# Dark web monitoring for business: what it covers and what a breach-data check finds

> Dark web monitoring services watch criminal marketplaces and forums for your company's data; EdgeProtect checks your staff email addresses against known breach data and reports which logins have leaked, without showing any passwords.

Canonical page: https://www.edgeprotect.io/features/dark-web-monitoring
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Features](https://www.edgeprotect.io/features) > Dark web monitoring

Dark web monitoring · Breach-data check. Checked with every scan. Passwords never shown. Nothing to install.

## What does the check report?

It is a breach-data check, not a crawler. It tells you which staff logins are in known breaches. It does not search marketplaces or forums, and there is no standing alert. Run it again when you need a fresh answer.

- **Affected staff addresses.** Each address on your domain, such as accounts@acme.co.uk, that appears in known breach data.
- **Leaked records and people.** How many records leaked and how many different staff addresses are involved.
- **Readable passwords.** How many leaked passwords were stored in the clear, so you can start with the accounts most at risk.
- **Which breaches.** The breaches each address turned up in, biggest first.
- **Never the password.** We deliberately never display the passwords themselves, to you or anyone else.
- **Checked when a scan runs.** Scan again to check again. The check is a point-in-time answer.
- **No standing alert.** Nothing watches in the background and nothing tells you about a new breach by itself.
- **No marketplace or forum search.** The check matches your addresses to breach data. It does not search criminal marketplaces or forums.

## How does it run?

As part of an attack surface scan. There is no separate dark web product to set up. The check is part of an attack surface scan of a domain you have verified, run from your browser.

- Verify the domain once, then scan whenever you like.
- Each scan checks the staff addresses on that domain against known breach data.
- Scans do not repeat by themselves. Run another scan to check again.

The same scan maps hosts, open ports and certificates. See what a scan finds: https://www.edgeprotect.io/features/attack-surface-management

## Continuous monitoring or a breach-data check?

Two different jobs. Many business dark web monitoring services watch criminal sources on an ongoing basis. A scan-time breach-data check answers a narrower question, on demand. Third-party descriptions are summarised from public vendor pages; confirm current detail with each vendor.

**What it looks at**

- Continuous dark web monitoring services: Criminal marketplaces, forums, paste sites and leaked data sets, as each vendor describes them.
- EdgeProtect breach-data check: Known breach data, matched to the staff email addresses on your verified domain.

**When it checks**

- Continuous dark web monitoring services: On an ongoing basis, with alerts when new exposure is found.
- EdgeProtect breach-data check: When an attack surface scan runs. There is no standing alert.

**What you receive**

- Continuous dark web monitoring services: Alerts and reports on exposed credentials, and often other data such as card numbers or internal documents.
- EdgeProtect breach-data check: The affected addresses, leaked record counts, readable password counts and the breaches involved.

**Passwords**

- Continuous dark web monitoring services: Varies by vendor.
- EdgeProtect breach-data check: Never shown. You see who is affected, not their secret.

**Marketplace and forum coverage**

- Continuous dark web monitoring services: Part of the service.
- EdgeProtect breach-data check: Not covered by EdgeProtect. The check does not crawl the dark web.

**Set-up**

- Continuous dark web monitoring services: Usually an onboarding process, a contract and a named contact.
- EdgeProtect breach-data check: Verify a domain, run a scan, open the credential records.

**Best suited to**

- Continuous dark web monitoring services: Organisations that need a standing watch on criminal sources and have staff to act on alerts.
- EdgeProtect breach-data check: Teams that want to know whose password to change now, without a monitoring service.

## What does it mean for a business?

Not the same as a consumer product. Search results for this term mix two products. Knowing which one you need saves a procurement cycle.

- **Consumer dark web scans.** These check one person's own email address, phone number or card against leaked data and tell that person to change a password. They are sold to individuals and cover personal accounts.
- **Business dark web monitoring.** These cover the company: every staff address on its domain, and in some services brand names, executives, source code and customer records. The result goes to a security or IT team that decides who must act.
- **Where EdgeProtect sits.** EdgeProtect is a business tool with a narrow scope. It checks the staff addresses on your domain against known breach data. It does not monitor brand mentions, executives or marketplaces.

## Questions

### What does dark web monitoring mean?

It means searching places where stolen data is traded, such as criminal marketplaces and forums, for information that belongs to you. A business service looks for company data. A consumer service looks for one person's details. EdgeProtect does a narrower job: it checks staff email addresses against known breach data.

### What is the difference between the dark web and the deep web?

The deep web is any page a search engine cannot index, such as webmail, online banking and intranets. The dark web is a small part of it that needs special software to reach and is where much stolen data is traded. Most of the deep web is ordinary and harmless.

### What does a business dark web check look for?

It looks for your company's data in leaked or traded sources. EdgeProtect's check looks for the staff email addresses on your verified domain in known breach data. It reports which addresses leaked, how many records, which breaches they came from and how many leaked passwords are readable.

### Does EdgeProtect monitor the dark web continuously?

No. The check runs when an attack surface scan of your domain runs. There is no standing alert and no crawling of marketplaces or forums. Run another scan whenever you want to check again.

### Will I see the leaked passwords?

No. You see who is affected and whether a readable password leaked, never the password itself.

## Related

- [Credential exposure](https://www.edgeprotect.io/features/credential-exposure)
- [Attack surface management](https://www.edgeprotect.io/features/attack-surface-management)
- [SSL certificate monitoring](https://www.edgeprotect.io/features/ssl-certificate-monitoring)
- [MCP server](https://www.edgeprotect.io/features/mcp-server)
- [All features](https://www.edgeprotect.io/features)