SKILL / Infrastructure
Plans: AgencyBreach Pattern Analysis
Compare authorized exposure evidence across records to identify supported patterns and unresolved associations.
Read the step-by-step user guideBreach Pattern Analysis answers a question that single lookups cannot: when several identifiers, aliases or incidents appear across exposure records, which connections between them are supported by the evidence and which remain open? Investigators use it to test whether a set of email addresses and usernames belongs to one subject, to trace how an alias recurs across incidents over time, or to assess the exposure of an organization’s staff as a group. Nexus compares the records and returns the patterns as evidence-linked findings, each backed by the specific records that support it.
What you get
An assessment of patterns across exposure records, separating supported links from unresolved associations.
Using Breach Pattern Analysis in an investigation
The output draws a firm line between what the records show and what would need corroboration. Recurring username fragments, shared registration details or the same identifier appearing in incidents years apart are reported as supported patterns when the records align, and as unresolved associations when the link rests on similarity alone. Credentials remain redacted throughout. Gaps in the record set are stated explicitly, because a pattern that is invisible in the available evidence may still exist elsewhere.
Pattern findings can be added to the case graph as connections between identifier, alias and incident entities, combined with Cross-Entity Correlation and Public Username Discovery to bring public-profile evidence alongside exposure evidence, and cited in a brief or PDF case report with each supporting record attached. Breach Pattern Analysis is an Agency-plan Skill intended for teams doing sustained fraud, insider-risk and threat investigations where alias attribution has to withstand review.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“Do these four email addresses and two usernames appear to belong to the same person based on exposure records?”
Ask Nexus
“How does this alias recur across exposure incidents over time, and which links are actually supported?”
Ask Nexus
“Across the exposure records for this organization’s domain, which patterns suggest a common cause?”
How Breach Pattern Analysis fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What Breach Pattern Analysis cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries Breach Pattern Analysis states up front.
- Patterns require corroboration; they do not establish who caused an exposure or who controlled the accounts involved.
- Similar usernames or overlapping details indicate a possible association, not a verified identity, and Nexus labels them as such.
- The analysis is bounded by the records available; unresolved associations and gaps are reported rather than filled in.
Best for
Teams that reach for Breach Pattern Analysis most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What does Breach Pattern Analysis add to a Breach Exposure Search?
Breach Exposure Search reports where a single identifier appears. Breach Pattern Analysis works across several identifiers and records at once, comparing them to find recurring aliases, shared details and incidents that connect them. The result is an assessment of which links the records support and which remain unresolved, each backed by its evidence records, so an investigator can move from a list of exposures to a reasoned view of how they relate.
Can Breach Pattern Analysis confirm that two aliases are the same person?
Breach Pattern Analysis cannot confirm that two aliases are the same person on its own. Where records align across several independent details it reports a supported pattern; where the link rests on a similar username or a single shared field it reports an unresolved association. Nexus leaves the identity conclusion to the investigator, who can corroborate the pattern with public-profile evidence and Cross-Entity Correlation in the same case.
Which Nexus plan includes Breach Pattern Analysis?
Breach Pattern Analysis is one of the four Agency-only Skills in the Nexus Skill Library, alongside Cross-Entity Correlation, IP Abuse History and IP Threat Signals. Pro includes 43 of the 47 investigative Skills, and the Agency plan includes all 47. Investigators on Pro can still run Breach Exposure Search for individual identifiers and compare the results manually.
Does Breach Pattern Analysis reveal passwords or hashes?
Breach Pattern Analysis does not reveal passwords, hashes or other secrets. Nexus keeps those values redacted in every record it compares and reports only that a field was present and whether it recurs. Patterns are built from identifiers, dates, incidents and non-sensitive fields, so the case file documents exposure and association without ever holding credential material that could be misused.