Reviewing your organization’s social media exposure

What leaks through social posts

Office photos show badges, whiteboards, screens, and visitor procedures. Job postings list exact software versions, VPN products, and cloud platforms. Celebration posts announce new systems going live. Each is useful to an attacker crafting a convincing phishing email or planning physical entry.

• Badges and access cards in photos
• Screens and whiteboards behind people
• Job ads naming products and versions
• Org charts that reveal reporting lines
• Announcements of migrations and outages

Scope it fairly

Review official company accounts, careers pages, and public posts that mention the company. Do not monitor employees’ personal accounts beyond what is publicly tied to the organization, and agree the scope with legal and HR. The goal is to fix patterns through policy and training, not to discipline individuals for one photo.

Lab: a ten-item exposure review

For an organization you are authorized to review, read the last six months of official social posts and the current job postings. Record up to ten findings with the source, what is exposed, and a recommended fix. Group them into themes such as photography, job ads, and announcements, and draft one guideline per theme.

id | source | exposure | fix
S-01 | company photo post, 2026-09 | visitor badge design visible | blur badges in photo guidelines
S-02 | job ad: network engineer | exact firewall model and VPN product | describe skills, not product versions
S-03 | IT team post | ticketing system name and URL | remove URL; general wording

Turning findings into change

Typical outcomes are a photo checklist for the communications team, job ad templates that describe skills instead of product versions, and short training that shows real anonymized examples. Recheck after a quarter to see whether the patterns changed.