Dark Web Monitoring Buyer's Guide: Choosing a Provider

Dark web monitoring providers are often chosen on claims of "millions of sources", and the result is a feed of old combolists that nobody can act on while fresh infostealer logs carrying your staff's sessions go unnoticed. The market ranges from credential exposure alerting to full digital risk protection (DRP) platforms that add brand and domain impersonation, executive exposure, data leak detection and takedown services. This vendor-neutral dark web monitoring buyer's guide helps security operations, threat intelligence, identity and procurement teams decide what scope to buy, write requirements and RFP questions, judge collection ethics and legality, compare providers on evidence, understand pricing models and run an evaluation. For what monitoring can see and how to triage findings, see the Dark Web Monitoring Guide.

Key takeaways

The best dark web monitoring is the one you can act on. The test of a provider is how many alerts led to a reset, a session revocation, a key rotation or a takedown, not how many records it indexed.
Freshness and context beat volume. Infostealer logs with infection date, device, URL and cookies are worth far more than recycled breach compilations.
Collection must be lawful and ethical. Require a written collection policy, legal review and a clear refusal to buy stolen data on your behalf.
Integrate with identity response. Alerts should match your directory and feed password blocklists, forced resets and session revocation automatically.
Non-human identities are part of the scope. API keys, cloud keys and tokens appear in the same leaks as passwords; a provider that only matches email addresses misses them.

Define requirements

Choosing a dark web monitoring provider starts with these questions, settled before approaching dark web monitoring vendors. They decide whether you need credential monitoring, a broader DRP platform or a managed service.

Assets to monitor: corporate email domains, single sign-on and VPN hostnames, customer-facing brands and domains, executive and high-risk staff names, code-signing and API key formats, IP ranges and key suppliers. A clear asset list is also what drives price.
Exposure types in scope: employee credentials, customer credentials (if you run consumer accounts), session cookies from infostealer logs, access broker listings, leaked documents and databases on leak sites, secrets in public code and paste sites, impersonation domains and social media accounts.
Response owners: who acts on each finding type. Credential findings go to identity operations, secrets to platform engineering, impersonation to brand or legal, and data leaks to incident response and the data protection officer. The NCSC notes that "The use of compromised credentials is still behind a large proportion of incidents that the NCSC responds to".
Integration targets: SIEM, SOAR, ticketing, identity provider and secrets manager APIs.
Legal and privacy constraints: whether your legal team permits any interaction with criminal forums, where the provider stores leaked personal data, and how breach notification decisions are made. If a finding reveals a personal data breach of yours, the ICO says "If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours".

Size changes the answer. A small organisation with SSO and phishing-resistant MFA gains most from free domain breach notifications, a password blocklist check at sign-up and change, and a tested reset and revocation process. Mid-sized organisations typically add a commercial credential and infostealer feed with API alerts. Large enterprises, consumer brands and regulated firms are the usual buyers of full DRP with takedown and analyst services.

Capability areas and evaluation criteria

Digital risk protection vendors and dark web monitoring providers package these capabilities differently, so a dark web monitoring comparison is only fair between offers with the same scope. Decide which you need now.

Capability	What it covers	Typical action
Credential exposure alerting	Breach compilations, combolists and infostealer logs matched to your domains and users	Force reset, revoke sessions, add to blocklist
Infostealer log monitoring	Per-device logs with saved passwords, cookies, autofill data and visited URLs	Revoke sessions, investigate the device (often personal), check third-party access
Access broker and forum monitoring	Listings offering access to your network, VPN or cloud tenant	Incident response, hunt for the access path
Data leak and leak site monitoring	Ransomware leak sites, forum dumps, paste sites, public code	Breach assessment, notification decisions, secret rotation
Brand and domain protection	Lookalike domains, phishing kits, fake apps and social accounts	Takedown request, safe browsing blocklist submission
Executive and VIP exposure	Personal data, impersonation and threats against named people	Privacy removal requests, protective security
Third-party exposure	Leaks naming your suppliers or containing your data held by them	Supplier engagement under contract

A DRP platform usually bundles several rows with a portal and analysts; a credential-focused provider does the first two rows deeply. Either way, ask which rows are collected by the provider itself and which are resold from another feed.

