Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Dark Web Monitoring
Transcript
- Lucas: So I was looking at a 2025 incident report last week — a Fortune 500 retailer that discovered fifteen thousand employee credentials for sale on a Russian-language forum. And here's the thing: they found out because their dark web monitoring service sent an alert. Three weeks later, they saw a credential-stuffing campaign hit their VPN portal. Luna: Three weeks of lead time. That's the whole argument for dark web monitoring in a nutshell. Lucas: Exactly. And it's become one of the fastest-growing categories in enterprise security. Gartner estimates that by the end of 2026, over 60 percent of large enterprises will have some form of dedicated dark web monitoring — either through a platform like Flare or SpyCloud, or as a feature within a broader threat intelligence subscription. Luna: Let's back up though — because 'dark web monitoring' gets thrown around a lot, and I think most people imagine hackers in hoodies typing on green terminals. What actually gets monitored? Lucas: Right, the marketing is worse than the reality. So practically, what these services do is crawl and index three layers: the surface web — that's indexed by Google, news sites, forums you can access without special software. Then the deep web — think private databases, pages behind login forms, anything not indexed by search engines. And then the dark web, which requires Tor or I2P to access, where you find the illegal marketplaces, ransomware leak sites, and private forums for cybercriminal groups. Luna: So when a company signs up for dark web monitoring, they're basically subscribing to a continuously updated database of stolen credentials, leaked documents, and chatter about their organization. Lucas: Correct. And the big shift in the last two years is automation. It used to be that a threat intel analyst would manually browse forums every morning, copy-paste into a spreadsheet. Now platforms like Flare have natural language processing models that scan millions of posts in Russian, Chinese, Arabic, and English, flagging anything that matches a company's domain, employee email pattern, or even a specific technology stack. Luna: Does that actually catch stuff before it becomes a breach? Or is it mostly noise? Lucas: It depends a lot on the maturity of the company's incident response process. The real value is when you combine the alert with an automated response. For example, if a credential appears on a dark web forum, the monitoring platform can trigger a password reset for that user, or even lock the account — all within minutes. That's what happened with the retailer I mentioned. Their SOAR playbook kicked in, reset fifteen thousand passwords in under an hour, and the credential-stuffing campaign hit an empty vault. Luna: So it's not just detection — it's about the speed of remediation. I've heard CISOs say that dark web monitoring is their most effective early warning system for identity-based attacks. Lucas: And that's the biggest use case right now: identity protection. According to a 2025 report from the Identity Theft Resource Center, over 80 percent of data breaches involve compromised credentials. So if you can detect a credential leak before it's used, you've effectively prevented the most common attack vector. Luna: But what about data that's not credentials? Like intellectual property or customer PII? Lucas: That's a different ballgame. Credentials are structured — email, password, sometimes a hash. Easy to match. But a leaked customer database or a stolen product design document — that's unstructured. You can scan for keywords, but there's a lot of false positives. Most dark web monitoring services are much better at credential detection than at detecting document leaks. The marketing tends to blur that distinction. Luna: So if I'm a CISO at a midsize company — not a Fortune 500 — should I invest in a dedicated dark web monitoring platform, or is it enough to rely on my existing threat intel feed? Lucas: Good question. I think the threshold is about ten thousand employees or sensitive data like healthcare or financial information. Below that, you might not get enough signals to justify the cost. Most platforms charge between $50,000 and $150,000 a year. But there are lighter options — SpyCloud has a freemium tier for small teams, and some managed security service providers include basic dark web scanning as part of their SOC offering. Luna: What about the legal and compliance angle? If you find employee credentials on a dark web forum, are you obligated to notify anyone? Lucas: That's getting more complicated. Under GDPR, if you discover a personal data breach — which includes credentials — you generally have 72 hours to notify the supervisory authority. Same under some U.S. state laws like the California Consumer Privacy Act. But the tricky part is that finding a credential on a forum doesn't necessarily mean the company was breached — it could be from a third-party service the employee used. So you have to do an investigation to determine the source, and that takes time. Luna: So the monitoring is the easy part. The hard part is the forensic follow-up. Lucas: Exactly. And that's where we see some companies getting it wrong. They get an alert, panic, and notify regulators before they know the facts. Then later they find out it was a credential from a personal LinkedIn account, not a corporate system. But the damage is done — a regulatory inquiry, potential fines, reputational hit. Luna: Let's talk about the human side. Are the forums actually active? I read that law enforcement takedowns have made some markets less reliable. Lucas: It's a cat and mouse game. In 2024, the FBI and Europol took down Genesis Market, which was a huge dark web marketplace for stolen credentials and browser fingerprints. But within weeks, new markets popped up, often on smaller, invite-only forums. The most active ones now are Russian-language forums like XSS and Exploit.in, which have been around for over a decade. They're surprisingly stable because the administrators enforce strict rules — no scamming, no law enforcement — and they've built a reputation system. Luna: So the data is still flowing. It's just distributed across more places. Lucas: Yes. And that actually makes monitoring harder. With Genesis, you had one big, easy to index marketplace. Now you need to crawl dozens of