Guide · Dark web
Dark-web monitoring: what to watch, and what to ignore
“Monitoring the dark web” means nothing until you define what you are looking for. This guide gives the six families of assets to declare and the sources that matter for each. “Monitoring the dark web” means nothing until you define what you are looking for. This guide gives the six families of assets to declare, the sources that matter for each, and what is better left unmonitored so you do not drown.
- Guide
- Guide
- Steps
- 6 ·9 min read
- Published
- Last updated
In one sentence
Useful dark-web monitoring for a company looks at six things: its domains and addresses in leaks, its brands and keywords on forums and marketplaces, its executives, its suppliers on leak sites, its data and documents, and access to its systems being sold.
The “dark web” strictly means anonymisation networks. In practice, what matters to an organisation also circulates on forums reachable with a simple account, instant-messaging channels, specialised marketplaces, file repositories and ransomware groups’ leak blogs. Serious monitoring covers that whole set, not a single network.
The volume is enormous and almost all of it is unrelated to you. The value of monitoring therefore rests on two things: a precisely declared perimeter, and qualification that discards the noise before the alert reaches you.
Steps
The six families to watch
- 01
Your domains and addresses
Every domain you own, including old brands and subsidiaries, to spot the credentials tied to it in breaches, combolists and information-stealer logs. It is the most productive family: start with it.
- 02
Your brands and keywords
The company name, its products, its internal abbreviations, the names of your applications. On forums and marketplaces, that is how access to your systems is described when it is sold, often without naming your domain.
Choose discriminating keywords: a name that is too common generates noise nobody will read.
- 03
Your executives
Name, work addresses and, once the person has accepted the invitation, personal addresses and identifiers. Doxing attempts, fake profiles and impersonation target specific people, and are prepared where they are named.
- 04
Your suppliers
Ransomware groups’ leak sites announce their victims. If a supplier holding your data appears there, you need to know the same day, not when its notification arrives.
- 05
Your data and documents
Customer databases, internal documents, source code, and your customers’ payment cards if you issue any, recognised by your BINs: their sale or publication is spotted through your brands, file names and formats. This family needs checking before you act: a published sample does not always prove what it claims.
- 06
Access to your systems
Initial access brokers sell VPN, RDP or administrator access described by sector, country, revenue and type of access. An analyst who knows your perimeter recognises a listing that concerns you where a keyword is not enough.
What is better left unmonitored
Generic keywords of your sector, the names of your competitors, leaks containing none of your assets, “your sector is targeted” alerts: all of that produces notifications nobody handles. Monitoring that sends a lot is monitoring that ends up ignored.
A good perimeter is short, precise and reviewed every quarter. Better to watch twenty assets that matter than two hundred that make noise.
Why raw alerts are useless without qualification
A raw mention says a word appeared somewhere. It does not say whether the author is credible, whether the data is recent, whether it really concerns you, nor what to do. Qualification, by an analyst who reads the source, checks the date, cross-references with your assets and writes the action, is what turns a mention into a decision.
Frequently asked questions
Should we access criminal forums ourselves?
We advise against it: restricted access, legal and security risks, exposure of your own addresses. Delegate collection to a provider that frames it, and keep the decision.
Does dark-web monitoring prevent attacks?
No. It gives you lead time to revoke an access, remove a domain, warn a person or a partner. Prevention stays in your hands.
What happens when nothing is found?
It is good news, and information in itself: it is dated and appears in the monthly report. Serious monitoring has empty weeks.
A short perimeter, a check before acting
The scoping of an exposure assessment serves first to decide what should not be monitored.
Bespoke offering: one price per service, no public price, no packages.