Dark Web Monitoring for NZ Businesses
Find out when your business domains, staff email addresses or key people appear in breach data or stealer logs. Exodesk reviews each match, explains what it means and helps you respond.
Supporting New Zealand businesses since 1989
What is dark web monitoring?
Dark web monitoring looks for information linked to your business in the breach data and other sources available to the monitoring service. A match can reveal exposed credentials or information that needs investigation. It does not mean every account is compromised, and an alert may arrive after the information has already been used.
Exodesk offers dark web monitoring for NZ businesses, on its own or alongside our managed IT and cyber security services. Talk to us about the domains you need covered, who should receive alerts and the support you need when a match is found. See what is monitored.
What does the service monitor?
We agree the identifiers your dark web monitoring will watch before it starts, and confirm that you have authority over each business domain.
Business domains
We monitor the agreed business email domains for matching staff addresses and credentials in the breach datasets and stealer logs available to the service.
Staff email addresses
Individual work addresses within those domains, so each match can be traced to an account and an owner.
Named people
Agreed key people, such as directors or finance staff, including personal email addresses they ask us to include.
Which sources are included?
The dark web monitoring service checks two kinds of source: breach and leak datasets, where email addresses and passwords from breached services are published or traded, and stealer logs, which are collections of credentials taken from infected devices by information-stealing malware.
The service does not supply session cookies or tokens. Where a stealer log suggests that a device was infected, the response treats possible session theft as part of the investigation rather than relying on the alert to show it.
What does a dark web alert mean?
An alert means information matching a monitored identifier has been found. The next step is to establish which account or service it relates to, what was exposed and when the data was collected.
An email address from an old breach needs a different assessment from a recent stealer log containing credentials for an active account. We triage each alert by risk rather than by a fixed timetable: an old record for an active administrator account can be urgent, while a newer email-only match may need a lighter response.
Credentials from an infected device
A potentially serious exposure. Check the account, service, source date, discovery date and any device details. The record may be old, recycled or from a personal device rather than a work machine.
Address in a third-party breach
An email address in another service’s breach does not by itself mean the mailbox, domain or network was compromised. Confirm which fields were exposed, which service was affected and whether the password was reused.
Recycled or historical data
Repeated records are grouped so the same exposure is not reported twice. Age alone does not make an exposure harmless, because a reused password can still work elsewhere.
A named person’s exposure
A personal address or password linked to a director or finance user. Assess password reuse, account recovery links and the potential for targeted phishing or impersonation.
How do review and escalation work?
Dark web monitoring, alert review and response are separate pieces of work, and the scope records who does each one.
Agree the scope
We confirm the domains, named people and alert recipients, and check your authority over each domain.
Monitor the sources
Dark web monitoring checks breach datasets and stealer logs for matches against the agreed identifiers.
Review each match
Our team reviews each alert, groups repeated records and works out which account, service and dates it relates to.
Explain and advise
We tell the agreed contact what was found, what it means for that account and which actions we recommend.
Act where we support you
For businesses whose IT we support, we carry out password resets and session revocation. Device investigation and wider incident work are scoped separately.
If another provider or an internal team runs your day-to-day IT, we pass our findings and recommended actions to them. Dark web monitoring runs automatically, but people review the alerts, and it is not a staffed around-the-clock response service. We confirm our alert review hours, your escalation contacts and the arrangements for urgent findings before monitoring starts.
What happens after an alert?
The response depends on what has been found. Suspected active compromise needs prompt containment, which may include blocking access and isolating an affected device.
- Use a trusted device. Change credentials from a device that is not suspected of infection, or the replacement password may be captured too.
- Revoke sessions. Revoking Microsoft Entra sign-in sessions invalidates refresh tokens. Microsoft notes that existing access tokens may remain usable until they expire, although supported continuous access evaluation can shorten that window. Some applications manage their own sessions and need separate action.
- Check what changed. Review sign-ins, inbox rules, forwarding, app permissions and the MFA and recovery methods registered on the account.
- Investigate the source. A stealer log points to an infected device, which may be a work or personal machine. Address it before treating the account as safe.
- Confirm containment. Check that access has actually ended before returning to normal use.
Agree who owns those actions before dark web monitoring starts. Reviewing an alert, resetting an account and investigating a compromised device are different pieces of work.
Does phishing-resistant MFA solve stolen sessions?
Phishing-resistant sign-in methods, such as security keys and passkeys, make it harder to steal credentials at sign-in. They do not clean an already infected device, and a session that has been stolen after sign-in needs separate controls. Microsoft’s guidance on protecting tokens covers device-bound tokens and replay protection. Our multi-factor authentication guide explains the sign-in options.
What can dark web monitoring not tell you?
No provider sees every private marketplace, criminal conversation or stolen dataset. Information may be delayed, incomplete or recycled from an older breach.
- A clear result is not proof of safety. Your business may be exposed in sources the service does not see.
- A match is not proof of compromise. It does not establish that the password or session is still usable.
- Timing varies. Detection depends on when a source becomes available and is collected, so exposure or misuse may predate the alert.
- Stolen copies stay in circulation. Monitoring cannot remove data once it has been shared.
Dark web monitoring adds visibility. It does not replace identity and access management, device protection or an incident response plan.
Who is dark web monitoring for?
Dark web monitoring suits businesses that want to know when their credentials turn up outside their own systems.