smaller forums, each with different authentication, different formats. That's why the automation and NLP models have become critical. Companies like Flare are scanning over 200 different sources now, including Telegram channels, which have become a huge vector for sharing stolen data. Luna: Telegram? That's not even dark web — it's a regular messaging app. Lucas: Right, and that's an important distinction. A lot of what's called 'dark web monitoring' actually covers surface and deep web sources too, because that's where the chatter happens. Cybercriminals use Telegram channels to sell data, discuss techniques, even coordinate attacks. It's more ephemeral than a forum, but it's also more immediate. Luna: So the term 'dark web monitoring' is almost a misnomer now. It's really 'threat actor activity monitoring' across all layers of the web. Lucas: Exactly. And I think we'll see the term shift over the next few years. Gartner already calls it 'external threat intelligence' in their reports. But the industry still uses 'dark web monitoring' because it sells better. Luna: That makes sense. Now, one thing I'm curious about: how do these platforms actually access the dark web? Do they maintain their own Tor nodes? Honeypots? Lucas: Most of them run their own Tor exit nodes or use commercial Tor proxies. They also maintain 'honeypot' accounts on forums — accounts that have been active for years, building reputation, so they can access restricted areas. Some even have relationships with law enforcement or former cybercriminals who provide access. It's a pretty sophisticated operation. Luna: That sounds like a lot of overhead. How do they make money? Are they selling the data back to companies? Lucas: They sell subscriptions to the monitoring platform, but some also sell one-time investigations. For example, if you're a law firm dealing with a data breach lawsuit, you might hire a dark web monitoring company to find evidence of the breach on forums. That can be lucrative. But the core business is recurring SaaS revenue. Flare, for instance, raised $50 million in Series B in 2025, and they claim over 800 enterprise customers. Luna: There's also the question of false positives. If you're scanning millions of posts, how do you avoid overwhelming the SOC team? Lucas: That's a huge challenge. The best platforms use a combination of automated triage — prioritizing alerts based on the severity of the data, the reputation of the source, and whether the data appears to be recent — and then human analysts to validate high-priority alerts. Some, like SpyCloud, also offer a managed service where their analysts handle the investigation and only send a confirmed alert to the customer. Luna: So the human element still matters. It's not just AI. Lucas: Not at all. The AI is great at finding needles in haystacks, but it's terrible at context. For example, an AI might flag a post that says 'I have access to Company X's network' — but it could be a teenager bragging, or a researcher testing defenses. A human analyst can read the history of that user on the forum, see if they've sold data before, and make a judgment call. Luna: Okay, let's bring this back to the CISO who's listening. What's the one concrete step they should take this week to gauge whether dark web monitoring would help? Lucas: Run a free credential exposure check. SpyCloud and Flare both offer free tools where you can enter your domain and see how many employee credentials have been leaked. That gives you a baseline. If you find more than a few hundred, it's probably worth a deeper look. Next, talk to a couple of vendors and ask specifically about their false positive rates and their integration with your existing SOAR tool. The worst thing you can do is buy a monitoring platform and then have alerts go straight to a shared mailbox that nobody reads. Luna: So it's not just about buying the tool — it's about building the process around it. Lucas: Exactly. And that's true for any security investment, but especially for something like dark web monitoring, where the signal to noise ratio can be quite low if you don't tune it correctly. Luna: Speaking of building processes, I think a lot of our listeners are operators themselves — they're the ones building and running these systems. And if these conversations help them do that better, that's exactly why we do this show. Lucas: Yeah, and it's also why listener support matters. We keep this show ad-free because we want to focus on the substance, not the sponsors. If you find value in episodes like this — whether you're a CISO, a security engineer, or just someone who wants to understand how the industry works — consider throwing a few bucks our way. It's buy me a coffee dot com slash fexingo. That's buy me a coffee dot com slash f-e-x-i-n-g-o. Every bit helps us keep digging into the real stuff. Luna: Definitely. And honestly, it's the listeners who ask the best questions. So if there's a topic you want us to cover, or a vendor you want us to dig into, reach out. Lucas: So back to the practical side. Once you have a monitoring service in place, the next step is to operationalize the alerts. That means mapping each alert type to a specific playbook. If it's a credential leak, reset the password and enable MFA. If it's a document leak, notify legal and start a forensic investigation. If it's chatter about a planned attack, escalate to the threat intel team for further analysis. Luna: And that's where the ROI really shows up — when you can measure the time from detection to remediation. I've seen case studies where companies cut that time from weeks to hours. Lucas: Right. And the best part is that dark web monitoring isn't just reactive. It can also be proactive. For example, if you see a post that says 'I'm looking for a way to exploit vulnerability X in Company Y's system,' you can patch that vulnerability before it's exploited. That's the kind of intelligence that moves you from defense to offense. Luna: So it's like having a window into the adversary's planning room. Lucas: Exactly. And that's why it's becoming a standard tool in the enterprise security stack. It's not a silver bullet — nothing is. But when done right, it gives you a massive information advantage. Luna: Alright, Lucas. Great deep dive. Thanks for walking through that. Lucas: Thanks, Luna. And thanks to everyone listening. We'll be back next week with another episode of Cybersecurity Business.