A public LinkedIn profile gives an attacker an employee's name, photo and job title: everything needed to prepare a targeted, credible phishing attack. The Sonar rule "Over-exposed LinkedIn profiles" finds each employee's public profile, asks them to hide this information, then checks that it has been done. You follow the results in Sonar, without having to chase anyone.
👍 Good to know: the rule is available to all Sonar customers, whether your employees follow Cyber Missions or Karma. If you only have Awareness, the LinkedIn digital footprint course remains available, but without reminder tasks or tracking. See Your employees' LinkedIn digital footprint.
1️⃣ How the rule works
👉 1. Riot finds the profile
Using the employee's name and your company name, Riot searches for their public LinkedIn profile. The employee confirms that it is theirs, or enters their profile URL themselves if Riot found nothing. A profile is only taken into account once the employee has confirmed it.
👉 2. The employee secures their profile
They receive a single task in their next mission, taking about 5 minutes, asking them to:
show only the initial of their last name;
hide their photo from people outside their network;
hide their job details.
Each step links directly to the right LinkedIn settings page.
👉 3. Riot checks
As soon as the employee says it is done, Riot looks at their public profile. If the profile is still exposed, the case stays open and the task comes back in the next mission.
👉 4. You follow the results
The rule page lists each case with its status and shows the share of employees who have secured their profile (see section 4️⃣).
👍 Good to know: by default, the rule starts once the employee has completed the LinkedIn digital footprint course: the course explains why, the task gets them to act. You can also make it start straight away (see section 3️⃣).
2️⃣ What Riot checks
Riot checks the public version of the profile, the one anyone can see without being logged in to LinkedIn. A profile is considered secured when:
the last name only appears as an initial;
the photo is limited to the employee's network;
job details are hidden.
The task also suggests three optional settings that Riot cannot check: the visibility of the email address and phone number, the date of birth, and turning on 2FA on LinkedIn.
💡 Our recommendation: a profile that Riot cannot read (a private profile, for example) never opens a case. We still recommend keeping the profile public with the settings above: making it private hides the profile from Google and from Riot's check, but not from a scammer with a LinkedIn account.
3️⃣ Enabling and configuring the rule
💡 Prerequisites:
be logged in to hub.tryriot.com with an account that has Admin access;
have a verified domain for your workspace;
allow Sonar to send tasks to your employees, in Sonar settings.
No Google or Microsoft integration is required for this rule.
👉 Step 1: log in to hub.tryriot.com with your Admin account.
👉 Step 2: open Sonar -> Rules to see the list of rules.
👉 Step 3: click the "Over-exposed LinkedIn profiles" rule. It is turned off by default: turn it on.
👉 Step 4: adjust the settings if needed:
start: after the LinkedIn digital footprint course (default), or straight away;
closing without an answer: the number of missions without an answer before the case closes, 1, 2, 3 or 6 (2 by default);
asking again: after a refusal or if the employee has no LinkedIn account, Riot asks again 12 months later, or never.
👍 Good to know: if your employees are on Karma, the task appears in their portal at the start of the month, and the no-answer period is counted in months rather than missions.
4️⃣ Following the results
The rule page lists each case with one of these statuses:
Awaiting employee: the employee has not yet dealt with their task;
Secured: Riot's check has confirmed that the profile is secured;
Closed: the case closed without the profile being secured, for example after the employee declined or did not answer.
It also shows the share of employees who have secured their profile.
👍 Good to know: you see who is covered, who has confirmed their profile and who has secured it, but never the profile URL or its content. The task tells your employees so.
An admin cannot close a case or mark it as secured. Cases close on their own: profile confirmed as secured by Riot, refusal by the employee, or no answer after the chosen number of missions.
5️⃣ The employee experience
The employee receives a single task, in their next mission.
They can confirm the profile Riot found, or say that it is not them ("That's not me") and enter their own profile URL.
They can also answer that they don't have a LinkedIn account, or that they don't wish to share their profile. Either way, the case closes, and Riot asks again 12 months later (or never, depending on your setting).
They earn Aura points when they mark the task as done, then a bonus once Riot's check confirms that their profile is secured.
Secured profiles are checked again every 3 months. A new case only opens if the profile becomes exposed again.
6️⃣ Data kept
To find a profile, Riot uses the employee's name and your company name. To run the rule, Riot then keeps:
the profile URL;
the confirmation and check dates;
the result of the latest check.
This data is deleted when the employee is anonymised after leaving the company. For details of how data is processed, see trust.tryriot.com.
7️⃣ Frequently asked questions
👉 Does our security team see our employees' LinkedIn profiles?
No. Admins see who is covered, who has confirmed their profile and who has secured it, never the profile URL or its content.
👉 What happens if Riot finds someone else's profile?
The employee says so in their task and can enter their own profile URL. A profile only counts once the employee has confirmed it.
👉 What if an employee says they're done without changing anything?
Riot checks the profile right after. If it is still exposed, the case stays open and the task comes back in the next mission.
👉 Will my employees be chased over and over?
No. Each employee receives a single task, in their next mission. Without an answer, the case closes after 2 missions by default. Secured profiles are checked again every 3 months, and a new case only opens if the profile becomes exposed again.
👉 We were already using the Awareness LinkedIn tasks. What changes?
The LinkedIn courses stay in place. For Sonar customers, the two former LinkedIn tasks (add their profile, reduce their footprint) are replaced by this rule. If an employee has already given their profile URL in the digital footprint course, the rule reuses it.
👉 The rule is turned on, but nobody has received the task. Why?
Most often, for one of these three reasons:
Sonar is not yet allowed to send tasks to your employees (Sonar settings);
the rule is waiting for the end of the mission containing the LinkedIn digital footprint course;
the next mission has not started yet.
Key takeaways
The "Over-exposed LinkedIn profiles" rule is available to all Sonar customers, on Cyber Missions and on Karma.
Riot finds the profile, the employee secures it in a task of about 5 minutes, then Riot checks the public version of the profile.
A profile is secured when the last name is reduced to an initial, the photo is limited to the network and job details are hidden.
The rule is turned off by default and needs no Google or Microsoft integration, just a verified domain.
Admins follow the statuses and the share of secured profiles, without ever seeing the URL or content of profiles.
Cases close on their own, and secured profiles are checked again every 3 months.