Since the start of 2026, the number of companies considering "dark web monitoring" has clearly grown, and we can feel it on the ground.
Behind this is the fact that the way cyberattacks begin has been gradually changing.
It used to be that the biggest concern was "whether someone would break in from outside."
But in recent investigations and assessments, we increasingly see cases where the problem lies at a stage before the intrusion itself: where and how information that has already gotten out is being handled.
In practice, we often receive inquiries when:
- No damage has been reported yet
- Internal systems are running without problems
- The logs show no suspicious behavior
In other words, when "nothing is happening."
But when we dig a little beneath the surface, we sometimes find credentials leaked in the past, or account information leaked through another service, being shared in fragments on the dark web.
That alone doesn't necessarily lead to damage right away.
From an attacker's point of view, however, it is also "a state in which the materials are coming together."
The dark web isn't only a place for trading "information to use right now."
Information may also be stored on the assumption that it will be used later, or traded so it can be combined with other information.
That's why, from a company's perspective, it's hard to understand "why we need to look into this now when nothing is happening."
On the other hand, from where we sit as investigators, now, when nothing is happening, is the time when you can check the situation most calmly.
Once damage has surfaced, it inevitably becomes much harder to trace accurately "where the information came out" and "how long the attack has been in preparation."
That's why we feel that requests like "just to be safe, we'd like to look at our dark web situation once" have become more natural than they used to be.
A basic understanding of the dark web is spreading.
Against this backdrop, it's no surprise that companies specializing in dark web monitoring are drawing attention.
Why Are Dark Web Monitoring Companies Drawing Attention Now?
Until recently, the assumptions for thinking about cyberattacks were relatively simple:
whether someone would break in from outside, and which entry point would be targeted.
We think most countermeasures were designed on that premise.
Recently, though, the nature of the investigation requests we receive has shifted a little.
"There's no sign of an intrusion, but something bothers us."
"There's been no damage, but we'd like to get a clear picture once."
We hear voices like these more often.
When we trace the background, the common thread is that the starting point of the attack is not "the company's own systems."
- Credentials leaked through another company's service
- Old accounts that were thought to be no longer in use
- Information that wasn't recognized internally as something to manage
Things like these circulate in fragments on the dark web.
That alone doesn't necessarily lead to damage right away.
But because no intrusion has happened yet at this stage, firewalls and EDR don't react either.
From the company's side, it looks like "nothing in particular is wrong."
From the attacker's side, on the other hand, it is a stage where the materials for understanding the environment are gradually coming together.
We feel this "gap in perception" is what makes today's cyber risk so hard to grasp.
That's exactly why what matters is whether you can identify information that has gotten out before an intrusion happens.
It's also worth deepening your understanding of how credentials circulate on the dark web.
Companies that specialize in dark web monitoring are the ones that fill this role.
Automated Tools Alone Aren't Enough for Dark Web Monitoring
Many people probably picture the dark web being handled by a system that crawls automatically and picks up keywords. And in fact, a certain amount of information can be captured that way.
However, the information that tends to cause problems in practice isn't necessarily found in "places where it shows up if you search."
For example:
- Closed, invitation-only forums
- Posts that look like idle chat at first glance but make no sense unless you follow the context
- Exchanges of information that deliberately avoid specific words and are intentionally vague
In places like these, simply picking up words often won't lead you to the important information.
In real investigations, rather than "whether a plausible-looking string exists," you need to look at what premises and flow that exchange emerged from.
Whether a post is:
- Just a rumor
- Merely rehashing old information
- Or information that could actually be used
This judgment is hard to automate.
That's why, unless a human who can tell "what is truly dangerous" and "which risks are realistic" is involved, things tend to get missed.
We feel that the reason each dark web monitoring company produces different findings and sees a different picture largely comes down to how much human eyes and judgment are involved.
For how to understand threats using public information, see the article below.
https://cyber.spool.co.jp/open-source-intelligence-osint/
2026 Edition: The Main Dark Web Monitoring Providers Used in Japan
Even within Japan, there are several companies offering dark web monitoring.
But they don't all do the same thing.
Some companies are strong at quickly determining "whether information has been found."
Others excel at deepening investigations by combining them with incident response and forensics.
What we feel from the inquiries we receive is that, in many cases, deciding "which one is the best" doesn't mean much in itself.
