If you run a company with more than a handful of employees, there is a very good chance that at least one of their work passwords is already sitting in a criminal database. That is not a scare tactic. It is the statistical reality of a world where every SaaS signup, forum account and supplier portal is another copy of an email address and, far too often, a reused password.
Dark web monitoring is the practice of finding out when that happens, before the person who bought the list does something with it.
What "the dark web" means in this context
The term covers more than Tor hidden services. For credential theft, the relevant places are:
- Breach dumps: full databases stolen from a company and sold or published, often years after the breach.
- Combolists: merged email-and-password lists compiled from many breaches and used for credential-stuffing attacks.
- Stealer logs: data captured by malware on an infected PC, including saved browser passwords, cookies and session tokens. These are the freshest and most dangerous.
- Forums, marketplaces and Telegram channels where all of the above is traded.
- Paste sites where attackers publish samples to prove a dump is real.
Monitoring these sources manually is impossible. A monitoring service does it continuously and compares what it finds against your domains.
How dark web monitoring works
- You register your domains. Everything at @yourcompany.com and its subdomains is now in scope.
- The service checks historical data. SecurityScanner.AI, for example, compares your domain against more than 15.4 billion leaked credentials from over 450,000 breach sources on the first scan. Most companies see hits immediately.
- New sources are ingested continuously. When a fresh dump or stealer log appears, it is parsed and matched within the next scan cycle.
- You receive an alert with the exposed address, the source, the date and whether the password was in cleartext.
Why cleartext matters more than anything else
Not every hit is an emergency. A password hash from a 2016 breach of a long-forgotten forum is worth a reminder email. A cleartext password captured by a stealer last week from an employee's laptop is an active incident: that password very likely still works somewhere, and the attacker also has the browser cookies that may bypass MFA entirely.
Good monitoring separates the two so your team can spend its time on the second category. See our 24-hour playbook for a leaked credential alert for what to do next.
What dark web monitoring does not do
It does not remove data from the dark web. Nobody can. It does not stop the breach at the third party that leaked your employee's password. What it does is turn an unknown exposure into a known one, so that a forced password reset and MFA enforcement happen before the login attempt, not after the ransomware note.
Who needs it
- Any company using cloud email (Microsoft 365, Google Workspace): a leaked mailbox password is a business email compromise waiting to happen.
- Companies with remote access (VPN, RDP, admin panels) protected by passwords that employees may reuse elsewhere.
- Regulated organisations: NIS2, DORA and ISO 27001 all expect you to detect credential compromise, and auditors increasingly ask how.
- MSPs who are accountable for customer security and need one dashboard across many domains.
How to choose a service
Ask five questions:
- How many sources and records are covered, and are stealer logs and Telegram included?
- Is cleartext exposure flagged separately from hashed passwords?
- How fast are alerts after a new source appears, and are scans automated?
- Does it cover subdomains and all employee addresses automatically, or do you have to list each one?
- Can findings be exported and mapped to compliance controls for audits?
Pricing matters too. Enterprise threat intelligence platforms start at tens of thousands per year. For a small or mid-sized business, a monitoring plan at under €100 per month that covers the sources above is the realistic option, and the free tier of SecurityScanner.AI dark web monitoring will show you in minutes whether your domain already has exposures.
Bottom line
Credential leaks are not a question of if. Dark web monitoring is the cheapest control you can add that directly shortens the time between a leak and your response, and it produces the evidence regulators and customers are now asking for.