Dark Web Monitoring tools are used to identify mentions of their organization on deep web and dark web forums and marketplaces, particularly any mentions which include compromised business data being illegally shared or sold. Deep web references areas on the internet that are non-indexed pages; dark web refers to non-indexed, illicit sites and private communications which are only accessible via Tor and I2P. This software uses automated scanners, web crawlers, and scraping techniques to continually monitor and analyze in real time any leaked sensitive business information, such as customer lists or data, employee login credentials, trade secrets, proprietary technology, and other valuable datasets made available on illicit markets. Businesses use dark web monitoring to reduce business risk, detect data breaches early, and to protect their intellectual property and brand reputation. Most commonly, dark web monitoring software is deployed and managed by a company's IT team or security team. Many of these tools have integrations with ticketing systems to assist with distributing real-time alerts to the right parties for remediation.
There is some overlap between dark web monitoring solutions and employee identity theft protection software and threat intelligence software. Employee identity theft protection software may monitor an individual employee's data on the dark web in addition to the surface web, but these tools are geared toward assisting an individual in the company, not a company's overall assets and brand. Threat intelligence software may also utilize some dark web monitoring functions, but has additional robust features to also identify novel cyber threats like new malware or active zero-day vulnerability exploits.
To qualify for inclusion in the Dark Web Monitoring tools category, a product must:
Provide automated monitoring of dark web forums and marketplaces for mentions of company name, employee data, customer data, and other selected keywords
Provide tools to analyze threats, including providing historical threat data, threat location data, threat actors names, relationships, URLs, and other relevant information to conduct further investigations
Provide real-time alerts when compromised company or other selected information is detected on the dark web
