Shorten the time from credential exposure to remediation with SpyCloud

For many organizations, the first sign that workforce credentials were stolen is unauthorized access to a corporate application, not an alert from an endpoint tool. The exposure usually begins with infostealer malware on an employee’s device which harvests corporate credentials, session cookies, VPN tokens, browser autofill data, and increasingly API keys. The malware then exfiltrates them to underground markets where they are bought and reused. Even a protected device may not reliably catch the intrusion or exfiltration of data. according to SpyCloud research, 66% of infected devices had antivirus or full endpoint detection and response (EDR) installed at the time of infection. SpyCloud recaptures this exposed identity data from underground sources so security teams can reset affected credentials and invalidate stolen sessions before they are used.

According to SpyCloud’s 2026 Identity Exposure Report, the threat landscape has expanded beyond human credentials. The report found 65.7 billion distinct identity records circulating underground, a 23% increase over the prior year. It also revealed a sharp expansion in non-human identity (NHI) exposure, spanning cloud infrastructure, payment platforms, developer ecosystems, and AI services.

SpyCloud’s team recaptures exposed identity data from underground sources such as underground forums, infostealer logs, phishing kits, combo lists, and third-party breaches, making it available to help security teams respond.

In this post, you’ll learn how SpyCloud built and operates its data pipeline using Amazon Web Services (AWS) offerings and how you can use it to protect your organization.

Why subscribe to SpyCloud in AWS Marketplace

SpyCloud is a third-party provider whose pipeline uncovers hidden identity risks in your users’ exposure to infostealers. When you subscribe to SpyCloud in AWS Marketplace, you streamline procurement and consolidate billing.

Solution overview

Many people think of exposed credentials as email-and-password pairs from data breaches, but infostealers are a different problem. Malware families include names such as Redline, Raccoon, and Vidar. As of October 2026, SpyCloud reports tracking over 105 malware families. These grab passwords and exfiltrate session cookies, authentication tokens, autofill data, browser fingerprints, device identifiers, and increasingly, API keys and machine credentials.

An exposed session cookie can allow access without requiring authentication (MFA) entirely, because the unauthorized user doesn’t need to log in. An exposed API key can provide access to cloud infrastructure outside of standard login-based detection. According to SpyCloud’s 2026 Identity Exposure Report, 18.1 million API keys and tokens were recaptured in 2025 alone.

SpyCloud’s data collection pipeline sees all of this. Their products address different parts of the problem:

• Workforce Threat Protection monitors employee identities against breach and malware data
• When exposed session cookies bypass MFA, Session Identity Protection is designed to detect them so teams can invalidate exposed sessions and address MFA bypass.
• For compromised corporate devices, Endpoint Threat Protection identifies which machines were affected and pairs with EDR tools such as CrowdStrike Falcon for isolation.
• Your supply chain’s exposed credentials are your risk. Supply Chain Threat Protection monitors vendor and third-party identities for exposure.
• Cybercrime Investigations gives threat intelligence teams a search console with IDLink identity resolution, connecting fragmented identities across more than 135,000 breach sources. According to SpyCloud’s internal benchmarks, IDLink reports delivering up to 8 times more records than exact-match searches alone.

How the data pipeline works on AWS

SpyCloud’s production pipeline turns raw data into searchable intelligence, following four stages described in their public documentation:

1. Ingestion – Raw data is recaptured from infostealer malware logs, successful phishes, third-party breaches, combo lists and other underground sources. Amazon Simple Queue Service (Amazon SQS) queues decouple collection from processing. When a large breach creates a sudden flood of data, Amazon SQS helps reduce the risk of downstream systems being overwhelmed.
2. Parsing – Every breach structures its data differently, and each malware family outputs logs in its own format. Amazon Elastic Compute Cloud (Amazon EC2) instances handle heavy batch processing, and AWS Lambda functions handle event-driven transforms. SpyCloud uses large language model (LLM)-powered parsing to classify and validate identity attributes across thousands of inconsistent formats. This is part of SpyCloud’s AI Insights layer, which operates continuously across more than 65.7 billion identity artifacts.
3. Storage – Parsed records land in Amazon Simple Storage Service (Amazon S3) as the data lake and Amazon Relational Database Service (Amazon RDS) for indexed lookups. According to SpyCloud, data is encrypted at rest with Advanced Encryption Standard 256-bit (AES-256) through AWS Key Management Service (AWS KMS) and in transit with TLS 1.2+.
4. Serving – AWS Lambda powers the SpyCloud REST API, handling requests at scale behind a managed API layer. Security teams query by email, domain, IP, session cookie, API key, or device fingerprint. According to SpyCloud, the API is designed to return results in milliseconds. The same API feeds automated workflows through SpyCloud Connect, delivering data to your security information and event management (SIEM), security orchestration, automation, and response (SOAR), or ticketing system.