What matters is whether you've worked out in advance points such as:
- What you want to know
- What stage of information you want to capture
- How you want to use the results internally
For example, do you want to:
- Check whether there's a leak happening right now
- Keep track of the situation regularly and follow changes
- Find out how much of the material that could lead to an intrusion is already out there
The dark web monitoring company you should choose changes depending on your purpose.
We feel that comparing from the perspective of what you want to confirm, rather than "because they're famous" or "because I've heard the name," usually leads to a decision you're more satisfied with in the end.
CyberCrew
CyberCrew's dark web monitoring is distinctive in that it isn't a service that provides a tool; it's built on the premise that white-hat hackers conduct the investigation directly.
Even when information is found on the dark web, we don't simply list it as "dangerous."
Taking the attacker's point of view, we examine each item one by one:
- Can the information actually be used?
- What attacks could it lead to?
- Is it a risk that should realistically be prioritized?
The investigations are carried out by white-hat hackers who include winners of world CTF championships and holders of hands-on certifications such as OSCP and OSWE. Because they perform intrusion simulations and assessments every day, their strength is judging by actual danger rather than by "how serious it looks."
As a service, its features include:
- Flexibility to choose anything from a spot check to continuous monitoring
- Early sharing of information that is highly likely to lead to an intrusion
- An investigation scope that extends beyond the dark web to cloud and AI (LLM) environments
Reports are also organized with an emphasis on letting you understand the situation without specialist knowledge.
Because they're shared in a form that shows what the problem is, why it requires attention and whether immediate action is needed, they also give peace of mind by making internal explanations and decisions easier.
This service suits organizations that:
- Don't want dark web monitoring to end with a notification
- Want to know the truly dangerous points from an attacker's perspective
- Don't want to take on tool operation and analysis in-house
It's easiest to think of CyberCrew's dark web monitoring as a service closer to "getting a diagnosis" than "monitoring."
By entrusting it to us, the information you need for decisions is properly organized,
which makes it an option we can recommend with confidence.
CyberCrew dark web monitoring: AlienGate Dark Web Intelligence
SMS DataTech (Dark Web Eye)
Dark Web Eye, offered by SMS DataTech, is a dark web monitoring service designed around how Japanese companies operate.
Offered since 2024 and optimized for domestic companies, it continuously monitors, 24/7/365, whether your company's email addresses, passwords and the like are circulating on the dark web.
Its first notable feature is the speed of detection and how easy it is for domestic companies to understand.
With overseas tools, screens and reports can be hard to understand, and you may need to re-explain the content for internal audiences.
Dark Web Eye is designed with this in mind, and its dashboard and notifications are presented in a form that fits easily into Japanese corporate operations.
Its monitoring covers a wide range: in addition to black markets and hacking forums on the dark web, it includes places commonly used as real distribution channels, such as Telegram and paste sites.
The service is also structured in tiers:
- Dark Web Eye
Core data leak monitoring.
Mainly used to detect leaked credentials early and connect that to initial response. - Dark Web Eye / ASM
Attack surface management that visualizes the attack surface as seen from outside
and organizes risks from an attacker's perspective. - Dark Web Eye / Discovery
Individual investigations by specialists targeting specific incidents or deeper layers.
As this structure shows, Dark Web Eye suits an approach of "monitor broadly first, then dig deeper as needed."
In particular, for companies that:
- Want to learn early about data leaks through external services
- Want to understand the situation in a form that's easy to explain internally
- Want to plan countermeasures step by step, centered on continuous monitoring
it's an easy-to-handle option.
On the other hand, if you place weight on analysis that goes as far as the attacker's intent and how information is used, a different approach may suit you better.
Where does "detection" end and "judgment" begin? How you draw that line is the key point when choosing.
SMS DataTech: https://www.sms-datatech.co.jp
StealthMole
StealthMole is an AI-powered dark web and threat intelligence platform offered by a company based in Singapore. It is a Singapore-based threat intelligence platform with particular strength in the Asia region.
If you had to sum up this service in a phrase, its defining feature is that "you can try it first and confirm its value."
Because you can check a demo and some features before adopting it, our impression is that it's often chosen by companies that want to decide after confirming "whether it fits our purpose," rather than signing a contract right away.
StealthMole covers a broad range of data, including not only the dark web but also the deep web and Telegram, and uses AI to visualize the relationships between pieces of information.
