Digital Vulnerability Is Not Siloed: Why Digital Footprint Removal Is Only Part of the Answer

There is a tremendous amount of attention being paid right now to digital footprints, online privacy, data brokers, and the removal of personal information from the internet. That attention is warranted, particularly for executives, high profile individuals, and others whose positions, wealth, responsibilities, or public visibility can make them attractive targets. The problem is that we have started to define digital vulnerability too narrowly, as if finding and removing personally identifiable information from hundreds of data broker and people search sites somehow addresses the larger risk. It does not. 

Why Data Removal Alone Cannot Solve Digital Vulnerability

Data removal is valuable, and it absolutely has a place in a good digital protection strategy. If someone’s home address, telephone number, personal email address, family information, or other sensitive information can reasonably be removed from a commercial data broker or people search site, we should remove it. Hetherington Group does this work as part of our own digital vulnerability programs.

But the existence of that information on a data broker site is not really the problem. The larger problem is the enormous ecosystem of information from which those sites, and anyone else conducting open-source research, can locate.

Think about how much information about an individual can legitimately exist across the public information environment. Property ownership and tax records may be publicly available. Geographic information systems can provide additional information about a property. Depending on the jurisdiction and applicable law, voter information may be accessible. Corporate records can identify businesses, officers, addresses, and relationships. Court records, professional licenses, news articles, biographies, conference appearances, social media, photographs, old websites, archived content, family members, and professional associations can all contribute additional pieces.

Then there is information that was never intended to become public at all. Data breaches, leaked databases, compromised credentials, exposed email addresses, old usernames, forgotten accounts, and information copied or republished elsewhere add another layer.

None of these sources has to tell the whole story, by themselves.

That is the part of digital vulnerability that we believe is too often overlooked. The risk is not simply how many pieces of information exist. The risk is what someone can discover, correlate, validate, understand, infer, manipulate, and ultimately do with those pieces when they are brought together.

The Data-Broker Ecosystem and the Limits of Removal Metrics

The way personal information moves between data brokers and people search sites makes this even more complicated. Hundreds of search results do not necessarily represent hundreds of independent sources. Information is aggregated, republished, licensed, copied, and redistributed throughout an interconnected data ecosystem, sometimes creating the appearance that the same information has been independently discovered in dozens of places.

We recently saw a very good illustration of this in litigation involving the people search company Radaris. Reporting by KrebsOnSecurity in September 2026 said that documents obtained by Atlas Data Privacy during litigation connected Radaris and at least 25 other people search websites to the same underlying operation. A New Jersey court ultimately transferred 14 domain names associated with the Radaris family of companies to Atlas.

The Radaris case illustrates one of the problems with measuring digital vulnerability by simply counting the number of websites where someone’s information appears. Fifty websites displaying substantially the same address do not necessarily represent 50 different vulnerabilities. They may represent the repeated distribution of information originating from a much smaller number of sources.

The opposite can also be true. One authoritative public record combined with a handful of seemingly insignificant pieces of information from unrelated sources can create a far more consequential vulnerability.

There is another important piece of the Radaris reporting that gets much closer to the larger problem. Privacy researcher Justin Sherman pointed out that public and government records are commonly exempted from state privacy laws. These can include voting registries, property filings, marriage records, court documents, professional licenses, bankruptcy filings, and other government records.

Removing a downstream copy of information from a people search site does not necessarily remove the underlying information from the environment. The source may still exist, and another service, researcher, automated system, or individual may find it again.

This is where the endless removal cycle can become misleading. A dashboard may tell someone that hundreds of records have been discovered and that 80, 90, or even 95 percent of them have been removed. That can be useful for measuring a particular removal activity, but it does not necessarily tell us whether that person’s actual vulnerability has been reduced by 80, 90, or 95 percent. Risk does not work that way.

Removing the same home address from dozens of sites that obtained it from one another may generate dozens of successful removals. Meanwhile, one property record, corporate filing, photograph, family member’s social media account, or other authoritative source may continue to expose information that matters considerably more.

This is why the objective should not be to spend the rest of someone’s life chasing the same information as it moves from one site to another. The objective should be to understand what information matters, where it originates, how it connects with other information, what risk those connections create, and which reasonable actions can actually reduce that risk.

Digital Vulnerability as an Intelligence Problem

An address discovered in one place may not mean much by itself. Neither does a spouse’s name, an old username, a photograph, a professional biography, a property record, or a social media post. When those pieces begin to connect, however, they can establish relationships, residences, assets, routines, interests, travel, family connections, professional responsibilities, and patterns of life that no single source ever disclosed.

That is why Hetherington Group increasingly views digital vulnerability
as an intelligence problem, not simply a privacy problem.

Privacy is certainly part of it, but asking what information about someone is online only gets us so far. The more consequential question is what someone else could learn by finding, validating, and combining the information that is available, and what they could potentially do with what they learn.

