Special Services • SP-06
Dark Web Monitoring
Find the exposure before it is used.
Scope
What the engagement covers.
Credentials, personal data and access are traded before they are exploited. Continuous monitoring across underground sources shortens the window between exposure and response.
Included capabilities
- Credential and session token exposure monitoring
- Personal data, document and identity document trading detection
- Corporate access brokerage and initial access listing monitoring
- Doxxing and targeting discussion detection
- Verified alerting with remediation guidance rather than raw dumps
Outputs and deliverables
- Selector register and monitoring configuration
- Verified exposure alerts with remediation guidance
- Periodic exposure summary report
- Remediation tracking record
Workflow
How it is delivered, step by step.
Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.
01RegisterSelectors covering the principal, family, entities and domains.
02MonitorContinuous collection across underground and closed sources.
03VerifyAnalyst validation to eliminate recycled and false exposures.
04AlertVerified alerts with immediate remediation guidance.
05RemediateCoordinated credential rotation, takedown and containment.
Use cases
Where this is typically applied.
Organizations whose access is being brokered for sale
Individuals subject to doxxing or coordinated targeting
Delivery model
The operating pattern for Special Services.
The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.
Assess
Threat picture, exposure, routine analysis and protective gap review.
Harden
Identity, device, communication, physical and information-domain controls.
Monitor
Continuous intelligence, exposure detection and early warning.
Respond
Containment, recovery, investigation and coordinated escalation.
Review
Post-incident learning, control adjustment and periodic reassessment.
Integration
- Client corporate security, legal counsel and communications functions.
- Existing IT and identity teams for account and device remediation.
- Insurers, local providers and law enforcement liaison where authorized.
- Family office and household staff protocols for the personal perimeter.
Engagement approach
Every mandate is scoped in writing with a named sponsor, defined coverage hours and a stated legal basis. Discretion applies to method and reporting channel, never to whether the work is lawful, authorized and recorded.
Related
Other capabilities in Special Services.
SP-01
Executive Digital Protection
Protect the person, not only the corporate perimeter.
SP-02VVIP Close Protection
Physical protection planned from intelligence, not from habit.
SP-03TSCM
Confirm the room is not listening.
SP-04Counter-Surveillance
Detect the people watching before they act.
SP-05Threat Intelligence
Early warning built from sources the principal cannot monitor alone.
SP-07Identity & Reputation Protection
Defend the name as carefully as the person.
SP-08Private Investigation
Lawful fact-finding that stands up when it is challenged.
SP-09Strategic Communications
Control the narrative before it controls the outcome.
SP-10Incident Response
When it has already happened, speed and evidence both matter.
SP-11Human Risk
The most reliable way in is still the person.
SP-12Clandestine Offensive Security
Adversary emulation run without warning the defenders.