A particular strength is its data on the Asia region.
It is strong on criminal techniques and hacker group activity specific to Asia, and it has been used in more than 75 countries worldwide, including by law enforcement agencies, government bodies and large enterprises.
Functionally, it goes beyond simple "leak detection":
- Darkweb Tracker
Collects data in real time from areas including invitation-only forums and marketplaces. - Ransomware Monitoring
Monitors ransomware groups' leak sites and activity for early awareness. - Credential Search
Searches for leaked email addresses and passwords, and credentials originating from stealers. - MoleSight
A relatively easy-to-use dashboard feature that sends notifications when monitored keywords are detected.
Another notable feature is its rich set of digital-forensics-oriented functions designed for investigations, such as geolocation display and link analysis.
Pricing is generally quoted individually, but through demos and trials you can try out day-to-day situation checks and how it feels to use.
As a result, for companies that:
- Want to confirm its capabilities as a tool first
- Have in-house staff who can handle investigation and analysis
- Want to dig into information and use it themselves
it's a well-matched option.
On the other hand, if there's a strong need to "hand over the investigation itself" or to "have everything organized, including the judgment," a different approach may suit you better.
StealthMole is easiest to understand when positioned as an intelligence platform that assumes you'll look, think and make full use of it yourselves.
StealthMole: https://stealthmole.jp
ZeroDarkweb
ZeroDarkweb is a dark web monitoring service with strength in spot investigations when an incident occurs or is suspected.
While it does include continuous monitoring, its positioning places more weight on "quickly grasping what is out there right now" than on "regular observation in normal times."
The investigations center on information tied to your company's domain. From the leak status of email accounts to credentials leaked as a result of malware infection, it organizes information on the dark web by level.
What stands out is the speed from detection to sharing:
- Automated 24/7/365 monitoring of information on the dark web
- Immediate alerts when a leak is confirmed
- Reports summarizing the damage delivered in a short time
It broadly covers real distribution channels such as hacking forums, black markets and Telegram channels around the world.
Its pricing is also relatively easy to understand, with monthly plans based on the number of domains:
- Basic: Investigation and monitoring of one domain
- Standard: Monitoring of multiple domains and an annual report
- Premium: A wider range of domains and multiple analysis reports
It's also offered through cloud support vendors and security distributors, which makes it easy to introduce in a way that fits your organization.
This service suits cases such as:
- There are signs of unauthorized access or a data leak, and you want to check the current situation first
- You want to quickly establish whether anything has leaked externally to prevent secondary damage
- You want to investigate safely without accessing the dark web yourself
On the other hand, if you place weight on analysis that goes into the attacker's intent and how information is used, or on continuous risk assessment, a different type of service may suit you better.
ZeroDarkweb is a service often used as "an initial investigation to pin down the facts first."
ZeroDarkweb: https://www.zerodarkweb.jp
Trend Micro (Trend Vision One)
Trend Vision One, offered by Trend Micro, is positioned less as a standalone dark web monitoring service and more as part of a platform for managing cyber risk across the entire enterprise in an integrated way.
Data leaks on the dark web are treated as "one risk factor" alongside endpoints, email, networks, cloud and so on, and visualized on the same screen.
What stands out is that it doesn't stop at finding leaked information.
When credentials are confirmed to be circulating on the dark web, you can track directly, in an XDR context, whether that account is behaving suspiciously in your internal environment.
The area previously called ASRM is now organized as CREM (Cyber Risk Exposure Management), which evaluates data leaks, vulnerabilities, misconfigurations and more together, and presents them in a form that makes it easy to decide response priorities.
This service suits companies that:
- Already use Trend Micro products
- Don't want to carve out dark web monitoring as a standalone function
- Want to understand risk as a whole and simplify operations
Vision One is easiest to understand as an option for organizations that want to treat the dark web not as "a target for individual investigation," but as one element of overall risk management.
Trend Vision One: http://trendmicro.com
Fortinet (FortiRecon)
Fortinet's dark web monitoring is provided as part of a digital risk protection service (DRPS) called FortiRecon.
What stands out is that it emphasizes 24-hour monitoring built around a SOC rather than a standalone tool.
As a result, it's prominently used by organizations that need constant monitoring and rapid response, such as global enterprises and financial institutions.
