Dark Web Monitoring: What It Costs and Whether It's Worth It

What it actually finds

Strip away the framing and the category resolves into four concrete detections, all of them useful.

Leaked credentials are the most valuable by a wide margin. When an unrelated service is breached, the credentials from it are traded and aggregated. If a member of your staff used their work email there — and some did, whatever your policy says — that pair now exists in a corpus attackers query routinely. Where the password was reused, which is the common case, it is a working key to your systems. Learning this before the attacker tries it converts an incident into a password reset.

Breach exposure is the broader version: knowing which of your domains and people appear in known breach corpora, what data classes were involved, and whether passwords were among them. This is what lets you force resets on the right accounts rather than annoying the entire organisation.

Brand impersonation and look-alike domains fall under the same monitoring umbrella in most products. A domain registered one character away from yours, a certificate issued for it, a cloned login page — the whole sequence is observable, often days before the phishing campaign launches.

Direct mentions of your organisation on forums and paste sites are the fourth, and the fuzziest. Sometimes it is an attacker advertising access to your network; more often it is noise. It has real value but it is the noisiest of the four, and a provider whose entire offering is mention alerting is selling you the weakest part of the category.

What it cannot do

Three honest limitations, none of which vendors volunteer.

It cannot search the whole dark web, because no such searchable thing exists. What is monitored is a collection of sources — breach corpora, paste sites, code repositories, forums, some marketplaces — that a provider has managed to obtain access to and index. Coverage varies enormously between providers and none of them cover everything. Treat any claim of complete coverage as disqualifying.

It cannot get your data back. Once a credential set is circulating it is circulating permanently. The value is entirely in your response — resetting, enabling multi-factor authentication, watching the affected accounts — not in removal, which is not achievable.

It cannot tell you the leak was your fault, and usually it was not. The overwhelming majority of leaked staff credentials come from breaches of unrelated services where the person reused a password. That is precisely why the monitoring is worth doing: it catches a risk created entirely outside your control, which no amount of internal security hardening would ever have prevented.

What drives the price

As with penetration testing, nobody publishes a meaningful list price, and for the same reason: the deliverable varies by an order of magnitude between providers. Four factors move the number.

Scope is the most obvious — how many domains, brands and executives are monitored. A single domain costs a fraction of a group with twelve subsidiaries and a set of named individuals under separate watch.

Source coverage is the largest genuine differentiator. Providers who have invested in obtaining and maintaining access to hard-to-reach sources cost considerably more than those aggregating the same public breach corpora everyone else uses. This is where you are actually spending money, and it is the hardest thing to evaluate from a datasheet.

Whether a human is involved separates the market in two. Software that alerts you is one price. A service where an analyst validates each finding, discards the noise and tells you what to do about it is several times that, and for most organisations without a security team it is the version that produces any value at all — because an unvalidated alert queue is a queue nobody works.

Response is the fourth. Detection alone is common; providers who also pursue takedowns of impersonating domains and phishing infrastructure charge for that separately, and it is usually worth it if your brand is consumer-facing.

• Monitoring one corporate domain with automated alerting sits at the affordable end and is worth it for almost any organisation with staff email.
• Add executives, subsidiary brands and takedown services and the figure rises steeply — these are the components genuinely worth negotiating.
• Bundling matters: dark-web monitoring bought inside a threat intelligence platform alongside attack surface discovery and brand defense is usually far better value than a standalone subscription, since the same monitoring infrastructure serves all three.
• Beware anything priced per-alert. It creates an incentive to alert.

How to tell a serious provider from theatre

Ask what sources they cover, specifically. A serious provider will describe categories of source and be candid about gaps. A weak one will say 'the dark web' and change the subject.

Ask what happens between detection and your inbox. If nothing does — if every raw hit becomes an alert — you are buying a noise generator, and within a month nobody will read it.

Ask them to describe a false positive they commonly see. Anyone genuinely operating this service can answer immediately and in detail. An inability to answer means they have not looked closely at their own output.

Ask what they do with a leaked password. The correct answer involves not storing plaintext, masking any preview, restricting who can reveal it and logging every reveal. A provider that emails you plaintext passwords has just created a second breach and, under the Kenya Data Protection Act, a processing problem of its own.

Finally, ask for a sample finding from your own domain before you sign. Any credible provider can produce one, and it converts the entire evaluation from a discussion about coverage claims into a look at what they actually found.

Is it worth it for a Kenyan organisation?

For organisations with staff email and customers who can be defrauded, the credential-exposure half is straightforwardly worth it. The economics are not close: the cost of monitoring one domain is a rounding error against a single successful business email compromise, and credential reuse is the most reliably observed entry route we encounter. Nothing about that pattern is specific to Kenya, but the local prevalence of mobile-money-themed lures gives a leaked credential more immediate monetisation paths here than in many markets.

For consumer-facing brands — banks, SACCOs, insurers, retailers, anyone whose customers log in — the brand-impersonation half is worth as much or more. Look-alike domains targeting Kenyan financial brands are a persistent pattern, and the window between a domain being registered and a campaign launching is usually days. Detection inside that window is the difference between a takedown request and a fraud investigation.

For an organisation with no public brand, no customer portal and a small internal staff, the mention-monitoring half is largely noise and the honest answer may be that credential monitoring alone is sufficient. That is a legitimate outcome, and a provider unwilling to say so is selling rather than advising.

Key takeaways

• The valuable half is credential and breach exposure — leaked staff passwords, usually from unrelated services, that still open your doors.
• No provider can search 'the whole dark web'. They index sources they have obtained access to, and coverage varies enormously. Complete-coverage claims are disqualifying.
• Monitoring cannot retract leaked data. All value is in your response speed.
• Price is driven by scope, source coverage, whether a human validates findings, and whether takedown is included. Unvalidated alert queues get read for about a month.
• Ask any provider for a sample finding on your own domain before signing — it turns coverage claims into evidence.

Frequently asked questions