Dark web monitoring tracks forums, underground marketplaces, messaging groups, and other sources outside the company's perimeter to find leaked credentials, exposed data, access listings, and brand mentions before they become incidents. The value of monitoring depends on what happens after the alert.
The threat intelligence concept is explained in the article What is Cyber Threat Intelligence (CTI). The focus here is operations: where to look, how to filter, and how to act.
Which sources does monitoring cover?
In the Vultus methodology, monitoring covers social media and messaging groups, the surface web, deep web and dark web, app stores, email and phishing campaigns, malware distribution, remote access trojans and botnets, and targeted attacks. Open sources such as the press, forums, and review sites round out the coverage.
None of these sources appear in internal tools, which observe only what happens within the environment.
Data volume is not intelligence
Many companies subscribe to feeds with millions of indicators, such as malicious addresses and malware signatures. Without context, curation, and a connection to the company, this data expands the SOC queue without guiding decisions.
A useful alert states what was found, why it concerns the company, the likely impact, and what to do.
What monitoring finds
Leaked credentials provide the most immediate return. In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, credentials stolen by infostealers accelerated intrusion in 21.4% of tests, as detailed in the article on infostealers.
Monitoring also finds company databases, documents, and code circulating in forums, access-for-sale ads, brand misuse, and information about groups attacking the industry and the techniques they use.
The M-Trends 2026, from Google Cloud, shows why time matters: the interval between initial access and handing that access to another criminal group fell from more than 8 hours in 2022 to 22 seconds in 2025.
From alert to mitigation
At Vultus, the workflow runs from identification to mitigation:
- Identification: automated and manual collection from monitored sources.
- Automated curation: AI filtering to discard irrelevant information.
- Manual curation: an analyst's assessment of context, credibility, and impact.
- Validation: confirmation that the threat is real and relevant to the company.
- Mitigation: internal actions, such as password changes and session revocation, and external actions, such as taking down a fake website.
- Report: a monthly summary of findings and recommendations.
Integration with the SOC shortens the cycle: a login using known leaked credentials becomes a priority alert. For institutions authorized by Brazil's Central Bank, cyber intelligence became part of the minimum controls under BCB Resolution 538.
Curated threat intelligence
Vultus monitors surface web, deep web, and dark web sources with automated and manual curation and delivers alerts with mitigation recommendations. Explore Vultus Cyber Threat Intelligence and the Vultus SOC by Google SecOps.
