DARK WEB & CREDENTIAL MONITORING: Understand what exposed information puts within reach.
Dark web and credential monitoring looks for exposed business information, passwords and session data in selected sources. Subdux examines matches linked to your organisation, assesses their relevance and helps determine protective action, taking account of whether a finding indicates an old disclosure, a current exposure or a concern requiring investigation.
- Discipline
- Managed Security & Advisory
- Engagement type
- Managed
The important question is what someone could use.
A match against your domain does not establish that your systems were breached or that an account remains accessible. Old records can reappear in new collections; unrelated organisations can share similar names. We examine the source, the identity involved, the information present and any available context before deciding what to escalate.
Credential exposure
Records linked to employee or business accounts, with attention to the type of credential and whether access may still be at risk.
Business information
Sensitive documents or other business-related material appearing in the sources included in monitoring.
Relevant context
Indications of recency, affected services and associated data that help distinguish an actionable concern from a repeated historical match.
Watch the identifiers that matter to your organisation.
We establish the domains, authorised identities and information indicators to monitor, the sources available and the handling required for sensitive matches. Coverage may include breach collections and other legally accessible sources relevant to the engagement. Findings are checked for relevance, consolidated where repeated and routed to the people who can act.
No provider can offer complete visibility into private channels or undisclosed breaches. We make the source coverage and material limitations clear.
Turn a relevant match into the right investigation.
Depending on the evidence, the next action may involve reviewing account activity, resetting a password, revoking sessions, removing exposed secrets or examining the affected device. We explain why an action is appropriate and coordinate it with the people responsible. Exposed information can suggest a wider compromise; the monitoring result alone does not establish its full extent.
What you receive
A relevant exposure record, including where and when it was observed where available.
Assessment of the affected identities or business information and the evidence supporting the concern.
Recommended protective action and an escalation record for significant findings.
A review of recurring patterns that may need broader changes in account or information handling.
Does a credential match prove an account has been accessed?
No. It identifies possible exposure. Current account risk depends on factors such as credential validity, password reuse, sessions and authentication controls. Account and device records may be needed to investigate further.
Can leaked data be removed?
Removal may be possible from a particular source, but copies can persist elsewhere. The priority is to reduce the usefulness of the exposed information and investigate any associated compromise. We do not promise that monitoring can retrieve every copy.
Is impersonation monitoring included?
It addresses a different problem. Brand Abuse & Impersonation Monitoring looks for fraudulent domains, websites and accounts misusing your identity. The two services can be coordinated when both risks are relevant.
Focus monitoring on the exposure you can act on.
Tell us which domains, identities and information are most important to your business. We can define the source coverage and escalation needs around them.
Related services: Identity & Access Management.