Search for “dark web monitoring tool” and you will find dozens of vendors that all promise to watch the dark web for you. They are not the same. Some are full threat intelligence platforms built for large analyst teams. Some are managed services that do the work and send you alerts. Some are breach-notification tools that only check published breach data.
This guide compares eight well-known options for businesses in 2026, explains how we evaluated them, and suggests which type of tool fits which situation.
Disclosure: this comparison is published by ACID Technologies, and ACID is one of the tools listed. We have tried to describe every vendor fairly, using their own public materials. We do not have inside knowledge of competitors’ products, so check details directly with each vendor, and run a trial against your own domains before you buy.
How we evaluated the tools
We compared each tool against six criteria that matter most when a business buys dark web monitoring:
- Source coverage. Dark web markets and forums, ransomware leak sites, paste sites, infostealer log markets, Telegram and other messaging apps, and the deep web.
- Tailoring. Whether keywords are set for your organization (domains, brands, executives, systems) and in which languages.
- Alert quality. How quickly alerts arrive, how much context they include, and how much noise the team has to filter.
- Delivery and integrations. Dashboard, email, SIEM/SOAR and API options.
- Operating model. Self-service platform, managed service with analysts, or a mix.
- Pricing model. Whether pricing is published or quote-based, and what drives cost.
We based descriptions on vendors’ public websites, product documentation and press materials available in September 2026. We did not score vendors numerically, because the right choice depends heavily on your team and use case.
Comparison at a glance
| Tool | Type | Best for | Coverage highlights | Delivery | Pricing |
|---|---|---|---|---|---|
| ACID Technologies | Managed dark web monitoring service | Organizations that want tailored, analyst-grade alerts without building an intelligence team | Dark web, deep web, leak and paste sites, Telegram and chat platforms; planning-stage detection; digital identity protection (DIP) | Dashboard, email, SIEM/SOAR, API | Quote-based |
| Recorded Future | Threat intelligence platform | Large security and intelligence teams | Very broad open, technical and dark web intelligence across many use cases | Platform, integrations, API | Quote-based |
| Flashpoint | Threat intelligence platform | Intelligence, fraud and physical security teams | Deep coverage of illicit forums, chat and markets; vulnerability intelligence | Platform, API | Quote-based |
| ZeroFox | External cybersecurity and digital risk protection | Brand protection and takedown programs | Social media, domains and dark web; takedown services | Platform, managed services | Quote-based |
| Cyble | AI-driven threat intelligence platform | Mid-size and large teams wanting broad external risk coverage | Dark web, attack surface and brand monitoring | Platform, API | Quote-based |
| SOCRadar | Extended threat intelligence platform | Teams wanting a combined threat intel and attack surface tool | Dark web, attack surface, brand protection, supply chain | Platform, integrations | Quote-based; free edition available |
| KELA | Cybercrime intelligence platform | Teams focused on cybercrime forums and threat actors | Closed cybercrime forums, markets and actor profiling | Platform, API | Quote-based |
| Constella Intelligence | Identity risk intelligence | Identity, fraud and account takeover programs | Large collection of breached and leaked identity records | API, platform | Quote-based |
| Have I Been Pwned | Breach notification | Individuals and small teams checking published breaches | Published breach collections | Web, notifications, API | Free and paid API |
The tools in detail
ACID Technologies
What it is: a managed dark web monitoring and threat intelligence service, delivered through the ACID Intelligence platform, with ACID DIP for digital identity protection and an Enterprise bundle.
Strengths:
- Keywords are defined for each client and translated into the languages that matter to them, including regular expressions and non-Latin scripts.
- Covers dark web and deep web sources, paste tools, dump and leak sites, and chat and messaging platforms including Telegram, 24/7/365.
- Built to detect attacks in the planning stage, such as access offers and targeting chatter, as well as data already leaked.
- Alerts arrive in real time on the dashboard and by email, SIEM/SOAR or API, with follow-up updates as more intelligence comes in.
- DIP adds monitoring of websites, DNS, lookalike domains and app stores for phishing and impersonation.
Things to consider: ACID is a focused monitoring and alerting service rather than a broad all-purpose intelligence platform. Teams that want to run their own open-ended investigations across every intelligence type may pair it with, or prefer, a larger platform.
Best for: banks, healthcare providers, critical infrastructure, government bodies and other organizations that want tailored, actionable alerts without building an in-house dark web intelligence team. See the dark web monitoring service or request a free dark web scan.
Recorded Future
What it is: one of the largest threat intelligence platforms, covering open, technical and dark web sources, with modules for brand, third-party, vulnerability and geopolitical intelligence. Recorded Future was acquired by Mastercard in 2024.
Strengths: very broad data collection, many intelligence modules, and wide integration support with security tools.
