform with the evidence collected.

Who looks after it in the company?

Nobody can do it alone. Management decides the scope and who is included. Cybersecurity and IT look after accounts and verification. Communications manages interviews and public appearances. Legal and the data protection officer take care of removals and legal bases. Executive assistants keep diaries and travel plans safe. And then there is the executive, the only person who can change their own habits. When exposure turns into an open crisis, the rules for the first hours of a reputation crisis apply.

In brief

Registers, profiles, interviews, photos and old breaches add up to a portrait of the people in charge that anyone can piece together.
That portrait makes phishing, fake profiles and pressure more credible, and it concerns the company, not just the person.
The exposure map is drawn up with the person’s consent, from open sources only and without analysing family members.
You remove what is superfluous, protect the accounts, set rules for what remains and watch for impersonations.
What has been public once may remain in other people’s copies. Prevention is worth more than removal.

Frequently asked questions

Can an executive be made to disappear from the internet?

No, and it would not help. Positions held in public registers and true news stories of public interest stay. What you reduce is the personal data that serves no one, and you manage the rest.

Is the exposure map an investigation into the person?

No. It covers only what is publicly accessible, it is carried out with the executive’s consent and cooperation, and its purpose is to protect them. The activities that require the licence provided for by the TULPS in Italy are something else.

Does it also apply to board members?

It can, if they agree. They too appear in public registers and can be impersonated. The scope is decided with management, person by person.

Checking, with the consent of those involved, which personal information about senior executives is public for no good reason, and how to reduce it, is part of our work on online reputation and false content in Strategic’s Communication and intelligence division. We work only from open sources and together with the company’s lawyers.

Sources

Consulted on 16 September 2026.

Find out moreCommunication and intelligenceCommunication at sensitive moments, management of reputational crises and a clear reading of what public sources say about the company.