Dark-web monitoring for companies, without the theatre

Every dark-web monitoring pitch I have sat through opens with the same promise: the vendor watches the entire dark web, around the clock, and tells you the moment your company is mentioned. It is a good line for a slide. It is also not how any of this works, and the distance between the claim and the product is where the disappointment collects. Used properly, dark-web monitoring is a sensor, not a shield. Treat it as a shield and you waste money and attention at the same time.

What monitoring can actually see

Coverage comes from a finite set of places a vendor has reached and manages to stay in: credential dumps and combo lists, a rotating cast of forums and marketplaces, paste sites, Telegram channels that now carry much of what used to live on hidden services, and the leak and extortion sites ransomware crews run. Against those sources, decent monitoring does a handful of things well.

• Leaked or for-sale credentials tied to your domains, so you hear that a staff login is circulating before someone tries it.
• Company data appearing on leak sites after a breach somewhere in your supply chain.
• Ransomware-group mentions naming your organisation, occasionally before encryption has even started.
• Targeting chatter: actors discussing your systems, your executives, or a supplier you depend on.
• Exposed infrastructure and keys that quietly widen your attack surface.

What it cannot promise

"We scan the whole dark web" belongs on the same shelf as "unhackable". Nobody holds an index of it. The material is scattered across overlay networks and closed channels, the actual shape of which we set out in what is really down there, and the busiest criminal spaces are invite-only, which is exactly where automated collection cannot follow. Coverage is partial and the sources move under you. Monitoring will not stop an attack. It often surfaces a breach weeks after the fact, when the data finally turns up for sale. And a quiet dashboard is not evidence you are safe: it means nothing has shown up in the sources being watched, which is not the same thing.

Signal versus noise

Not every hit deserves a call at two in the morning. The alerts that matter point at an asset you can act on. Escalate a working credential for a live account, above all one without multi-factor authentication; your data named on an extortion site; a threat actor discussing your people, sites or systems by name. Triage calmly the ten-year-old password from a third-party breach that no longer opens anything, the domain that turns up in a billion-line combo list naming half the internet, and the "brand mention" that is really someone selling knock-off merchandise under your name. A service that cannot tell these apart, and simply forwards everything, has moved its workload onto your team and billed it back to you as coverage.

How to judge a service

Four questions separate a service worth paying for from an alert firehose.

• Source transparency. Will they tell you where a finding came from, or is it all "proprietary sources"? Provenance you cannot inspect is provenance you cannot act on.
• False-positive handling. Who tunes the noise down, and how? Ask what happens to a hit before it reaches you.
• Automation with human review. Credible services pair machine collection with an analyst who reads the consequential findings before they land in your inbox.
• Does it feed a response. An alert with no owner and no runbook is theatre. It has to plug into how your corporate security team actually resets credentials, briefs an executive, or opens a case.

Monitoring earns its place when it is wired into something that acts: a response plan, a credential-reset workflow, cybersecurity consulting that turns a finding into a fix. On its own it produces a tidy feed of things to worry about and no way to resolve them. Bought well, with the sources named, a human in the loop and alerts that reach an owner, it shortens the gap between your data leaking and you doing something about it. That is the real value, and it is worth having. Just not the force field on the slide.

Frequently asked questions