The dark web consists of hidden pages that can only be accessed through specialist technologies and web browsers. The dark web can be used by journalists or activists who need to maintain anonymity for their safety. It can, however, also be used to protect the anonymity of individuals wishing to commit dangerous and illegal activities. In common perception, the dark web is a place where drugs, weapons, and exploitation are rife.
What does this have to do with your organization? Provided that your employees don’t have anything to do with the dark web, there shouldn’t be any problems. Right? Not exactly.
One of the commodities traded on the dark web is data. This includes compromised account credentials, credit card details, addresses, and social security numbers. You might not even know that you’ve been hacked, but your company and employee details could end up for sale.
Dark web monitoring solutions continually scan the dark web to find leaked data, fraud and impersonation attempts, planned attacks, and known exploits. By identifying this content whilst on the dark web, you can prevent it being used in an attack against your organization.
A good dark web monitoring solution should allow you wide visibility into the dark web, without venturing into it. This prevents admin users from putting themselves at risk or having to be exposed to elicit content. The solutions should flag keywords relevant to your organization. You are then able to monitor the threat as it evolves, to ensure you can respond appropriately.
There is not one single dark web monitoring solution for all use cases – some are fully automated, some require a team of experts to run, and some utilize ML and AI to provide accurate and relevant insights. In this guide, we explore some of the top dark web monitoring solutions and focus on key features, subscription options, and who they’re best suited for.
ACID is a threat intelligence and detection vendor that specializes in helping users to identify external threats and take preventative action in real time. ACID Intelligence is its surface, deep, and dark web monitoring platform that continuously surveys a range of sources (including social media, darknet sites, chat forums, messaging apps, and paste sites) using clusters of robots and AI algorithms to detect early signs of attack and hostile activity.
The platform works by monitoring surface, deep, and dark web sources 24/7/365 for any suspicious activity or breached data. When a potential threat is identified, the platform will send real-time alerts that enable teams to react efficiently and effectively to remediate the threat. A centralized dashboard also enables teams to track threats as they develop, with the platform automatically updating alerts as more data is collected. What’s great about the solution is that it’s fully automated, meaning that monitoring and alerting are carried out by the platform and require no human intervention. The service is also easy to customize, with the ability to tailor keywords to meet each organization’s specific requirements.
ACID Intelligence is a SaaS platform that comes in two subscriptions: Classic or Premium. Classic offers shared hosting with virtual application separation, whereas premium is for law enforcement agencies and government entities only and offers dedicated hardware. The platform also easily integrates with third-party SIEMs and more. We recommend ACID Intelligence for mid-sized to enterprise organizations across all sectors (including law enforcement and government) that are looking for a continuous monitoring service alongside real-time alerts.
Cobwebs Technologies is a web intelligence vendor that specializes in helping both private and government sector organizations globally to identify threats, gain attack context, prevent illegal activities, act on real-time insights, and improve response times. The Web Investigation Platform is its AI- and machine-learning-based web monitoring solution that works by automatically monitoring and extracting intelligence across surface, deep, and dark web sources, enabling in-depth investigation and situational awareness.
The Web Investigation Platform leverages AI, machine learning, and automation to continually analyze big data across the whole of the web, while enabling analysts to investigate incidents and threats from end to end within the platform. The platform also automatically generates actionable insights and alerts in real time, enabling analysts to respond to threats more efficiently and effectively. As well as automated monitoring, teams can also benefit from the ability to search and analyze data across multiple sources and streams.
Based on an advanced cloud infrastructure, the platform is flexible and scalable enough to meet an organization’s needs and requirements. Cobwebs Technologies’ Web Investigation Platform is a great choice for larger organizations operating in the private and government sectors that are looking for powerful, automated, AI- and ML-based web monitoring that comes with robust investigation capabilities built in.
CrowdStrike is a global leader in cloud-native security, specializing in powerful endpoint protection and advanced threat intelligence services. Falcon X Recon is its surface, deep, and dark web monitoring solution that sits alongside CrowdStrike’s threat intelligence products and helps organizations detect breached business and employee sensitive data, monitor fraudulent activity, and track threat actor tools and infrastructure.