AI for Investigations Accelerates Research—but Not Validation

AI for investigations is reducing the effort required to collect, organize, summarize, and correlate large amounts of information. For years, conducting meaningful open-source research required time, patience, methodology, and enough experience to recognize relationships among information that appeared disconnected. Those requirements have not disappeared, particularly when information needs to be validated and consequential decisions are being made.

A person conducting research no longer necessarily needs one database containing a complete profile of an executive or family. They can begin with fragments distributed across dozens of sources and use increasingly capable tools to help assemble those fragments into something far more useful.

This is part of what we have described at Hetherington Group as a Knowledge Ecology. Data becomes information. Information is combined with other information and becomes knowledge. That knowledge influences decisions and actions, which create additional information and continue the cycle. The information does not exist in isolation simply because it resides in different databases, systems, platforms, or parts of the internet.

Digital Resilience Requires Integrated Corporate Risk Management

The objective of digital protection therefore cannot simply be removal; it should be digital resilience. Sometimes removal is absolutely the right answer. Sometimes the better answer is changing privacy settings, correcting inaccurate information, modifying behaviors that continually recreate exposure, or monitoring information that cannot realistically be removed. For an executive or other protected individual, building that resilience may require coordination among corporate security, executive protection, threat intelligence, cybersecurity, legal counsel, communications or public relations teams, and the individual and family themselves.

This is also where the traditional boundaries between digital security and physical security begin to break down. Companies may separate privacy, cybersecurity, executive protection, fraud, and physical security into different functions, but effective corporate risk management must account for how those exposures interact. Someone intent on exploiting an executive’s information is not constrained by the organizational and functional boundaries companies use to manage risk.

A residence discovered through public records can become relevant to physical security. Family information can assist social engineering. Professional information can make impersonation more convincing. A photograph or social media post can establish location. An event announcement can establish where someone is likely to be on a particular day. Information about an executive’s interests, relationships, routines, or family can become useful to someone attempting to gain access, influence behavior, commit fraud, harass, intimidate, or cause physical harm.

The information may originate in completely different places, but the resulting vulnerability belongs to the person and the organization as a whole.

Why OSINT Training Must Evolve

That is why HG believes we have entered a different phase. Finding information is no longer the most difficult part of the problem; we are surrounded by it. The professional challenge increasingly involves determining what is accurate, validating sources, recognizing relationships, understanding what can reasonably be inferred, identifying what actually matters, and assessing the consequences that could follow. Effective OSINT training must therefore emphasize judgment, validation, and analysis—not collection alone.

What a Digital Vulnerability Program Should Deliver

A meaningful Digital Vulnerability Program should not end with a list of exposed records. It should establish what can actually be learned about an individual and their family, identify which information is consequential, determine how seemingly unrelated information can be correlated, assess what a motivated researcher could reasonably infer, distinguish meaningful exposure from informational noise, and develop practical recommendations for reducing the resulting risk.

Most importantly, the assessment should lead to action.

Understanding exposure is only part of understanding vulnerability. The next question is who might exploit that exposure, why they would do it, and what they are capable of doing with it. That requires understanding the threat environment around the individual, something I believe deserves a much deeper discussion of its own.

The work has to answer a critical question, solve a problem, or give someone what they need to make a consequential decision. That means determining what is credible, what is relevant, how the pieces fit together, and what they mean in the context of the outcome we are trying to achieve. Otherwise, we are accumulating information without producing the understanding necessary to act on it.

Why Continuous Risk Monitoring Matters

We also have to be realistic about what can actually be accomplished. There is no permanent delete button for a person’s digital footprint. People change jobs, families move, and properties are bought and sold. Organizations publish biographies and announcements. Executives attend conferences and events. New accounts are created. Children grow up and establish their own online presence with content and followers. Databases are refreshed, breaches occur, photographs are posted, and information that disappeared from one place can emerge somewhere else.

Digital Vulnerability Programs therefore must be treated as an ongoing process of assessment, mitigation, monitoring, education, and reassessment, informed by changes in both the individual’s exposure and the threat profile.

Technology is enormously valuable in that process. We use it extensively at Hetherington Group, and we automate work when automation improves speed, scale, consistency, or coverage. We remove information when removal meaningfully reduces exposure, and we monitor the information environment for changes in both exposure and potential threats.

But technology does not eliminate the need to understand what the information means.

Managing Digital Vulnerability, Not Just Data

After decades of conducting investigations, due diligence, intelligence research, and open-source research involving people, businesses, relationships, assets, activities, and risk, one lesson has remained remarkably consistent: information becomes consequential when someone understands how to use it.

Protecting people in this environment therefore requires more than finding their names on hundreds of websites and trying to make those records disappear. It requires understanding the information environment around them, identifying the exposures that actually matter, recognizing how those exposures connect, understanding who may have the interest or opportunity to exploit them, and making informed decisions about what can and should be done.

That is the difference between managing data and managing digital vulnerability.

As the amount of information available about all of us continues to grow, and the technology for finding, correlating, and interpreting that information becomes more capable, the ability to understand both exposure and threat will become increasingly important to protecting people from the risks that exist between the two.