Dark web monitoring has become a standard offering from security vendors, often sold as an add-on to existing products with minimal explanation of what it actually does — or does not — cover. The term creates an impression of comprehensive surveillance of criminal activity that, in practice, no product achieves. Understanding what monitoring can realistically find, and what its limits are, helps you decide whether the investment is justified and how to act on alerts when they arrive.
What the Dark Web Actually Is
The "dark web" in most monitoring contexts refers to several distinct categories of content:
- Tor hidden services (.onion sites) — websites accessible only via the Tor network, including ransomware leak sites, criminal forums, and markets
- I2P and other anonymising networks — alternative anonymising networks with their own criminal communities, though smaller than Tor
- Criminal forums on the clearnet — some criminal marketplaces operate on standard web infrastructure but require registration or invitation
- Paste sites — services like Pastebin and its successors where stolen data is frequently posted, both on the clearweb and within Tor
- Telegram channels and groups — increasingly the primary communication channel for criminal groups, IABs, and data brokers
A monitoring product that covers only Tor hidden services is missing significant criminal activity that now occurs on Telegram. A product that covers Telegram but not criminal forums is missing a different slice. Understanding what sources your monitoring vendor actually covers is the first question to ask.
What Dark Web Monitoring Can Find
Leaked Credentials
Credential leaks — email address and password combinations from third-party data breaches — are the most common and most actionable alert type. When a service your employees use is breached, their credentials frequently appear in dumps shared on criminal forums or paste sites within days or weeks.
Corporate email addresses in credential dumps are significant because employees frequently reuse passwords, and corporate credentials appearing in a dump may give attackers access to corporate systems if MFA is not enforced. Alert volume depends heavily on the size of your workforce and how many third-party services they use with corporate email addresses.
Initial Access Broker Listings
As covered in our post on how ransomware groups choose targets, IABs advertise network access for sale on criminal forums. A monitoring service with forum coverage may identify your organisation listed for sale before a ransomware affiliate purchases that access.
This is arguably the highest-value alert type — early warning of a listing gives you a window to identify and remediate the compromised access before it is exploited for ransomware. The window is measured in days to weeks, not months.
Ransomware Leak Site Mentions
Most ransomware groups operate leak sites that list victims, often with a countdown timer to data publication. Monitoring leak sites across active groups provides early warning if your organisation has been added — potentially before you are aware of the encryption event if initial discovery was delayed.
Stolen Data
Where data has been exfiltrated from your organisation — whether in connection with a known incident or not — monitoring can identify it appearing for sale or distribution. This includes customer databases, financial data, employee records, and intellectual property.
Brand and Executive Impersonation
Phishing infrastructure, domain registrations similar to your own, and impersonation of executives on criminal forums all appear in dark web monitoring with good coverage. These are often indicators of planned attacks rather than completed ones.
What Dark Web Monitoring Cannot Do
Cover Private Channels
An increasing proportion of criminal activity occurs in private Telegram channels, invitation-only forums, and encrypted messaging groups that no monitoring product has access to. If a threat actor specifically targeting your organisation is operating in private channels, monitoring will not detect it.
Guarantee Real-Time Alerting
Criminal forums have anti-scraping measures. Tor hidden services go offline and come back under different addresses. Data that appears briefly and is then deleted may not be captured. Monitoring provides coverage, not certainty.
Prevent the Breach
Monitoring is a detection and intelligence tool, not a preventive one. It tells you that your credentials have already leaked, that access to your network is already for sale, that your data has already been exfiltrated. Acting on those alerts rapidly can limit the damage, but the initial event has already occurred.
Verify Every Alert
Not every credential alert represents a current risk. A leaked password from five years ago may have been changed, the account may no longer exist, or the exposed account may not have access to corporate systems. Alert triage — understanding which alerts represent genuine current risk — requires analyst time and context, not just a dashboard.
What to Do When You Get an Alert
Leaked Corporate Credentials
- Identify the affected account(s) and immediately reset passwords
- Check whether MFA is enforced — if not, enforce it now
- Review authentication logs for the affected account for suspicious access prior to the alert
- Check whether the same password pattern appears in other corporate accounts (password auditing)
- Determine which third-party service was the source of the breach and whether that service holds other sensitive data
IAB Listing for Your Organisation
- This is a high-priority incident requiring immediate DFIR engagement
- The listing typically describes the access type (RDP, VPN credentials, domain admin) — use this to focus initial investigation
- Do not assume the listed access is no longer valid — take it seriously regardless of listing age
- Engage threat intelligence capability to assess whether the listing has been sold and to whom
Ransomware Leak Site Listing
- If you were not already aware of an incident, initiate incident response immediately
- The listing may include sample data — analyse this to understand exfiltration scope
- Begin breach notification assessment — the ICO clock may already be running
- Consider whether negotiation to suppress publication is appropriate
Is It Worth It?
Dark web monitoring at the credential alert level is a relatively low-cost, reasonable hygiene measure for any organisation with a significant employee base. The value scales with the quality of coverage (sources monitored, alerting speed) and the organisation's ability to act on alerts.
Monitoring that produces alerts and no response process is not worth the cost. Build the response playbook alongside the monitoring capability.
For organisations in high-risk sectors — legal, financial services, healthcare, defence supply chain — investing in threat intelligence capability beyond basic credential monitoring is justified. Proactive monitoring of criminal forums, IAB listings, and threat actor communication provides earlier warning and more actionable intelligence.
Binary Response provides dark web monitoring and threat intelligence services with analyst-led alert triage, not just automated dashboards. Contact us at enquiries@binary-response.com to discuss monitoring appropriate for your risk profile.