The email arrives with a red header and a number in it. Fourteen of your company’s credentials have been found on the dark web. There is a button, and behind the button is a meeting invite. Effective marketing, because it feels like an alarm going off inside your building.
We offer dark web monitoring. We also think it is one of the most oversold products in our industry, and that most business owners misunderstand what the alert is telling them. It is not a burglar alarm. It is closer to a letter informing you that a hardware store you visited years ago kept a copy of your house key. Worth knowing. Worth acting on. Not the same as someone standing on your porch. Here is what the alerts actually mean, what a genuinely useful response looks like, and the narrow set of cases where this service earns its money.
What the Alert Actually Says
Strip away the presentation and almost every finding says one of two things. Either an email address ending in your domain appeared in a data set that is being traded, or an email address and a password appeared together in one.
The first is nearly meaningless. Your employees’ work addresses are printed on business cards and posted on your website. Their presence in a scraped directory tells you nothing about your security.
The second matters, but not for the reason the email implies. The password almost never came from your systems. It came from a breach at a hotel chain, a forum, or a service one of your employees signed up for years ago using their work address. Nothing on your network was touched. What was exposed is one password that person chose, at one unrelated site, at one moment in time.
That distinction changes everything about your response. You are not investigating an intrusion. You are closing a door that has been unlocked for a while.
Why the Finding Is Usually Old
Breach data does not expire. It circulates, gets combined with other sets, gets renamed, and reappears. A password stolen in one year can surface in a “new” collection years later, then again after that. Monitoring services scan those collections, so one underlying leak can generate alerts on and off for years. That is why a company gets three notifications about the same employee and the same ancient password.
Age does not make it harmless, though, and this is where reflexive dismissal goes wrong. In an April 2025 alert on credential exposure, CISA warned that stolen credential material lets attackers “escalate privileges and move laterally within networks,” “access cloud and identity management systems,” and “conduct phishing, credential-based, or business email compromise (BEC) campaigns,” and that criminals “resell or exchange access to stolen credentials on criminal marketplaces.” CISA also noted that credential material embedded in scripts and configuration files “is difficult to discover and can enable long-term unauthorized access if exposed.”
That is the real risk model. An old password is dangerous when it is still in use somewhere, or when it reveals the pattern a person uses to build passwords. The date on the breach matters far less than whether that password, or something two characters away from it, still works today.
The Response That Actually Matters
Here is the entire useful workflow. It takes about ten minutes per finding and it does not require buying anything.
- Change that password wherever it still lives. CISA’s guidance for individuals in that same alert is to “immediately update any potentially affected passwords that may have been reused across other platforms.” The exposed site barely matters. Reuse is the whole problem.
- Have an honest conversation about reuse. Ask the employee directly whether that password, or a close relative of it, was used at work. People will tell you if you are not scolding them. The FTC’s small business guidance is blunt on this: “Never reuse passwords and don’t share them on the phone, in texts, or by email.”
- Confirm strong multi-factor authentication is on that account. This is the control that makes a leaked password close to irrelevant. CISA’s performance goals call for using the strongest method available, with phishing-resistant options preferred over codes sent by text message. If you are weighing the options, we have compared security keys, passkeys, and standard MFA in plain terms.
- Check recent sign-in activity. Look for logins from places nobody has been, and mail forwarding rules nobody set up.
- Stop the next one at the door. NIST’s Digital Identity Guidelines FAQ explains that comparing new passwords against a list of “commonly used, expected, or compromised values” is meant to blunt guessing attacks. Screening passwords when they are created prevents the problem; monitoring only reports it afterward.
Notice that step five is the only permanent fix in the list, and it is the one no dark web service performs.
Notification Is Not Protection
This is where we will annoy some of our peers. Dark web monitoring is frequently sold as a protective control, sitting on a slide next to firewalls and backups. It is not protective. It cannot prevent anything, it cannot detect an attack in progress on your network, and it certainly cannot remove your data from anywhere. Nobody is issuing takedowns to criminal marketplaces on your behalf. Any provider implying otherwise is selling you a feeling.
Honestly described, it is a notification service with a dramatic name. That is not worthless. Notification has real value when it triggers a fast, specific response. But billed as protection it distorts your budget, taking money and attention that would do more good on sign-in controls, backups, and patching.
There is also a quieter cost. When a business receives a scary alert every few months and nothing bad ever happens, people learn to ignore the alerts. That habit transfers to alerts that do matter.
Where It Genuinely Helps
- Finding reuse patterns you would never otherwise see. When one person shows up across four unrelated breaches with recognizably similar passwords, you have learned something real, and you have a concrete reason to move them onto a password manager.
- Spotting credentials harvested by malware. Some exposures come from information-stealing malware on a personal machine rather than an old company breach. Those are current, not historical, and they often come with active session data. If a provider can tell you which kind you are looking at, that is worth paying for. If they cannot, ask why.
- Watching the accounts that move money. Owners, finance staff, and anyone with banking authority are targeted deliberately. Knowing their credentials are circulating is worth a phone call, not just a ticket.
- Starting a conversation people otherwise avoid. We will be candid: seeing their own name in a report gets employees to adopt a password manager faster than any policy memo. Using a real finding to drive a real behavior change is legitimate. Using it to close a deal on fear is not.
The Bottom Line
Dark web monitoring is a smoke detector for a fire that finished burning somewhere else years ago. That does not make it useless. It makes it a low-cost input to a process, and the process is what matters: change the password, confirm it was not reused, verify strong multi-factor authentication is on, and screen new passwords against known-compromised lists so this stops recurring.
If the fundamentals are in place, add monitoring. It is cheap and occasionally catches something urgent. If they are not, spend the money on multi-factor authentication and a password manager first. Being told about a problem is not the same as fixing it, and no vendor should be allowed to blur that line.
We would rather explain what an alert means than use one to sell you something. If you have received a dark web notification and want a straight read on whether it matters for your business, Contact us today.
Sources:
Comments are closed