Cybersecurity
Do You Really Need Dark Web Monitoring?
Most business credentials found on the dark web come from third-party breaches, password reuse, and infostealer malware. Learn what dark web monitoring can and cannot do for your business, and what to do when an alert arrives.
The dark web is the part of the internet that ordinary search engines do not index and that requires special software, such as the Tor browser, to reach. Much of it is used for legitimate privacy reasons. It also hosts criminal marketplaces and forums where stolen data is bought, sold, and traded. For a business, the most common thing found there is not credit card numbers. It is employees' work email addresses and passwords.
Dark web monitoring is a service that watches for that exposure and tells you when it happens. Whether you need it depends on what you will do with the alerts.
How Company Credentials End Up on the Dark Web
Most exposed business credentials do not come from a breach of your own systems. They come from somewhere else:
- Third-party breaches:
- An employee used a work email address to sign up for a vendor portal, a webinar platform, or a shopping site that was later breached.
- Password reuse:
- The same employee used their work password, or a close variation of it, on that outside site.
- Infostealer malware:
- Malware on a work or personal device captured saved passwords and browser session cookies and sent them to a criminal, who packaged them into a "log" for sale.
- Phishing:
- An employee entered credentials on a fake sign-in page.
Once those credentials are posted or sold, attackers use them to try your email, Microsoft 365, VPN, and other systems.
What a Business Monitoring Service Does
A business dark web monitoring service collects breach data from criminal marketplaces, forums, paste sites, and infostealer logs. It matches that data against your company's email domains and alerts you when a match appears. Better services tell you where the data came from, when it was seen, and whether a password or session cookie was included.
It also has limits that are worth stating plainly. No service sees the whole dark web. Alerts arrive after the data has already been exposed, sometimes weeks or months later. And no service can remove data once it is circulating, because it is copied and resold too quickly. Monitoring is an early warning, not a shield.
Do You Need It?
For most businesses, some form of credential exposure monitoring is worthwhile, because it turns an invisible risk into a specific task: this person's password must be changed today. The value comes entirely from acting on the alerts. There are several ways to get it:
- Free domain search:
- Have I Been Pwned lets a domain owner see which addresses on the domain appear in known breaches, and its free tier covers domains with up to 10 breached addresses.
- Microsoft Entra ID Protection:
- Available with Microsoft Entra ID P2 licensing, it can flag accounts whose credentials appear in leaks and require a secure password reset automatically.
- Managed monitoring:
- A commercial service, often delivered by your IT provider, that covers more sources, including infostealer logs, and routes alerts into an incident process.
What to Do When an Alert Arrives
Reset the affected password, and any other account where the same password was used. Sign the user out of all sessions, because a stolen session cookie can bypass a password change. Confirm that multi-factor authentication is enabled and that no unfamiliar methods or mailbox forwarding rules were added. If the source was infostealer malware, investigate and clean the device before the user signs in again. Then ask why the exposure happened and close that gap.
Controls That Reduce the Need for Alerts
Monitoring works best alongside the controls that make exposed passwords less useful:
- Require multi-factor authentication on every account, and prefer phishing-resistant methods such as passkeys or FIDO2 security keys.
- Give every employee a business password manager so that no password is reused.
- Block known compromised and easily guessed passwords at the directory level.
- Run endpoint detection and response on every device to catch infostealer malware.
- Train employees not to use work email addresses for personal sign-ups.
Get Help Monitoring for Exposed Credentials
Cyber One Solutions helps businesses in Texas and Tennessee monitor for exposed company credentials and respond quickly when they appear, as part of a broader identity and endpoint security program. Learn more about our managed cybersecurity services or contact us to see what is already exposed for your domain.