Table of Contents
Everything you post is an invitation to look deeper. The real question is who exploits it.
Your child is a talented artist; their portfolio is full of paintings of nature, the family dog, scenic views, all seemingly innocent. One of those views is from inside your house, looking out into the backyard, the same backyard that has seen every one of your children’s birthdays. That painting is part of their online portfolio, and they titled it with a street number and street name. Goldmine.
What Your Platforms Already Know
LinkedIn is one of the most underestimated sources of exposed identity data I work with, and threat actors know it too. Privacy settings aren’t on by default; that wouldn’t be very social media of it. I see you commented “so proud of the mother, wife, and CISO you are.” I now know your spouse’s name and employer, which narrows the geographic region considerably, plus confirmation that you have children. There’s also a “Contact Info” button on every LinkedIn profile, and personal phone numbers, emails, blogs, and even birthdates are often sitting there, fully visible to anyone who checks. The data is there; most people haven’t audited it.
Social media platforms are built around a growth model, and growth depends on data visibility. That’s why privacy settings are buried three menus deep, default to opt-out rather than opt-in, and are never surfaced at account creation. This is growth hacking at the product level: every design decision optimized around engagement and acquisition, because a locked-down account generates less data and less revenue than an open one. There’s no business incentive to route you toward tighter settings. So most accounts stay exposed by default, and most users never change them.
Venmo and Cash App are less obvious vectors. Both platforms let you search for someone by phone number, and Venmo’s notes feature makes every transaction detail public by default, whether the user knows it or not. Last Tuesday I saw you paid your dog groomer and wrote your phone number and email in the transaction note so she could reach you. Now I have your contact information, your friends list including siblings, and a detailed picture of your weekly routine. I wonder if that sourdough you get at the farmers market every Saturday is really that good.
Private Instagram pages are a reasonable precaution, but when Threads launched, Meta didn’t carry Instagram’s privacy restrictions over to the linked account. Threads posts and follower lists were public by default regardless of what you’d set on Instagram. That’s a product decision.
Your Network is Your Attack Surface
From there, the analysis moves outward to your broader network: family members’ accounts, their post histories, whether they tag you, what they’re sharing publicly. One example that absolutely shook me to my core was a grandmother posting her grandchildren’s graduation pictures publicly. In those photos I could clearly see the graduating class pamphlet, and from that single image I had the school name, approximate grade level, and a narrow age range for the kids. Your digital footprint isn’t just yours. Everyone close to you is part of your attack surface.
When Scraps Become a Dossier
No single piece of information here is particularly sensitive. A painting titled after a street address, a LinkedIn comment, a Venmo transaction note, a graduation photo. Each one is trivial. But combined, they produce a home address, an employer, family member identities, daily routines, and a social network that extends well beyond you. This is the aggregation problem, and it’s why no single post needs to be obviously sensitive to matter. What matters is what the full picture looks like once someone starts pulling it together.
Before you hit post, shift your perspective to that of a threat actor and think through what they could do with what you’re about to share. Would they consider it their goldmine moment? Eyes are everywhere. It just depends on what you allow them to see.
VanishID is building a solution to this problem with AI Exploitability Management, a new capability that scores how exposed your footprint really is to an AI-powered threat actor. Book a demo.
