Dark Web Monitoring: What It Is, What It Finds, and What to Do About It

What the Dark Web Actually Is

The term "dark web" is overloaded in vendor marketing. For security purposes it refers to a specific segment of the internet accessible only through anonymizing networks—primarily Tor (The Onion Router) and, to a lesser extent, I2P (Invisible Internet Project). Hidden services on Tor use .onion domains and are not indexed by conventional search engines.

The criminal ecosystem operating on these networks includes:

Carding forums where stolen payment card data is sold, often with BINs, zip codes, and CVVs
Credential marketplaces trading username/password combos from data breaches
Initial access brokers (IABs) who sell VPN credentials, RDP access, and compromised corporate accounts
Ransomware leak sites where groups publish stolen data to pressure victims into paying
Paste sites (both on Tor and on the clearnet, like Pastebin) where breach dumps are posted for free distribution

Legitimate dark web monitoring also covers adjacent sources: closed Telegram channels where threat actors share breach data, Russian-language forums like XSS and Exploit (partially accessible on the clearnet), and private Discord servers used by specific threat groups.

What Monitoring Services Actually Detect

Credential Exposure

The highest-volume alert type. When a breach database is published—whether via a ransomware attack on a third party you use, a breach at a business associate, or an attack on your own systems—monitoring services ingest the data and match it against your monitored domains and email addresses.

Services typically monitor:

Email addresses in the @yourdomain.com format
Variations and typosquats if configured
Hash formats (MD5, bcrypt, SHA-1) and, where the hash is cracked, plaintext passwords
Associated data: full name, phone number, IP address, date of breach

Important caveat: many credentials in breach databases are years old and may have already been addressed. Recency matters. Services like SpyCloud maintain "first seen" timestamps so you can prioritize fresh exposure.

Corporate Network Credential Exposure

A step above generic credential monitoring. Services like Recorded Future, Flare, and SpyCloud specifically look for credentials that indicate corporate VPN, SSO, or internal system access—exactly what initial access brokers sell. An alert that your company's Okta or Cisco AnyConnect credentials are listed on a broker forum is a severe, time-sensitive incident.

Payment Card Data

For companies that handle payment cards, monitoring for BIN ranges associated with your issued cards or cards processed through your platform provides early warning of skimming attacks or processor breaches. This is more relevant to banks and card issuers, but merchants can monitor for their merchant ID appearing in fraud discussions.

Intellectual Property and Source Code

Ransomware groups routinely publish partial data dumps to prove they have access and pressure victims. Monitoring for your company's internal documents, source code snippets, or proprietary data appearing on leak sites provides early warning when a breach is being threatened or has occurred.

Brand Impersonation and Phishing Infrastructure

Clearnet monitoring—technically adjacent to dark web monitoring but often bundled—watches for newly registered domains that spoof your brand, phishing kit deployments on bulletproof hosting, and social media accounts impersonating your company.

Executive Personal Data

High-value employees (C-suite, security team, finance) are disproportionately targeted. Monitoring their personal email addresses and personal identifiable information (PII) provides early warning of targeted spear-phishing preparation.

Major Monitoring Services Compared

SpyCloud

SpyCloud is primarily known for its recaptured credential database, which is particularly deep because they operate deception infrastructure (honeypots, infiltration operations) to collect breach data early—often before it is widely distributed. Their Active Directory Guardian product is specifically designed for enterprise credential monitoring with direct integration into identity providers.

Strengths: breadth of credential data, early access to fresh breaches, good enterprise integrations. Weaknesses: expensive for smaller organizations, some overlap with free HIBP data.

Recorded Future

Recorded Future is a full-spectrum threat intelligence platform that includes dark web monitoring as one module. Its strength is contextual intelligence—not just "your credentials appeared" but "these credentials are being discussed in the context of a campaign targeting your industry sector."

Strengths: analyst-grade intelligence, context around threat actors and campaigns, Fusion platform integrates with SIEMs. Weaknesses: pricing reflects enterprise positioning, steeper learning curve, can produce alert volume that requires a dedicated analyst to triage.

Flare

Flare (formerly Flare.io) focuses on the cybercriminal underground specifically and offers a user-friendly interface aimed at security teams that do not have dedicated threat intelligence analysts. It covers Telegram channels, dark web forums, paste sites, and some clearnet sources.

