Dark-web monitoring
Stolen credentials and leaked databases are posted to dark-web forums and markets all the time. Every day, we check what is new against your domains and customers, your key accounts, their passwords and your company and brand names, and alert you in your client portal when something turns up.
Included in the annual subscription
What we monitor
Four kinds of monitoring run side by side. Each is checked against new data every day, and every match reaches you as an alert in your client portal.
Every leaked account under your domains, customers included.
We find every leaked account tied to your domains, from your own staff to the customers who sign in to your services. When customer logins for your app surface in an infostealer log, you can protect those customers from account takeover.
A named watch on the accounts that matter most.
Tell us which accounts carry the most weight, such as administrators, executives, and service or shared accounts. We watch each of them and alert you when one appears.
Know when a password tied to your accounts is exposed.
When a password linked to one of your accounts is exposed, you hear about it so it can be reset before anyone uses it. Passwords stay masked and are never shown in plaintext. Secrets committed to your own repositories are caught separately, by code monitoring.
Posts that name your company or brands, flagged early.
We watch dark-web forums and marketplaces for your company and brand names, so you hear early about posts that name your organization, from data claimed to be yours to discussion of your company.
Where exposure comes from
Stolen credentials reach the dark web in two main forms. New material of both kinds is added to our monitoring every day.
Credentials and sessions taken from infected devices.
Malware on a laptop or phone collects the passwords saved in its browser, the session cookies that keep people signed in and the sites they belong to. That bundle ends up on the dark web as a log.
Why it matters
Logs are often recent and point to the exact sign-in page. A stolen session can open an account without the password or the second factor.
Databases and combo lists posted on forums and markets.
When a service is breached, its user database can end up posted in full. Combo lists gather email and password pairs from many breaches into a single file.
Why it matters
People reuse passwords. A work email and password leaked from another service can be tried against your own sign-in pages.
How it works
Monitoring runs every day for as long as your subscription does. Your part is to tell us what to watch and to act on what we find.
01Share
Share your domains, the accounts that matter most, and your company and brand names.
02Check
Every day, new infostealer logs, breach dumps and forum and market posts are checked against what you share.
03Alert
When something of yours turns up, it appears as a new exposure in your client portal.
04Act
Each alert shows what was exposed and how severe it is, with recommended steps to contain it. Exposures also appear in your weekly report.
Anatomy of an alert
An alert is more than a match. It shows where your data appeared, when we found it, what was exposed and how serious it is, with the steps to take.
Where it appeared. The kind of leak, an infostealer log or a breach dump, and the kind of place it was posted.
When it was found. When our monitoring found it, so you can tell a new exposure from an old one.
Affected identifier. Which of your identifiers is involved. It is always masked, never shown in plaintext.
Data exposed. The kinds of data involved, such as a password, a password hash or a session cookie.
Severity. How urgent it is, so your team knows what to handle first.
Recommended actions. Defensive steps to take, the most urgent first.
Illustrative sample for Example Corp on example.com. Not a real exposure.
Handling
Exposure data follows the same rules as the rest of your client data.
Affected identifiers, your customers’ included, are masked in your portal. Exposed passwords and other secrets are never shown in plaintext.
Your exposures, including any that involve your customers, stay inside your organization’s isolated portal, apart from every other client’s data.
Exposure data is stored in the European Union, with the rest of your client data.
Included in the annual subscription
It comes alongside offensive security across your running systems, code monitoring on every commit and pull request, and one written report every week. Tell us what you want covered.
