Dark Web Surveillance

Our dark web monitoring combines automated scanning with analyst investigation. Automated crawlers scan over 60 dark web marketplaces and forums, 12,000+ breach databases, paste sites, and code repositories for your organisation's domain names, email addresses, and keywords. When a match is found, we extract the data, analyse it for relevance and freshness, and generate an alert. Analysts then triage the exposure — determining what data was exposed, how current it is, what attack it enables, and what remediation is needed. You receive an alert with the exposure details and a clear remediation path. The entire process from data appearing on the dark web to you receiving an alert typically takes less than 24 hours.

We monitor for several categories of exposed data. Credential leaks: employee email and password pairs from breach databases. Corporate data: internal documents, source code, intellectual property, and proprietary information posted or sold. Customer data: customer records, PII, and payment data from breaches affecting your organisation. Executive data: personal email addresses, phone numbers, and credentials of executives and VIPs. Brand impersonation: typosquatting domains, fake social media profiles, and brand spoofing. Financial data: corporate credit cards, payment credentials, and bank details. Each category is monitored continuously across all sources.

No — once data is posted on the dark web, it cannot be reliably removed. Dark web marketplaces run on Tor hidden services and encrypted channels that are hard to take down, and data is often copied and reshared across multiple sources. What we can do is detect the exposure early, alert you immediately, and guide you through remediation — resetting passwords, locking accounts, rotating credentials, and investigating the source. In the Enterprise tier, we offer takedown services, working with hosting providers and law enforcement to remove the data, but this depends on the source's cooperation and isn't guaranteed. The value is in early detection and rapid response, not removal.

Password managers like 1Password and Bitwarden check your passwords against known breach databases — they tell you if a specific password has been compromised. Dark web monitoring is broader and deeper. It monitors not just your passwords but your entire organisation's attack surface: employee email addresses, corporate documents, customer data, executive personal information, brand impersonation, and financial data. It monitors dark web marketplaces and forums where data is actively being sold, not just breach databases. And it provides analyst-led triage and remediation guidance, not just a notification. A password manager tells you a password is compromised; dark web monitoring tells you your entire organisation's exposure and what to do about it.

When an employee email and password pair appears in a breach database, the password may be current or years old. Credential freshness assessment determines whether the leaked password is still in use. We do this by checking the breach date, comparing the password against your password policy requirements, and, where possible, checking whether the password matches the current authentication pattern. If the password is old and the employee has since changed it, the risk is lower. If the password is current and still in use, the risk is critical — the account can be taken over immediately. This helps you prioritise which credential exposures require immediate action versus which can be addressed as part of normal password rotation.

Executive VIP monitoring extends dark web monitoring to the personal digital footprints of your executives and high-profile employees. This includes their personal email addresses, phone numbers, home addresses, and family member information that may be exposed in breaches. Executives are prime targets for spear-phishing, executive impersonation, and physical security threats. An attacker who knows an executive's personal email, phone number, and home address can craft highly convincing phishing emails or even plan physical attacks. VIP monitoring alerts you when executive personal data is exposed, so you can take protective action—change personal passwords, increase executive security awareness, and, in some cases, enhance physical security measures.

Brand impersonation monitoring detects when someone creates a fake version of your brand to defraud your customers, partners, or employees. This includes typosquatting domains (e.g. yourcompany-login.com instead of yourcompany.com), fake social media profiles using your logo and name, fake mobile apps in app stores, and brand spoofing in dark web marketplace listings. Attackers use these to trick users into entering credentials, making payments, or sharing sensitive data. We monitor domain registrations, social media platforms, app stores, and dark web sources for lookalike brands. When a fake is detected, we alert you with the details and, in the Enterprise tier, can assist with takedown requests to the hosting provider or platform.

The time from data appearing on the dark web to you receiving an alert depends on the source and the service tier. For major publicly dumped breach databases, detection is typically within hours. For data posted on dark web marketplaces and forums, our automated crawlers detect new posts within 24 hours. For data shared on encrypted messaging channels (Telegram, Discord), detection may take up to 48 hours as these require analyst access. The Standard tier includes 24-hour alerting. The Managed and Enterprise tiers include analyst-led triage, which adds context and remediation guidance before the alert is sent — typically within 24 to 48 hours of detection. In all cases, the goal is to alert you before attackers can use the data.

Yes. Dark web monitoring supports several compliance frameworks. GDPR Article 33 requires organisations to assess the risk of a personal data breach — dark web monitoring provides evidence of whether breached data has appeared on the dark web, which informs the risk assessment and notification decision. PCI DSS Requirement 12.10.1 requires monitoring for compromised credentials — dark web monitoring directly satisfies this. HIPAA Security Rule requires monitoring for PHI exposure — dark web monitoring detects if patient data appears on illicit marketplaces. SOC 2 CC7.2 requires monitoring for security events — dark web exposure is a security event. Our reporting maps dark web monitoring activity to these framework requirements for audit purposes.