Falcon X Recon offers access to breached data and raw threat intelligence across a range of sources in near-real time, including hidden pages across the surface, deep, and dark web and underground environments. This enables organizations to monitor these sources for fraudulent activity, VIP and executive impersonation, compromised data, supply chain fraud, and threat actor TTPs. Security teams can then search across both current and historical data, with results shown on easy-to-read cards that contain all relevant contextual information. Teams can also set up real-time alerts to notify them when new data is discovered, and leverage a customizable dashboard to help with investigation.
Falcon X Recon is priced based on the number of endpoints covered or by company size, and is offered in two editions: Express and Enterprise. Express is suited for SMBs, while Enterprise is suited for larger businesses and includes more wide-ranging features. Businesses can also choose to invest in Falcon X Recon+, which is its fully managed service that includes a dedicated CrowdStrike expert, alert triaging, mitigation recommendations, and a facilitated takedown service that helps to eradicate fraudulent accounts, phishing websites, and malicious posts.
The solution integrates seamlessly with third-party tools, including SIEM and SOAR solutions. We recommend CrowdStrike Falcon X Recon for businesses of all sizes that are looking for powerful dark web monitoring and near-real time alerting capabilities.
DarkOwl is a leading darknet data provider that specializes in helping businesses leverage dark web intelligence to quantify and understand threats. The DarkOwl Vision UI leverages its commercially available searchable darknet database to enable users to easily search, analyze, and monitor dark web activity relating to their business in near-real time.
The DarkOwl database is continuously updated with data from tens of thousands of darknet sites every day, including information sourced from underground marketplaces, forums, chat rooms, and networks such as Tor, I2P, ZeroNet, and Telegram. Data is collected via a combination of AI and manual processes, analyzed using DarkOwl engines, and structured according to type—enabling users to easily search across the database. Searches can also be filtered in granular detail, with users able to search across specific variables, darknet sources, and queries—and across 47 languages, too. Users can also set up “always-on” monitoring and alerts so that they’re alerted when a piece of business data appears on the darknet.
DarkOwl Vision UI is a powerful and easy-to-use research tool for dark web monitoring and is widely used not only by security professionals and researchers, but by law enforcement agencies, too. This platform does not, however, have a reporting capability. We recommend Vision UI for mid-sized organizations and enterprises that are looking for the ability to search and monitor the darknet across a range of sources, and that have the resources available to devote to supporting the product.
Digital Shadows is a leading digital risk protection vendor that specializes in threat intelligence, brand protection, and data exposure. The company was acquired by Tampa based ReliaQuest in 2022. Included as part of the SearchLight managed service—which helps customers to manage digital risk and reduce their attack surface—the platform’s dark web scanning capability provides organizations with in-depth visibility across a wide range of sources and insight into looming risks.
The solution works by continuously monitoring a range of dark web sources—including closed forums across multiple languages, underground marketplaces, Tor, I2P pages, and paste sites—for exposed credentials and data, intellectual property, fraudulent services, VIP and executive threats, and attack plans. If any of these are identified, an alert can be sent to notify affected organizations. The solution’s threat intelligence is not only supported by its external-facing Photon Research team (which provides intelligence reports, threat assessments, and risk-based scoring for alerts), but also access to the Digital Shadows threat intelligence library, historical archive of dark web data, and multiple threat feeds. For admins, reporting is made easy with customizable reporting templates and drag-and-drop functionality.
Digital Shadows offers three packages for its SearchLight platform: Essentials, Extend, and Elevate. All three come with dark web monitoring included, but the different packages come with various additional services. Current users appreciate the platform’s ease of use, responsiveness, alert filtering, and in-depth intelligence, but some note that its reporting capabilities could be improved. We recommend Digital Shadows SearchLight for SMBs that are looking for powerful dark web monitoring alongside threat intelligence and risk protection services.
DigitalStakeout is a risk mitigation vendor that focuses on helping organizations reduce digital risk and increase resilience by leveraging surface, deep, and dark web data. Scout is its dark web monitoring solution that leverages automation to collate billions of data points across a range of sources and provide real-time visibility of risks, emerging threats, and breached data.