Weight criteria to your requirements. An illustrative split: 25% source coverage and freshness, 20% matching and context, 20% integration and automation, 15% collection ethics and data handling, 10% takedown, 10% commercial terms.

Criterion	What good looks like	Weak signs
Source coverage	Source types listed (stealer logs, broker forums, leak sites, messaging channels, paste and code sites) with how coverage is measured and refreshed	Unverifiable source counts; no source type breakdown
Freshness	Median time from appearance to alert; infection date on every stealer log	Alerts dominated by records years old
Matching and deduplication	Matches to directory accounts, flags whether the password is current (via secure comparison, not plaintext sharing), deduplicates across sources	Raw dumps of every record containing your domain
Session and NHI coverage	Cookie and token findings with target application; API key and cloud key formats detected by pattern	Email and password only
Integration	API, webhooks, SIEM and SOAR connectors, identity provider actions	Email alerts and PDF reports only
Data handling	Leaked passwords stored hashed or masked, role-based access, retention limits, residency options	Plaintext passwords emailed to your analysts
Takedown	Defined scope, median time to removal by content type, abuse-channel only, evidence pack	"Unlimited takedowns" with no service levels

Collection ethics and legality

Monitoring involves sources run by criminals, so legal review is part of the purchase, not an afterthought. The US Department of Justice's CCIPS guidance says that "Doing nothing more than passively gathering information from an online forum" is unlikely to be a federal crime, but that using stolen credentials to access a forum could breach the Computer Fraud and Abuse Act, that "A practitioner must avoid doing anything that furthers the criminal objectives of others on the forums", and that "organizations should be wary of attempting to obtain stolen data and security vulnerabilities in this manner". It also flags sanctions risk and advises: "Involve your legal department in operational planning." UK and EU buyers should take their own legal advice, including on the Computer Misuse Act 1990 and on processing leaked personal data under UK GDPR. Require the provider's written rules of engagement covering access methods, personas, payments and law enforcement referral, and never ask a provider to buy back your data. Analyst safety and data handling are covered in the Dark Web Monitoring Guide.

Credential exposure alerting and response

An alert is only useful if it changes something. NIST SP 800-63B-4 says verifiers "SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords", which may include "Passwords obtained from previous breach corpuses", and that while periodic changes must not be required, "verifiers SHALL force a change if there is evidence that the authenticator has been compromised." Ask whether the provider can feed your blocklist and trigger forced changes. For infostealer findings, a password reset is not enough: stolen session cookies (ATT&CK T1539) must be revoked. CISA's credential guidance advises organisations to "Monitor authentication logs for anomalous activity" and to review code for hardcoded credentials, since embedded credentials "can enable long-term unauthorized access if exposed". In the 2024 cloud data warehouse customer breaches, infostealer credentials used against accounts without MFA unlocked 165 customer environments. See the Leaked Credential Response Playbook.

Takedown services

Takedown works where the content sits with a legitimate host, registrar or platform: phishing sites, lookalike domains, fake social accounts and apps, and pastes or code on mainstream services. It does not remove data from criminal forums or leak sites. The NCSC's own Takedown Service, which covers UK Government brands, works by issuing takedown notices to hosting providers and adding sites to safe browsing lists so browsers block them; commercial services follow the same model. Ask what is included, the median time to removal by content type, and how cases that hosts refuse are escalated.

Pricing models

Dark web monitoring pricing is rarely published, and the counting unit drives total cost more than the headline rate.