FortiRecon is designed on the premise of "looking at your company from the outside with the same perspective as an attacker."
It continuously monitors the dark web, hacking forums and private channels such as Telegram, catching the circulation of credentials related to your company and signs of attacks at an early stage.
The service consists mainly of the following three areas:
- External Attack Surface Management (EASM)
Automatically discovers externally exposed domains, IPs, public repositories and the like,
and continuously checks whether vulnerabilities and misconfigurations are being left unaddressed. - Adversary Centric Intelligence (ACI)
Monitors leaked information and signs of attack planning on the dark web and in underground forums. - Brand Protection (BP)
Detects fake domains, impersonation sites and brand abuse, and supports takedowns.
Heading into 2026, Fortinet has strengthened its design around the "industrialization" of cybercrime and the acceleration of attacks through AI. FortiRecon likewise emphasizes delivering practical, low-noise intelligence by combining AI-driven automated analysis with analysis by FortiGuard Labs experts.
This service suits organizations that:
- Assume 24-hour monitoring through a SOC
- Want to manage environments that include overseas sites and multinational operations
- Want to tie dark web monitoring closely to their defensive measures
FortiRecon is easiest to place as an option for companies that want to build dark web monitoring into continuous risk management and defensive operations, rather than carving it out on its own.
FortiRecon: https://www.fortinet.com
Cognyte (LUMINAR)
Cognyte's dark web monitoring is provided through LUMINAR, the company's cyber threat intelligence platform.
Whereas typical dark web monitoring starts from "whether information has leaked," Cognyte emphasizes analysis that goes as far as the attacker's intent and background.
LUMINAR collects information not only from the dark web and deep web but also from social media, closed hacker forums, Telegram and more, and uses AI to correlate it in real time.
What stands out is that it can track and profile threat actors (the attackers) themselves.
Based on past activity and behavioral patterns, it can organize "who" is handling the information and "for what purpose," which makes it easier to prioritize the response.
As of 2026, it also incorporates support from an AI co-pilot powered by generative AI, letting you check the threat situation in natural language without writing specialist queries.
This is designed to lower the analysis workload while keeping false positives down.
Its monitoring is broad, covering areas such as:
- The circulation of credentials and internal data
- Whether externally exposed assets are being targeted
- Phishing and impersonation that abuse your brand
- Activity on ransomware groups' leak sites
In Japan, it is offered through partner companies not only as a platform but also as an operational support service run by analysts.
This service suits cases such as:
- You want to keep following the activity of attacker groups
- You want to understand the flow of an attack, not just detect one-off leaks
- Organizations that require advanced threat analysis, such as financial institutions and government agencies
Cognyte is easiest to understand as an intelligence platform for organizations that want to anticipate "what is likely to happen next" more than "what has leaked."
Cognyte (LUMINAR): https://www.sompocybersecurity.com
KELA (via Lumint Japan)
In Japan, KELA's dark web monitoring is offered through partners such as Lumint Japan.
As of 2026, it stands out for being used not just to detect data leaks, but as intelligence for catching the earliest signs of attack planning.
KELA's distinguishing feature is that, rather than "collecting large volumes of information," it carefully selects and notifies you only of threats that are highly likely to lead to actual damage. By combining proprietary algorithms with review by expert analysts, it is designed to eliminate as much noise as possible.
Automated monitoring for enterprises is handled by LUMINT.
It tracks ID-trading marketplaces on the dark web and the leak sites of more than 100 ransomware groups around the clock, and notifies you only when information related to your organization is found.
Heading into 2026, it has also strengthened its coverage of areas that easily lead to secondary damage, such as the misuse of customer IDs and payment information, and of new threats targeting generative AI (LLMs).
KELA uses several solutions depending on the purpose:
- LUMINT
SaaS that automatically monitors and notifies you of threats related to your organization. - KELA Investigate
An analysis tool for in-depth investigations, including historical dark web data. - AiFort
A new solution aimed at countering attacks that target LLM and generative AI environments.
In Japan, by introducing it through partners such as Lumint Japan, you can also receive reports in Japanese and support that includes operations outsourcing. A practical advantage is that it can be used as a "dark web exploration service" even if you don't have a dedicated in-house analyst.