Security in the cloud follows the AWS Shared Responsibility Model, where AWS secures the underlying infrastructure and the customer secures what they build on it. The encryption described in this post represents how SpyCloud reports implementing its side of that model.

Example scenario

An infostealer is in on an employee’s personal laptop. The malware collects their corporate credentials, their Okta session cookie, and their browser autofill data. API keys stored in developer tools are made available through underground sources. See an example of exposed records on SpyCloud’s website or use SpyCloud’s provided demo to see your own email exposure in five minutes.

SpyCloud’s collection team collects and parses the exposed data. To help prevent unauthorized access, the pipeline parses it, identifies the corporate email domain, and matches it against the customer’s watchlist. Workforce Threat Protection flags the exposed credentials and, for customers with Okta or Active Directory integrations, can trigger an automated password reset. Session Identity Protection surfaces the exposed session cookie so the security team can invalidate it to help prevent unauthorized access. The employee gets a password reset prompt. The unauthorized session is invalidated. If exposed API keys are detected, security teams can rotate them before they’re used to access cloud infrastructure.

According to SpyCloud, nearly 50% of corporate users have encountered infostealer malware on professional or personal devices. This makes proactive identity monitoring a practical priority.

Get started

SpyCloud is available as a private offer in AWS Marketplace, so you procure it through your existing AWS account with consolidated billing. To act on SpyCloud’s data, you connect it to your existing identity provider, endpoint, or SIEM/SOAR tooling. Integration options include the REST API, prebuilt connectors for Splunk, CrowdStrike, Okta, and Microsoft Sentinel, plus SpyCloud Connect for custom automation.

Take these next steps:

1. Run a complimentary exposure check to see what has already been recaptured for your domain.
2. Subscribe to SpyCloud in AWS Marketplace for consolidated billing and simplified procurement, and contact SpyCloud for custom pricing based on your organization’s size.
3. Explore the SpyCloud API documentation to evaluate integration with your existing security stack.

Cost

SpyCloud is delivered as software as a service in AWS Marketplace, so SpyCloud operates the data pipeline and you do not deploy anything directly. You pay a subscription fee based on the duration and terms of your contract, billed to your consolidated AWS bill. SpyCloud offers a 12-month contract on its AWS Marketplace listing, and pricing scales with the number of identities you protect; for volume or committed-term pricing, you request a private offer and structure the terms with SpyCloud. As noted on the listing, additional AWS infrastructure costs may apply for services you run in your own account to consume the data, such as your SIEM or SOAR. To estimate those, use the AWS Pricing Calculator.

Cleanup

Because SpyCloud Enterprise Threat Protection is a software as a service (SaaS) product that runs in SpyCloud’s environment, there is no infrastructure in your AWS account to remove. To stop using SpyCloud, delete AWS resources you built to consume SpyCloud data, such as automation functions or log ingestion pipelines. If you bought the public 12-month contract, open the product’s ordering page in the AWS Marketplace console, choose Modify renewal, and then choose Cancel renewal. Access continues until the current contract term ends. If you connected SpyCloud to other security tools or deployed Identity Guardians, contact SpyCloud support for help removing them.

Conclusion

Many organizations face credential exposure that extends beyond passwords to session cookies, API keys, and machine identities. SpyCloud’s pipeline, built and operated using AWS services, collects identity data from underground sources and is designed to deliver intelligence to your security team quickly. SpyCloud’s pipeline uses Amazon SQS, Amazon EC2, AWS Lambda, Amazon S3, and Amazon RDS. According to SpyCloud, the pipeline processes 65.7 billion records and is designed to return results in milliseconds.

Call to Action

Subscribe to SpyCloud in AWS Marketplace to help protect your organization’s identities.

About the authors

© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.