- Staff use work addresses on other sites. The National Cyber Security Centre warns that business credentials used on a breached website can give attackers a way into work email.
- Key people are targets. Directors, finance and administrator accounts carry more risk if their credentials are exposed.
- Cloud services hold your work. Cloud accounts can be targeted remotely. Stolen credentials are a risk, with access also depending on MFA, device requirements and other controls.
- You hold personal information. Knowing about exposed credentials early supports your security safeguards.
Can I check my domain myself?
Have I Been Pwned offers a domain search, but it is not a quick anonymous check. You must verify that you control the domain, and the results shown depend on the subscription level, with stealer log data in the higher tiers. A search with no results is not proof of no exposure.
How does it fit with other security services?
Dark web monitoring finds exposure in external data sources. Other services cover different parts of the risk.
Endpoint security addresses threats on the devices your staff use, including the malware that produces stealer logs. Managed detection and response investigates and responds to suspicious activity in the systems it covers. Strong, unique credentials reduce the damage when an address does appear, and our secure passwords guide covers the habits that help.
These services work together. Our cyber security services page shows how they fit into a wider programme.
Does an alert mean a notifiable privacy breach?
Not automatically. A dark web alert can prompt a privacy assessment, but it does not by itself establish a notifiable breach.
Under the Privacy Act, a breach becomes notifiable when it has caused, or is likely to cause, serious harm. The Privacy Commissioner explains what counts as a notifiable privacy breach, and the assessment depends on what was exposed and your responsibilities for that information. Our guide to Privacy Act security safeguards explains the security safeguards.
How is the service scoped?
Dark web monitoring is available on its own or alongside our managed IT and cyber security services, and quoted once the scope is agreed. The main factors are:
- Domains. The number of business domains to monitor.
- Named people. Any key people and personal addresses included.
- Alert handling. Who receives alerts and how urgent ones are escalated.
- Response. Whether we carry out resets and session revocation as your IT provider, or advise your own team.
Device investigation and incident response work are quoted separately when they are needed.
Is there an initial scan?
Yes. Once your authority over the domain is confirmed, we can run a free, no-obligation initial scan and talk you through what it shows. It may or may not find exposed records, and a clear result is not a guarantee that nothing has been exposed.
Why work with Exodesk?
Reviewed alerts
Our team reviews each dark web monitoring match and explains what it means for the affected account before recommending action.
Response included for supported clients
Where we run your IT, we carry out the resets and session revocation, so alerts lead to action.
Christchurch and Dunedin
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
Dark web monitoring questions
What is dark web monitoring?
Dark web monitoring looks for information linked to your business in breach data and other sources available to the monitoring service. A match can reveal exposed credentials or information that needs investigation. It does not mean every account is compromised.
Does dark web monitoring prevent a breach?
It can help identify exposure and support a response, but it does not stop the original theft or guarantee an alert before misuse. Use it alongside account protection, device security and a clear incident response process.
What does Exodesk monitor?
We monitor your business domains, staff email addresses and agreed named people, including personal addresses they ask us to include. The service checks breach and leak datasets and stealer logs. We confirm your authority over each domain before monitoring starts.
Does the service monitor session cookies?
No. The service covers breach datasets and stealer logs but does not supply session cookies or tokens. Where a stealer log suggests an infected device, the response treats possible session theft as part of the investigation.
Does a stealer log alert mean a work device is infected?
Not necessarily. It is a potentially serious exposure, but the record may be old, recycled or from a personal device. Check the account, service, source date and any device details before deciding on the response.
Is a password reset enough after a stealer alert?
Not necessarily. The exposure may include sessions or other accounts, and an infected device can steal replacement credentials. Use a trusted device, review affected access, revoke relevant sessions and investigate the suspected source.
Does revoking sessions end access straight away?
Not in every case. Revoking Microsoft Entra sign-in sessions invalidates refresh tokens, but existing access tokens may remain usable until they expire, although supported continuous access evaluation can shorten that window. Some applications manage their own sessions and need separate action, so confirm that affected access has ended.
Does a breach data match mean our domain was hacked?
No. An email address in another service breach does not by itself show that your mailbox, domain or network was compromised. Confirm which fields were exposed, which service was affected and whether the password was reused.
Who acts on an alert?
Our team reviews each alert and explains what it means. For businesses whose IT we support, we carry out password resets and session revocation. Device investigation and wider incident work are scoped separately.
Can we use dark web monitoring if another provider runs our IT?
Yes. The service is available on its own, and we pass our findings and recommended actions to your provider or internal team. The scope records who receives alerts and who acts on them.
Is the Have I Been Pwned domain search enough?
It is a useful check, but you must verify control of the domain and the results depend on the subscription level. A search with no results is not proof of no exposure.
Does a dark web alert mean we must notify the Privacy Commissioner?
Not automatically. An alert can prompt a privacy assessment, and a breach is notifiable when it has caused, or is likely to cause, serious harm. The assessment depends on what was exposed and your responsibilities for that information.
Is there a free initial scan?
Yes. Once your authority over the domain is confirmed, we can run a free, no-obligation initial scan and explain what it shows. It may or may not find exposed records.
Find out what is already exposed
Tell us the domains you need covered, who should receive alerts and the support you need when a match is found. We can start with a free, no-obligation initial scan.
Talk to us about dark web monitoring
Tell us a little about your business and the domains you want covered, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941