What Dark Web Monitoring Is
Written by MSP Outpost.
In Short
Dark web monitoring searches leaked credential dumps, breach data and criminal marketplaces for a client's email addresses and domains, and alerts you when one turns up. It tells you a password is already out there. It does not stop an attack the way MFA or endpoint protection does, so its value is in the reset it triggers and the conversation it starts.
What It Does
- Domain monitoring. Watches every address on a client's domains and reports new exposures.
- Alerts. Notifies you when an address appears in a new breach or dump.
- Exposure detail. Shows whether a record held a password, a hash or only the address.
- Prospect scans. A one-off scan of a prospect's domain to open a security conversation.
- Client reports. A summary of what was found and what was done about it.
- Ticketing. Sends findings to the PSA so each one gets a reset and an owner.
When You Need One
Useful mainly as a sales tool, because a scan of a prospect's domain is a concrete way to open a security conversation. Paying for continuous monitoring across every client can wait.
Worth adding to a security bundle, so a leaked credential triggers a password reset and a check that MFA is on. Route alerts into the PSA, or they will be ignored.
It becomes one feed among several in a security service. Judge it on how fresh the data is, how it handles repeat findings and how well it fits your other security tools, rather than on the size of its database.
What to Look For
Must Have
- Per-Client Domain Monitoring
- Alert to Ticket
- Source and Date Shown
- Password Exposure Detail
- Prospect Scans
Worth Having
- Client-Facing Reports
- Repeat Finding Suppression
- Personal Address Monitoring
- Security Bundle Pricing
- An Open API
How It Is Priced
Pricing is usually by quote, often per domain monitored or included in a wider security suite, and some charge by usage such as the number of lookups. Watch for limits on prospect scans, extra charges for more domains per client, and annual terms on a tool whose value you should test first.
Switching
Switching is easy: there is little data to move, and you can run two tools side by side for a month and compare what they find. The work is in the processes, such as alert routing, client reports and any sales material built around the old tool. Check what happens to past findings and reports once you cancel.
Questions to Ask a Vendor
- Where does your data come from, and how soon does a new breach reach my alerts?
- Does an alert show the source, the date and what was exposed, or only that the address appeared?
- How do you avoid alerting me again about the same old breach?
- How many prospect scans are included, and can I put my own brand on the report?
- How is it priced when a client has several domains?
- Can I see the findings for a domain I own before I buy?
