Dark Web Monitoring

We monitor criminal marketplaces, forums, paste sites and closed messaging channels, including Telegram, for leaked credentials, documents and data tied to the domains and brands you put in scope. That means employee and customer credentials appearing in breach dumps and combination lists, internal documents offered for sale or shared for free, and impersonating domains and fake profiles trading on your name. We are equally clear about the limits. Nobody sees all of the dark web: it is a shifting set of private, invite-only and short-lived places, so we report what our sources can reach and say so, rather than claiming complete coverage. We do not buy data from criminals, we do not access your systems during monitoring, and we do not name the commercial sources we read. Discovery of what you expose on the public internet is a different service, attack surface management, which runs alongside this one.

An analyst validates the hit before it reaches you. Most raw matches are recycled: the same credential appears across dozens of aggregated lists for years, so an unfiltered feed produces alarm without information. We confirm the record is genuinely tied to your domain, work out which breach or leak it came from and whether the password is current, and discard what is stale or already reported. What you then receive is the account affected, the evidence behind the finding and specific response guidance: which passwords to reset, which tokens, API keys and session credentials to rotate, and which accounts to contain or watch while you do it. Where the exposure suggests a wider compromise, we say what else to check, and if you run SOC as a service with us the finding goes to the same analysts who watch your alerts. We do not change anything in your environment ourselves.

Sometimes, and we make the requests, but nobody can promise it. Where data, an impersonating domain or a fake profile sits with a host, registrar, platform or paste site that answers abuse reports, we prepare and submit the takedown request with the evidence it needs, and we chase it. What we will not do is tell you when, or that they will, because the decision belongs to the host and not to us, and the criminal side of the internet has no abuse desk at all. Be clear-eyed about what that means: once a credential or document has spread across mirrors, archives and private collections, it cannot be unpublished. Monitoring tells you what is exposed so you can make it worthless, which is why the response guidance matters more than the removal request. A rotated password in a leaked list is a historical record rather than a live risk.

They look at opposite sides of the same problem. Attack surface management looks outward at infrastructure: the domains, subdomains, IP ranges, cloud-exposed services and certificates you present to the public internet, and the misconfigurations on them. Dark web monitoring looks at information that has already left your control and is circulating somewhere it should not be: credentials, documents, customer data, and people passing themselves off as you. Neither finds what the other finds. An estate can be well configured and still have a finance team's passwords for sale, and a clean credential picture says nothing about the forgotten staging host nobody registered. The two also resolve differently. An exposure is fixed by changing a configuration; a leak is answered by rotation, containment and, where possible, a removal request. Clients often run both, and we deliberately kept them separate services so neither claims the other's coverage.

Either, and we decide it at scoping. Run as a managed service, collection and matching are continuous and a validated finding reaches you as soon as an analyst has confirmed it, with a report summarising each period. Run as scheduled sweeps, we search the same sources on an agreed cadence, typically monthly or quarterly, and you get a report at the end of every cycle. The choice is about how fast an exposure would hurt you and how much handling you want, not about quality: the same sources are read and the same validation is applied either way. Continuous suits organisations with large workforces, consumer logins or frequent credential reuse. Periodic sweeps suit smaller estates, and organisations that want the evidence for an audit or a board on a predictable rhythm. We state the cadence, the sources in scope and what is excluded in writing before the service starts.

Less than most services. We need the identifiers that define you: your domains and email domains, brand and product names, the executive names you want watched, and any customer-facing domains that are yours but not obvious. We need written authorisation to monitor on your behalf, and a named contact who can act on a finding at short notice, because a validated credential leak is only useful if somebody can reset an account. It helps to know which systems matter most and whether single sign-on covers them, so response guidance names the right place to rotate. We do not need access to your network, your directory or your mail, and monitoring does not touch your systems. Scoping usually takes a call and a written scope; the first sweep follows, and the first report is the most crowded one you will get, because it covers everything already circulating.