Dark Web Monitoring
Stolen credentials, access and data are advertised before they are used. We watch where they are sold — read-only by design — and tell you what each finding unlocks and what to do next.
This service is in preparation: we are not yet taking on monitoring clients. Talk to us if you would like to know when it opens.
Book a ConsultationThe break-in is often for sale first
Infostealer malware takes more than passwords: it lifts session cookies and application tokens that let an attacker sign in as an authenticated user, along with the device details needed to imitate the victim. Europol’s Internet Organised Crime Threat Assessment (IOCTA) 2026 still describes infostealers as a key enabler across the whole range of cyber-attacks. Its 2025 edition describes unanalysed infostealer logs traded as a commodity, access credentials sold in bulk without verification, and initial access brokers advertising access with details of the compromised organisation.
Not every listing is real. Europol also notes that many data brokers overstate what they hold and that offerings may be fake or tied to old leaks — so the value is not in an alert, it is in knowing which findings matter. A reused work password from a years-old third-party breach, a fresh infostealer log from an employee’s laptop, and a broker selling access to your VPN need three very different responses.
The response is usually ordinary: reset, revoke, review. A 2024 CISA and MS-ISAC advisory describes an attacker who got in through a former employee’s administrator account that was not disabled when they left — credentials that had appeared in channels carrying leaked account information.
From listing to fixed, not just alerted
What we watch
Criminal forums and marketplaces, ransomware leak sites, paste sites, public channels and infostealer-log listings that can be read without an account, a purchase or any interaction — for your domains, brands and agreed executives, and for anyone advertising access to your systems.
Triage, not raw alerts
Every finding says what it is, how old it is, what it unlocks and what to do next. Listings stay labelled as claimed or advertised until you confirm them through your own systems — never presented as a confirmed breach.
Remediation that fits the finding
Password resets, session and token revocation, MFA review, device clean-up, and access and offboarding checks — plus blocklist checks on new passwords, as NIST SP 800-63B-4 requires of verifiers when passwords are set or changed.
Breach-decision support
A finding can start your breach assessment. We date-stamp the evidence and deliver it quickly, so that you and your data protection officer have what you need for your own notification decision. The decision stays yours.
Read-only by design
- We read; we don’t participate — we never buy, bargain, post, solicit or use invented personas, and we never sign in or test anything with credentials we find
- Credentials go to one place — only to the person at your organisation who controls those accounts, redacted to the minimum needed to act
- We keep evidence, not dumps — minimal, redacted indicators with short retention; sensitive personal data is not kept, and is filtered out before review, and data belonging to other organisations is set aside
- No buy-backs, no promises of removal — we will not pay for your data, and nobody can guarantee it is erased from the internet
- Illegal material is never touched — anything that may be unlawful to access or possess is never viewed, displayed, downloaded or opened; its location is reported to the appropriate hotline
- No cold pitches with your data — if we come across data belonging to an organisation that is not a client, we tell them or the authorities, with no conditions attached
Where monitoring supports what you already owe
No law requires dark web monitoring. Several frameworks expect you to understand the threats you face and act on compromised credentials — monitoring can contribute evidence toward them. Current as of October 2026.
| Framework | Instrument | How monitoring can help |
|---|---|---|
| Breach notification | GDPR Art 33 and EDPB Guidelines 9/2022 | Binding; applies since 25 May 2018. Where personal data has been compromised, controllers notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to people. EDPB guidance (March 2023) allows a short investigation, started as soon as possible, after a report from another source — so fast, dated evidence matters. Proposed, not adopted: the Digital Omnibus, COM(2025) 837, would limit notification to likely high-risk breaches and extend the deadline to 96 hours. |
| Financial services (EU) | DORA Art 13(1) | Binding; applies since 17 January 2025. Financial entities must have capabilities and staff to gather information on vulnerabilities and cyber threats (except those under the Art 16 simplified regime). Monitoring can support that capability. DORA itself never names the dark web; its threat-led penetration testing standard, Delegated Reg (EU) 2025/1190 (in force since 8 July 2025), does. |
| United Kingdom | NCSC Cyber Assessment Framework 4.0 (Aug 2025) | Guidance. Outcome A2.b asks you to understand threat actors’ capabilities, methods and techniques to inform risk decisions; at “Achieved”, C1.f has threat-intelligence feeds chosen on risk-based, threat-informed decisions. NCSC says nearly all UK cyber regulators use it. |
| Identity guideline | NIST SP 800-63B-4 (July 2025) | Verifiers shall check new passwords against a blocklist of common, expected or compromised ones, force a change on evidence of compromise, and not require periodic changes. Voluntary outside US federal agencies. |
| United States | CISA #StopRansomware Guide (Oct 2023) | Guidance. Suggests considering credential monitoring services that watch the dark web for compromised credentials, a common ransomware entry point. |
| EU digital infrastructure | NIS2 Implementing Reg (EU) 2024/2690 | Binding; in force since 7 November 2024. For in-scope DNS, TLD, cloud, data-centre, CDN, managed and managed security service, trust service and online-platform providers: risk analysis must take cyber threat intelligence into account, and credentials must be changed on suspicion of compromise. |
What you get
- Agreed watch scope — domains, brands, executives and systems, set at onboarding and reviewed with you
- Triaged findings — what was found, when, how old it is, what it unlocks, and the recommended next step, delivered to a named contact
- Monthly exposure report — trends across findings, what was remediated, and what we could and could not see
- Remediation guidance — account, session, device and access actions matched to each finding
- Breach-decision pack — dated evidence and context for your data protection officer when a finding may be notifiable
Find out what is being sold about you.
Monitoring starts with an agreed scope — your domains, your brands, and the people whose exposure matters most.
Get in Touch