Scout works by continuously monitoring not only the dark web (including breached data and cybercriminal chatter on underground forums, marketplaces, paste sites, and applications) but also the surface and deep web, social media, public news sites, blogs, and others. The data can then be automatically structured and labeled to provide additional context and enrich alerts. The platform also boasts a 15-second event-to-alert latency, meaning any discovered breached data is flagged near-immediately, and organizations can also have full control over what triggers an alert. Finally, the platform comes with more than 50 dashboard views to enable teams to investigate and analyze insights and alerts, and search across data.
The Scout solution is currently offered in five pricing tiers—starting at $2,395 per month for its most cost-effective solution and $30,000 per month for its most feature-rich solution. Users praise the platform for its powerful dark web monitoring capabilities, real-time intelligence, and automated alerts. We recommend DigitalStakeout Scout for mid-size and enterprise businesses across all industries (including public sector) that are seeking a strong dark web monitoring solution that delivers near-real-time, customizable alerts when breached data is discovered.
Echosec Systems is a leading data discovery and intelligence vendor that helps security teams to leverage relevant, contextual data to stay ahead of emerging threats. The Echosec Systems Platform is an open-source, SaaS product that enables teams to monitor the security of their digital assets across a range of surface, deep, and dark web environments, as well as social media, and access threat data in real time. In August 2022, Echosec Systems was acquired by cyber threat intelligence provider Flashpoint.
The Echosec Systems Platform works by monitoring thousands of data sources every second, searching for threat indicators like actor groups and motives, vulnerabilities, breached data, etc., then classifying the threat potential of each alert using machine learning models. The platform can also monitor these using image, keyword, and location filters to tailor results to an organization’s specific needs. The platform offers three dashboard views: Echosec, Beacon, and Risk Portal. The Echosec view enables admins to search across social media sites, blogs, news, and forums. Beacon enables them to search across underground communities, dark web marketplaces, and messaging apps. Risk Portal view enables them to track the security of digital assets in real time.
The Echosec Systems Platform is priced based on team size and requirements. Users praise the platform’s intuitive interface, fast search results, in-depth data, and effectiveness. Any reported issues are resolved swiftly and seamlessly by the vendor. We recommend Echosec Systems Platform for SMBs across all industries that are looking for dark web monitoring across a wide range of sources and powerful filtering capabilities.
Recorded Future is a leading threat intelligence vendor that combines automated, AI-powered data collection with human expertise that allows organizations to better identify and remediate threats. The Recorded Future Intelligence Platform is its powerful open-source intelligence product that’s comprised of multiple modules and add-ons to enable organizations comprehensive, real-time monitoring across their external threat landscapes.
The Intelligence Platform works by automatically collecting data across hundreds of surface, deep, and dark web sources—including Tor webpages, forums, paste sites, and IRC channels. The platform then alerts organizations in real-time when information (such as stolen credentials, sensitive proprietary data, exploit chatter, and brand mentions) surfaces on one of these sources. This data is then enriched by Insikt Group (a team of researchers and analysts that can extract information directly from underground communities), as well as ML and NLP, which helps organizations to identify and prioritize the most relevant threats.
The Recorded Future Intelligence Platform is highly customizable in terms of pricing and packaging, as the solution is built on several modules and add-ons. The platform also supports seamless integrations with hundreds of third-party tools, such as major SIEM and SOAR providers. Current customers particularly praise the platform for its high-quality intelligence, intuitive interface, and wide range of data sources—but some experienced a learning curve on initial use. We recommend the solution for larger enterprises that are seeking in-depth, high-quality, and automated dark web monitoring and intelligence enhanced by a powerful team of analysts and researchers.
SpyCloud is a cybersecurity vendor that offers a range of solutions to protect customers against account takeover, ransomware, malware, and online fraud. ATO Prevention is its solution that’s designed specifically to protect organizations against account takeover, and includes dark web monitoring as part of the service. This enables businesses to search across “recaptured” data (essentially, breached data that’s been discovered on the dark web, malware-infected devices, and other sources) to discover and continuously monitor for leaked information.
The platform leverages a combination of automated scanning and human intelligence (“HUMINT”) to gain access to underground communities, markets, and forums, as well as data that’s inaccessible to traditional scanners. This “recaptured” data then feeds into its expansive database in real time, and includes cracked plaintext passwords, credentials, and personally identifiable information. The solution is adept at accessing data before it can be sold or made public, meaning organizations can act more quickly and stop further breaches and attacks. What’s also great about the solution is that it can provide automated remediation for breached passwords via its integration with Active Directory—this means users can automatically be prompted to change their passwords as and when a breach is discovered.
