IT glossary
Dark web monitoring
Dark web monitoring searches leaked and stolen data for your company's email addresses and passwords, and tells you when one turns up in a breach dump.
Most of what it searches is not mysterious. It is the accumulated contents of past breaches at other companies: a fitness app, a retailer, a forum somebody signed up to in 2016 with their work email and a password they still use. Those datasets get traded, combined and republished. The service checks whether your domain appears in them.
Why it matters to you
It is genuinely useful for one narrow thing: telling you that a specific work email and password combination is now public, so that password can be changed and that account can be checked. Reused passwords are the reason a breach at an unrelated company becomes your problem, and this is the only control that will tell you it has happened.
Where it is oversold
Two things get promised that nobody can deliver.
The first is removal. Once data is out, it is out. It has been copied, mirrored and folded into other datasets. Any service suggesting it can take your information down is describing something that does not exist. What it can do is tell you, so you can act.
The second is prevention. This is a detection control, and a lagging one. The exposure has already happened by the time you hear about it, sometimes years earlier.
Be honest about the ranking
If you have a fixed budget and are choosing between controls, dark web monitoring is not near the top. Multi-factor authentication, monitored endpoints, patching and a tested backup all do more, and MFA in particular reduces the impact of exactly the problem dark web monitoring reports on, because a leaked password stops being enough on its own.
It is a sensible addition once those are in place. It is a poor substitute for them, and it is sold as a headline product far more often than its value justifies.
What to check if you buy it
Whether alerts are triaged by a person or forwarded raw, since old and duplicate findings are common. Whether it covers your whole domain or a list of named executives. And what the provider does when something is found, a report you have to act on yourself is worth much less than a call and a password reset already in progress.