Model	What is counted	Watch for
Per monitored asset	Domains, brands, IP ranges, executives, keywords	Subdomains and brand variants counted separately
Per identity	Employees or customer accounts monitored	Customer monitoring priced per account at consumer scale
Tiered modules	Credentials, DRP, takedown, analyst service	API access or stealer logs reserved for the top tier
Takedown quota or per request	Number of removals per year	Quota exhausted by low-value cases; overage rates
Managed service	Analyst hours or retained service	Analyst time spent on triage your automation could do

Ask for a three-year cost at today's asset list and at 30% growth, including API, connectors, takedown overage and professional services.

Framework mapping

Framework	Reference	What the provider supports
NIST SP 800-63B-4	Password blocklist and forced change on evidence of compromise	Compromised password data for your blocklist; reset triggers
NIST SP 800-53 Rev. 5	IA-5(1) Password-based Authentication; PM-16 Threat Awareness Program; SI-5 Security Alerts, Advisories, and Directives	Compromised password checks; threat intelligence input
NIST CSF 2.0	ID.RA-02 cyber threat intelligence received from information sharing forums and sources	Structured intelligence feed
MITRE ATT&CK	T1597.002 Purchase Technical Data; T1650 Acquire Access; T1539 Steal Web Session Cookie	Early warning of data and access being sold; session findings

ATT&CK notes that T1597.002 is hard to prevent because it happens outside enterprise defences and that adversaries "may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets", which is exactly the gap a monitoring service is bought to narrow.

Questions to ask vendors

Use these as the core of a dark web monitoring RFP and send the same set to every provider in the dark web monitoring evaluation.

Which source types do you collect yourselves, which do you buy or resell from other feeds, and how do you measure coverage and freshness?
Provide your written collection policy: access methods, personas, payments to criminal sources, legal review and law enforcement referral. Do you ever purchase stolen data?
For an infostealer log, which fields do you deliver (infection date, device, URLs, cookies, saved credentials), and how quickly after it appears?
How do you match findings to our directory, tell us whether a password is still current without exposing it in plaintext, and deduplicate repeats?
Which API key, cloud key and token formats do you detect, and can findings go straight to our secrets manager or ticketing?
Which identity provider, SIEM and SOAR integrations exist today, and can an alert trigger a forced reset and session revocation?
Where is leaked data stored, who can see it, how long is it kept, and how do you handle personal data under UK GDPR?
What does your takedown service cover, through which channels, at what median time to removal, and what happens when a host refuses?
What counts toward the licence, how are subdomains, brands and executives counted, and what does 30% growth cost?
Can we run a retrospective test: findings for our domains over the last 12 months compared with our known incidents?

Red flags

Offers to buy back your data or to "engage" sellers on your behalf.
Source counts with no breakdown by type and no freshness measure.
Alerts that are mostly old combolists already in your blocklist.
Plaintext passwords sent by email or shown to every portal user.
No session cookie or token findings, so infostealer exposure is treated as a password problem only.
Fear-driven sales demos showing other customers' leaked data.
Takedown promises covering criminal forums or leak sites, which legitimate abuse channels cannot reach.

Proof of concept

Agree scope and legal approval: list domains, brands, executives and key formats, and have legal sign off the provider's collection policy before any data is shared.
Retrospective test: ask each provider for findings on your assets over the past 12 months and compare against known incidents, password resets and phishing cases.
Live run for 30 days: connect alerts to a test SIEM index or ticket queue and record time from appearance to alert, duplicates and false matches.
Score actionability: count findings that led to a forced reset, session revocation, key rotation, takedown or investigation, versus those that were stale or unmatched.
Test response integration: trigger an automated reset and session revocation for a test account from an alert, and one takedown of a test lookalike page if the provider permits.
Check data handling: confirm how leaked passwords appear in the portal and API, who can see them, and audit logs of your analysts' access.
Close down: revoke API keys and integrations, and obtain written confirmation of deletion of trial findings that contain personal data.

Carry these measures into production: share of findings acted on, median time from appearance to alert, median time from alert to reset or revocation, exposed secrets rotated within your target, takedown median time by content type, and repeat exposures for the same users.

Standards and references

How NHI Mgmt Group can help

We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.

Dark Web Monitoring Buyer’s Guide: Choosing a Provider