Dark web monitoring: useful alarm, not a shield

The short answer

Dark web monitoring is worth it for a business only as an early warning that triggers action, and only if the basics are already in place. It tells you when company email addresses and passwords appear in breach dumps, criminal markets or infostealer logs. It does not prevent a breach, it often reports old data, and it cannot see everything. For many small businesses, free or included tools cover most of the value: Have I Been Pwned’s domain search, and the leaked credentials detection in Microsoft Entra ID. Paying extra makes sense when someone is assigned to act on every alert within a day.

The rest of this article covers what monitoring actually finds, where it falls short and the exact steps to take when your company’s credentials show up.

Why stolen credentials still matter

Verizon’s 2026 Data Breach Investigations Report found that exploited software vulnerabilities overtook stolen credentials as the most common way attackers first get in, at 31 percent of breaches. It was the first time in the report’s 19 years that stolen credentials were not the top entry point, but they remain a major one. In its 2025 report, Verizon looked at victims posted on ransomware extortion sites and found 54 percent had their domains show up in at least one infostealer log or marketplace posting.

In plain terms: a stolen password is rarely the whole story, but it is often part of it.

What dark web monitoring actually finds

• Breach dumps. Databases stolen from websites and services where employees signed up with work email. The password may be the one they used on that site, sometimes reused at work.
• Combolists. Huge lists of email and password pairs compiled from older breaches, often recycled for password-spraying attacks.
• Infostealer logs. Data harvested by malware on an infected computer: saved browser passwords, session cookies and the sites they belong to. These are the most dangerous findings because they are recent and can include working sessions. In Verizon’s 2025 data, 46 percent of infostealer-compromised systems holding corporate logins were unmanaged devices that stored both personal and business credentials.
• Mentions and listings. Some paid services also watch forums for your company name, domain or sale listings of network access.

The limits most sales pitches skip

• It is after the fact. By the time data is posted, it has already been stolen.
• Much of it is old. Many alerts involve breaches from years ago and passwords already changed.
• Coverage is partial. No vendor sees every private forum, chat channel or buyer. A clean report does not mean you are clean.
• It does not cover personal email. An employee’s personal account that shares a password with work will not show up in a domain search.
• Alerts without action are noise. If nobody resets passwords and checks sign-ins, the subscription changes nothing.
• Consumer products are different. Personal identity protection, such as plans sold to individuals, watches your own Social Security number and cards. It does not monitor your company domain.

Free and included options to try first

• Have I Been Pwned domain search. Verify that you own your domain, by DNS record or another method, and you can see which company addresses appear in known breaches and sign up for alerts on future ones. Its creator says the aim is for most domain searches to stay free, with paid tiers for larger domains.
• Microsoft Entra leaked credentials. Microsoft scans breach dumps, paste sites and law enforcement data, then compares found credentials against your users’ current password hashes. A detection fires only on a confirmed match. As of 2026, Microsoft lists this detection as available on Entra ID Free and P1, though full risk details and automated risk policies need P2.
• Password screening. NIST’s password guidance calls for checking new passwords against lists of known compromised passwords. Microsoft and Google both offer banned or compromised password checks.

Want to know how exposed your logins really are? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity and IT operations, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

What to do when company credentials show up

1. Identify the source and date. An old third-party site breach is lower risk than a fresh infostealer log from an employee’s computer.
2. Reset the password for the affected account and any account that used the same password.
3. Revoke active sessions. In Microsoft 365 or Google Workspace, sign the user out everywhere. Stolen session cookies can bypass a password change.
4. Check MFA. Confirm it is on and review registered methods. Remove any phone or app the user does not recognize.
5. Review sign-in logs for unfamiliar locations, devices or apps over the past 30 days.
6. Look for mailbox rules. Attackers often create forwarding or delete rules to hide replies. Check for new rules and external forwarding.
7. Scan the device if the finding came from an infostealer log. Treat it as infected until proven otherwise, and check personal devices that access company accounts too.
8. Talk to the employee. Ask where else they used that password, and help them change personal accounts.
9. Record what you did. Your cyber insurer and, if it becomes a breach, your lawyer will want a timeline.

Controls that matter more than monitoring

Dark web monitoring is a smoke detector. These are the fire-resistant walls:

• Multi-factor authentication on every account, with phishing-resistant methods for admins
• A password manager so people stop reusing passwords
• Endpoint protection on every device that touches company data
• Policies that keep unmanaged personal devices away from sensitive systems
• Same-day removal of people who leave
• Regular access reviews

Questions to ask before buying a paid service

• Does it include infostealer logs, or only public breach dumps?
• How fresh is the data, and does each alert show the source and date?
• Does it tell you whether an exposed password is still valid, or only that an address appeared?
• Who receives alerts, and is response included or left to you?
• Can it watch more than one domain, including old ones you still own?
• Can you cancel monthly, and do you keep the alert history if you leave?

A service that sends a monthly PDF of old breaches adds little. One that flags a fresh infostealer hit on a named employee the same day can stop an intrusion early.

So, is it worth paying for?

Use this decision rule. If you do not yet have MFA everywhere and a password manager, spend the money there first. If you do, start with the free options above. Pay for a commercial service when you want infostealer coverage, alerts tied to named employees and someone who will act on them quickly.

JLB USA’s cybersecurity services focus on those controls: MFA, access reviews, same-day removal of leavers, endpoint protection, email security and monitored backups. For the people side, see our employee offboarding IT checklist.

Keep reading

• How much does cyber insurance cost for a small business in 2026?
• Cyber insurance claim denied? Why it happens and how to prevent it
• How to set up DMARC, SPF and DKIM without breaking your email
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Microsoft 365 security settings