Strengths: accessible UI, reasonable pricing for mid-market companies, good Telegram coverage. Weaknesses: less depth than SpyCloud for credential recapture, lighter on analyst context than Recorded Future.

Intel 471

Intel 471 focuses on actor-level intelligence—understanding who the threat actors are, what they are planning, and what tools they are using. Their TITAN platform is used heavily by law enforcement and large enterprises.

Strengths: actor-level intelligence, high signal-to-noise ratio, deep underground forum coverage. Weaknesses: expensive, built for mature security programs.

Have I Been Pwned (Free Tier)

Troy Hunt's HIBP service offers free domain monitoring that emails you when addresses from your domain appear in new breaches. It does not cover criminal forums, paste sites, or IAB marketplaces, but for small organizations it is a meaningful free baseline.

Enable domain monitoring at haveibeenpwned.com/DomainSearch. You receive email notifications for each new breach that includes addresses from your domain.

Limitations of Dark Web Monitoring

Dark web monitoring is frequently oversold. Before investing heavily, understand what it cannot do:

It is reactive by default. You learn about exposure after the breach has occurred and the data has reached the criminal ecosystem. The delay between a breach occurring and data appearing on dark web markets averages 12–18 months for large corporate breaches, though ransomware groups publish data within days of an attack.

Coverage is incomplete. No service monitors everything. Private markets, escrow-based transactions, and encrypted direct sales between actors are often invisible to monitoring services.

Alert quality varies enormously. High-volume, low-context alerts burn out security teams. A service that sends you 500 alerts about 4-year-old breach data that you have already addressed is noise.

It does not prevent breaches. Monitoring tells you about exposure after it has happened. Prevention requires security controls, not intelligence.

Building an Actionable Response Program

Receiving an alert is the beginning, not the end. A response program defines what happens next.

Triage

Not all alerts are equal. Prioritize:

Fresh breach data (first seen within the last 30 days)
Credentials that include plaintext passwords (indicating weak hashing or algorithm cracking)
Credentials for corporate SSO, VPN, or privileged systems
Executive or high-privilege accounts
Volume of exposed accounts (a breach affecting 10 employees at once is higher priority than 1)

Forced Password Resets

For exposed credentials, initiate forced password resets for affected accounts. The reset notification should not mention "dark web" (users find this alarming and confusing) but should explain that their password needs to be changed as a precautionary measure.

After the reset:

Invalidate all active sessions for the account
Verify contact details (email, phone) have not been tampered with
Check for unauthorized OAuth grants or API keys created by the account

MFA Enforcement

If exposed accounts do not have MFA enabled, enforce it as part of the response. An attacker who has the old password but cannot get past MFA is stopped. An attacker who has the password and the account lacks MFA may have already gained access before your alert arrived.

IAB Alert Response

An alert that corporate access credentials are being sold by an initial access broker is a potential active compromise, not just a historical exposure. Treat it as an incident:

Immediately revoke and rotate the exposed credentials
Review authentication logs for the account in the 30–90 days prior to the alert
Check for lateral movement, new user creation, data access anomalies
Engage incident response if there is any evidence of prior access

The time window between when an IAB lists access and when a buyer uses it can be very short—hours to days for high-value targets.

Customer Data Exposure

If monitored data includes customer PII (names, emails, phone numbers) rather than just internal credentials, you may have notification obligations under GDPR, CCPA, or other applicable regulations. Work with legal counsel to determine whether the data constitutes a "personal data breach" and what notification timelines apply.

Integrating Monitoring into Your Security Operations

Dark web monitoring alerts should flow into your SIEM or ticketing system (Jira, ServiceNow, PagerDuty) rather than sitting in a vendor dashboard. This enables:

SLA tracking for response times
Correlation with other signals (login anomalies, endpoint alerts)
Historical trending (are exposures increasing? Are they concentrated in specific employee groups?)

Set up a dedicated response playbook for each alert type. A forced password reset for a breached credential should take 15 minutes, not require a meeting. A potential active compromise from an IAB alert should trigger your incident response plan immediately.

Review monitoring coverage quarterly: are you covering all relevant domains (including subsidiaries and acquisitions)? Are you covering the right executive accounts? Has the threat landscape shifted to sources your current service does not cover?

Dark web monitoring is one input into a broader threat intelligence program. Combined with vulnerability management, identity security, and endpoint protection, it helps you reduce the time between exposure and response—which is, ultimately, what determines whether a breach becomes a catastrophe or a contained incident.