How to setup a Dark Web Monitor
This guide explains how to configure the Dark Web Monitoring feature within the CYRISMA platform. You can set up monitoring for either an entire Domain or specific Email Addresses associated with your organization.
- User Manual
- Agents
- The Cyber Risk Assessment Process
- API Documents
- General Questions and Troubleshooting
- The Cyber Risk Assessment Process (Video Tutorials)
- Sales and Prospecting Articles
- CYRISMA Partner Portal Access
- Glossary
- CYRISMA Change Log
- Support Ticket SLA
- Onboarding Framework
- PSA Integrations
- Billing Questions
- Self Onboarding Guide
Table of Contents
Domain Monitoring Setup
Step 1: Access Dark Web Domain Monitor
- Navigate to Dark Web → Setup Dark Web Monitor.
- Choose the Domain Monitor option.
Step 2: Enter Domain Details
- Input Domain: Enter your organization’s primary domain (e.g., yourcompany.com).
- Company Name: Enter the company name associated with the domain you want to monitor.
Step 3: Activate Domain Monitor
- Click Submit to activate Domain Monitoring.
Your organization's domain will now be continuously monitored for any compromised information appearing on the dark web.

Email Address Monitoring Setup
Step 1: Access Dark Web Email Monitor
- Navigate to Dark Web → Setup Dark Web Monitor.
- Select the Email Address Monitor option.
Step 2: Enter Email Address Details
-
Input Email Address(es): Enter specific email addresses you wish to monitor (e.g., johndoe@yourcompany.com).
- You can add multiple email addresses separated by commas or by uploading a CSV file if available.
- Company Name: Enter the company name associated with these email addresses.
Step 3: Activate Email Monitor
- Click Submit to activate Email Address Monitoring.
CYRISMA will now monitor the specified email addresses and notify you if they appear compromised on the dark web.

Dark Web Monitor Results Overview
The Dark Web Monitor provides critical insights into the security of your organization's data by tracking breaches involving personal or sensitive information. Here's a breakdown of what the results tell us:
Total Number of Breaches:
- The “Total Number of Breaches” number gives a sense of the scale of exposure and alerts you to the frequency of incidents related to your organization.
Most Dangerous Breach:
- “Password,” indicates the password-related breaches that are most significant concern for your organization, potentially representing a large portion of exposed credentials.
Breach Data Visualization:
- The color-coded pie chart and bar graph categorize the type of information exposed in each breach:
- Password (purple):
- Name (blue):
- Location (pink), Phone (purple), Username (gray), and IP Address (light blue)
Victim Accounts and Findings:
- Under each breach category, victim accounts are listed, showing which specific accounts were affected. For instance, the "Password" category lists accounts with each showing a number of findings (i.e., how many times this account’s data was exposed).
- The "Last Seen" column shows the most recent time the data was found on the dark web, helping track when the breaches were identified.

- Focus on Critical Breaches: Pay close attention to the category with the highest number of breaches, as this represents the most significant area of concern.
- Monitor Exposed Data: Even if certain categories show fewer instances, exposed personal or identifying information can still pose a risk to your organization and should be mitigated.
- Account Monitoring: Continuously monitor accounts that appear in the breach results and implement security measures such as changing passwords, enabling multi-factor authentication, or other protective actions.
By analyzing the dark web monitor results, you can prioritize security efforts and take steps to protect your organization from the risks associated with exposed data.