Every week, hundreds of millions of email address and password combinations from old data breaches circulate across criminal forums and paste sites. Some of those credentials belong to your staff. Some might include email addresses associated with your business domain. If any of your people have ever reused a password across a personal account and a work account — and, realistically, some of them have — that’s a direct path to your systems.

Dark web monitoring is the category of service that watches these dumps and tells you when your business turns up. It sounds like the sort of thing only large organisations worry about. It’s not.

What dark web monitoring actually does

The honest version: these services monitor known breach databases, paste sites, criminal forums, and certain dark web marketplaces. When credentials matching your monitored email domains appear in a newly discovered breach dump, you get an alert.

What they’re monitoring is mostly historical breach data rather than real-time criminal activity. When you get an alert that jane.smith@yourbusiness.com appeared in a credential dump, it means her email and an associated password appeared in data that’s now circulating. The breach itself might be years old — the LinkedIn breach from 2012 still turns up in credential dumps circulating today. The alert doesn’t mean your systems were compromised; it means a credential associated with that email address has been exposed somewhere.

The value is proportional to your password hygiene. If your staff use unique passwords for every account via a password manager, an old exposed credential is mostly harmless — the password it’s associated with isn’t used anywhere relevant anymore. If anyone’s reusing passwords across work and personal accounts, that exposed credential is a direct risk.

Free versus paid options

Have I Been Pwned (haveibeenpwned.com) is the starting point for most small businesses. Troy Hunt’s service monitors major breach dumps and lets you check any email address for free. You can also set up domain monitoring — enter your business domain and get email alerts whenever any address on that domain appears in a new breach. This is free and genuinely useful. If you’re not already doing this, set it up today.

Microsoft Entra ID (what most people still call Azure AD) includes credential monitoring as part of its identity protection features. If you’re on a Microsoft 365 Business Premium subscription, you already have access to alerts when user credentials appear in known breach databases. Check whether this is configured in your admin centre.

Google Workspace has similar dark web monitoring via its Admin Console on higher tiers, showing credential exposures for accounts in your domain.

Paid dark web monitoring services — services like SpyCloud, Flare, Constella, or tools bundled into security platforms — go further. They monitor a wider set of sources including criminal forums that aren’t indexed publicly, can surface infostealer malware logs (where malware on someone’s device swept all their stored credentials), and provide more context about what was stolen and when. For a small business handling sensitive client data or financial transactions, the broader coverage justifies the cost — typically £500–£2,000 per year for SMB-focused tiers.

The infostealer problem

Here’s the thing about dark web monitoring that most explainers skip: the most current and dangerous credential exposure isn’t from old breaches. It’s from infostealer malware.

Infostealers — Redline, Raccoon, Vidar, and their variants — are commodity malware that infect devices (often through phishing or malicious downloads), sweep all stored credentials from browsers, email clients, and password managers, and exfiltrate them to criminal infrastructure. The stolen data is sold in “logs” on criminal markets within hours of collection.

Standard dark web monitoring catches some of this when logs are eventually posted publicly. But the window between infection and your credential turning up in a monitoring alert can be days or weeks — long enough for the credential to be used. More sophisticated monitoring services monitor criminal markets in near-real-time for fresh infostealer logs, which is where the premium tier earns its cost for high-risk businesses.

What to do when you get an alert

An alert from dark web monitoring isn’t a crisis — it’s useful information that you need to act on.

First, identify which credential was exposed. The alert should tell you the email address and, in some cases, which service the breach came from. That tells you which password is compromised.

Second, have the affected user change that password immediately — and audit whether they’ve reused it anywhere else. The standard advice is to change it everywhere it was used. Realistically, if they can’t remember where they used it, a forced password reset on all accounts connected to that email address is the safer approach.

Third, check account activity. If the credential is for a work system — Microsoft 365, Google Workspace, your accounting software — review recent login logs for unusual activity. Look for logins from unusual locations, unusual times, or unfamiliar devices. Unusual activity should trigger an incident response rather than just a password reset.

Fourth, enable MFA if it isn’t already on. A compromised password with MFA on the account is usually recoverable. A compromised password without MFA frequently isn’t.

The NCSC’s view

The NCSC recommends credential monitoring as part of its baseline security guidance for small organisations, alongside password managers and MFA. They specifically highlight Have I Been Pwned as a practical starting point for businesses that can’t justify paid monitoring.

Dark web monitoring isn’t a substitute for the basics — good password hygiene, MFA on everything important, keeping software updated. But it adds a detection layer that can catch a problem before it becomes a breach, and at the free tier there’s no reason not to have it running.