SpyCloud ATO Prevention integrates seamlessly with most SIEM, SOAR, ticketing systems, and identity management platforms. Users praise how quickly leaked information is identified by the platform, how easy its interface is to use, and how effective the executive reporting capabilities are. We recommend the solution for mid-sized and enterprise businesses across all industries (including finance, government, and e-commerce) that are looking for a robust solution to help not only monitor dark web activity, but also prevent account takeover.
ZeroFox is an industry leader in brand protection and offers fully managed threat protection, identification, and intelligence, as well as takedown services to shut down domain impersonation across the surface, deep, and dark web. It is part of the cloud-based ZeroFox platform, and its Dark Web Monitoring service offers organizations in-depth visibility of any data leakage or attack planning on the dark web that might relate to their business.
The solution offers continuous visibility across many corners of the deep and dark web, including hidden websites, forums, chatrooms, private marketplaces, and paste sites. If any relevant information is found—including sensitive business and personal data or plans to attack your business—an alert is immediately sent with information on what action should be taken. The solution is backed by AI-driven rules as well as the ZeroFox Alpha Team of threat hunters and researchers, which means that organizations can benefit from targeted, in-depth insights into their unique digital risks. Lastly, admins can view all alerts and breached information identified from one, easy-to-use dashboard.
The ZeroFox platform offers flexible pricing and levels of visibility to suit a business’ unique needs. The solution can also integrate seamlessly with threat intelligence platforms, SIEM, and SOAR solutions, as well as other common technologies in your security stack. Users praise the platform for its efficiency and responsiveness, but some note that it can take some work to onboard. We recommend the ZeroFox platforms for SMBs and enterprises that are looking for a powerful managed service that can provide continuous, in-depth dark web monitoring.
FAQs
What Is Dark Web Monitoring?
Dark web monitoring is a security tool that monitors and tracks the dark web. Dark web monitoring solutions will search to see if any information belonging to a company has been stolen and leaked there, such as passwords, credentials, and other sensitive data. Sensitive information, data, and login credentials are valuable as they can be sold on the dark web, then used in an attack. Dark web monitoring solutions can detect when credentials are up for sale, then alert teams so preventative measures can be put in place.
Dark web monitoring tools are also used for general threat hunting. By analysing information from the dark web, attack trends can be identified, enabling organizations to match their security settings with the latest threat intelligence.
How Do Dark Web Monitoring Tools Work?
Dark web monitoring tools work by continuously scanning the dark web for your company’s information and data. They will scan millions of sites in real-time to give you deep and valuable insight into dark web activity. Once this information has been discovered, the tool will send an alert to the company’s IT team so plans for remediation can be made.
Features that make up a dark web monitoring solution include:
- Threat intelligence: The solution pulls and analyzes large amounts of data which can be sent to a threat intelligence systems for data enrichment and contextual analysis.
- Threat hunting: Dark web monitoring tools can be used to improve detection and analysis capability.
- Investigation and response workflows: Due to a higher quantity of accurate information, workflows can be tailored to result in improved incident response times, thereby reducing the impact of a threat.
What Are The Key Features To Look For In A Dark Web Monitoring Solution?
- Wide range of visibility – You need to gather information from all the sources you can on the dark web. These include forums, chatrooms, marketplaces, and messaging apps. Remember, people who are trying to sell credentials won’t make themselves easy to find.
- Continuous Monitoring And Analysis – With breaches and attacks happening all the time, and across the globe – ensuring that your solution is constantly searching is the best way to protect yourself. Your solution should have crawlers, scrapers, and scanners to identify risk and analyze content in real time.
- Alerting – Your dark web monitoring solution should have an efficient way of alerting admin users to any relevant updates. The alerts should convey as much information as possible, whilst enabling you to react quickly.
- Reports – If your dark web monitoring solution can calculate a risk score associated with your organization, you are in a good position to monitor specific assets and implement more stringent security tools where relevant.
- Facilitated Response – While not all dark web monitoring solutions will have the capability to remediate threats from withing the platform – they should integrate with your security stack to facilitate this response. Some solutions might be able to remove harmful content, but this is not the case for all products.