This service suits organizations that:
- Want to detect signs of an attack as early as possible
- Belong to high-risk industries such as manufacturing or critical infrastructure
- Want to plan countermeasures on the premise of active cyber defense
KELA is easiest to understand as an intelligence platform for companies that want to catch "the warning signs of what's about to happen" rather than "what has happened."
KELA: https://www.kelacyber.com
UGINT® (Digital Forensic Laboratory Co., Ltd.)
UGINT®, rolled out in Japan by Digital Forensic Laboratory Co., Ltd., is a platform built for investigation- and analysis-grade intelligence that combines dark web investigation with understanding of the attack surface.
It is based on a platform developed by the Israeli company UGINT, and as of 2026 is provided in Japan mainly by Digital Forensic Laboratory.
Rather than an automated monitoring tool, it is distinguished by a design intended for use by law enforcement agencies, the CSIRTs of large enterprises, public bodies and critical infrastructure.
UGINT® collects information not only from dark webs such as Tor and I2P, but also from Telegram, Discord, closed hacker forums and paste sites that don't appear in ordinary search engines.
It is also valued for capturing new posts and circulating information in near real time.
Its particular strength is analysis centered on attackers (actors).
It offers a rich set of functions for following "who is acting," such as linking the activity of the same person spread across multiple forums and visualizing their exchanges and relationships.
Digital Forensic Laboratory, the domestic provider, offers support that goes beyond licensing to include spot investigations, analysis reports in Japanese and, where needed, a handoff to forensic investigation.
This service suits organizations that:
- Want a deep understanding of attackers' intent and background
- Are public bodies or critical infrastructure facing advanced threats
- Want information closer to "investigation and analysis" than to detection
UGINT® is easiest to understand as an analysis platform for understanding the structure of attacks themselves, rather than a tool for monitoring the dark web.
UGINT®: https://dflabo.co.jp
Managed service providers (MBSD / JSecurity / ALSI / Fujitsu, etc.)
Managed service providers such as MBSD, JSecurity, ALSI and Fujitsu are characterized less by offering dark web monitoring on its own and more by comprehensive support combined with incident response and forensics.
These services don't just detect information circulating on the dark web; they treat the initial response when a real problem is confirmed, the root-cause investigation and the scoping of impact as a single continuous flow.
As a result, our impression is that they're often chosen by companies that want to hand over "how to respond" to an outside party as well, rather than interpreting and judging monitoring results themselves.
The delivery models are also relatively flexible, and they can be used in forms such as:
- Spot investigations and reports
- Continuous monitoring and regular reports
- Emergency response when an incident occurs
to match your organization's structure and maturity.
This type of service suits organizations that:
- Can't secure enough dedicated security analysts
- Want to consolidate everything, including incident response, in one place
- Want to reduce the burden of operating tools and analyzing results in-house
On the other hand, if you want to analyze threat information yourselves and use it day to day, a platform-type service may suit you better.
Managed service providers are easiest to understand as "a realistic option for companies that want to outsource dark web monitoring as an operational task."
For real examples of markets where leaked information is traded, see the article below.
Russian Market: What a Dark Web Marketplace Reveals About How Data Leaks Today
What to Look for When Choosing a Dark Web Monitoring Company
When considering dark web monitoring, comparing only on price or the number of reports makes it easy to make the wrong call. From a practical standpoint, that's not what matters.
The points where differences tend to show up in the field include, for example:
- How deep the investigation goes
Whether it includes invitation-only forums and closed areas. - Whether it relies on automated detection alone
Or whether human analysis and judgment are involved. - How the information found is interpreted and organized
Whether it's just a list, or explained along with its danger level and background. - Whether it's explained in connection with your own environment
Whether you can tell "what this information means for us."
If you misjudge these points, you tend to end up with "lots of information, but we still don't know how to make a decision."
"Finding" and "turning it into a decision" are two different things.
When choosing dark web monitoring, we feel that comparing with this difference in mind ultimately saves you a detour.
Dark Web Monitoring Matters Most "Now, When Nothing Is Happening"
Dark web monitoring isn't something you introduce after something has happened.
Rather, it's an area you can check calmly precisely because nothing is happening now.
Attacks don't necessarily begin dramatically.
Preparation proceeds quietly, and by the time you notice, the conditions may already be in place.
Where, and how, are your company's name, domains and accounts being handled right now?
Checking even once is, in our experience in the field, already part of prevention.
