Dark-web monitoring is a service that watches criminal forums and markets for a company's stolen data, such as its employees' passwords and its customers' records, and warns the company when they appear. The dark web is the part of the internet that can be reached only with special software, such as the Tor browser, which hides who is visiting. Criminals use it to buy and sell stolen data.
Most stolen passwords are not guessed. They are copied. A common route is malware called an infostealer. It is hidden inside a pirated program or a fake browser update. Once it is installed on a computer, it copies every password saved in the browser and sends the list to the attacker. The attacker then sells the list. A buyer can use a company password to log in as the employee, often without anyone noticing.
The monitoring service keeps accounts on hundreds of forums, markets and chat channels, many of them not in English. Its software collects new posts and data dumps every day. It searches them for the domain names and the brand names of the companies it protects. Analysts read the posts that match and decide which ones are genuine. Many services also watch public code websites and paste sites, where data is sometimes leaked by mistake.
Imagine an IT services company in Noida with 6,000 employees. On a Tuesday, the service finds a post on a criminal market. It offers 350 logins stolen from infected computers, and 41 of them use the company's email domain. Nine of these are passwords for the company's remote-access system. The service sends the list to the company's security team within hours. The team resets the nine passwords at once and checks that multi-factor authentication (MFA) is switched on for those accounts. It then sends the infected computers' details to the IT team for cleaning. One of them turns out to be an employee's home computer.
The findings also go to the company's threat intelligence platform, so that analysts can look for the same attacker elsewhere. Together with external attack surface management (EASM), dark-web monitoring shows the company as an attacker sees it.
Dark-web monitoring for a company is different from identity theft protection for a person. Consumer services, often sold as part of antivirus and security suites, watch the same forums for one person's email address, phone number or PAN. They warn that person, not a company.
Dark-web monitoring finds a leak after it has happened. It cannot stop the theft. Its value is speed: a password that is reset within hours is useless to the person who bought it.