Things to consider: the breadth that makes it powerful also makes it a significant investment in both licence cost and analyst time. Smaller teams may use only part of what they pay for.
Best for: large enterprises and governments with dedicated intelligence analysts.
Flashpoint
What it is: a threat intelligence platform known for its collection from illicit online communities, including forums, chat services and markets, with vulnerability and physical security intelligence.
Strengths: deep coverage of cybercrime and extremist communities, and intelligence products used by fraud, security and physical security teams.
Things to consider: like other large platforms, it gets the most value in the hands of trained analysts.
Best for: intelligence teams in large enterprises, financial services and the public sector.
ZeroFox
What it is: an external cybersecurity vendor focused on digital risk protection: monitoring social media, domains, the dark web and other external sources for threats to brands and people, with takedown services. ZeroFox was taken private in 2024.
Strengths: strong focus on brand and executive protection and on removing malicious content.
Things to consider: evaluate how deep its dark web coverage is for your sector compared with dedicated dark web monitoring providers.
Best for: organizations whose main concern is brand impersonation, social media threats and takedowns.
Cyble
What it is: an AI-driven threat intelligence company offering dark web monitoring alongside attack surface management, brand protection and vulnerability intelligence.
Strengths: broad external risk coverage in one platform, with a strong research presence.
Things to consider: check how alerts are tuned to reduce noise for your organization and what level of analyst support is included.
Best for: mid-size and large security teams that want several external risk functions in one tool.
SOCRadar
What it is: an extended threat intelligence platform that combines dark web monitoring, attack surface management, brand protection and supply chain intelligence.
Strengths: wide feature set and a free edition, which makes it easier to start small.
Things to consider: as with any broad platform, confirm which features and sources are included at your chosen tier.
Best for: security teams that want a combined threat intelligence and attack surface product.
KELA
What it is: a cybercrime intelligence company focused on closed cybercrime forums, markets and threat actors.
Strengths: deep focus on the cybercrime underground and threat actor tracking.
Things to consider: best suited to teams that will investigate and act on cybercrime intelligence themselves.
Best for: threat intelligence and CTI teams that want underground-focused research.
Constella Intelligence
What it is: an identity risk intelligence provider with a large collection of breached and leaked identity records, used for account takeover prevention, fraud and executive protection.
Strengths: identity-centric data and API access that suit fraud and identity programs.
Things to consider: its focus is identity exposure rather than broad dark web threat monitoring, such as attack planning or leak-site listings.
Best for: identity, fraud and customer account protection programs.
Have I Been Pwned
What it is: a well-known breach-notification service that lets people and organizations check whether email addresses appear in published breaches, with a paid API and domain search.
Strengths: free for individuals, simple, trusted and useful for awareness.
Things to consider: it covers breaches that have already been published and loaded into its database. It does not watch dark web forums, infostealer log markets, messaging channels or leak sites in real time, and it does not detect planning-stage threats.
Best for: individuals and small teams; as a supplement to, not a replacement for, business dark web monitoring.
Which type of tool fits your situation?
You have a dedicated threat intelligence team. A broad platform such as Recorded Future or Flashpoint gives analysts the most data to work with. Consider whether you also need a managed service for tailored alerting on your own organization.
You have a SOC but no dedicated intelligence analysts. A managed, tailored service such as ACID sends alerts that are ready to act on, straight into your SIEM or SOAR, without asking your team to search the dark web themselves.
Your biggest worry is phishing and impersonation. Look at digital risk protection tools such as ZeroFox, or ACID DIP for domain, DNS, website and app monitoring. See brand impersonation monitoring.
Your biggest worry is account takeover. Identity-focused data from Constella, or credential leak monitoring that covers infostealer logs, will matter most.
You are a small business on a tight budget. Start with free breach notification and a free dark web scan, then move to continuous monitoring as your exposure grows.
How to run a fair trial
Vendor demos always look good. A trial against your own organization is the only real test.
- Pick the same scope for each vendor: the same domains, brands and executives, for the same period.
- Ask what they found that you did not know. Old combo-list hits are easy; fresh infostealer logs, access offers and leak-site mentions are harder.
- Measure noise. Count how many alerts your team would actually act on.
- Check speed. Ask when each finding first appeared at the source and when you were alerted.
- Test delivery. Send alerts into your SIEM or ticketing system during the trial.
- Ask about languages and sources that matter for your region and sector, such as Telegram channels in Russian or Arabic.
Our guide on how to choose a dark web monitoring vendor has a full checklist.
Methodology and updates
This comparison reflects public information available in September 2026. Vendors change quickly through acquisitions, product launches and rebrands. We review this page every quarter. If you represent a listed vendor and believe something is inaccurate, contact us and we will review it.
For background on the category itself, read What Is Dark Web Monitoring? and Dark Web Monitoring for Business.