Part of Defend — dark web monitoring used to be documented under a separate Threat Intel product. It is now part of Defend. Your clients see their dark web results in HCP. Some menu names may still show the older Threat Intel name.
Overview
Dark web monitoring checks the email addresses of the users you manage against Enzoic's breach-exposure data. When a managed user's email turns up in a known breach, a finding is recorded and surfaced to your team. The monitoring is per-account and fully in-platform — there is nothing to set up and no domain to verify.
How Monitoring Works
Each address is checked once a week, and the week's checks are spread across the days. The background scanner itself runs daily, but each run works through only about a seventh of the roster — the day an address falls on is derived from a stable hash of the contact, so every contact is checked exactly once per seven-day cycle and no single day carries the whole book. Those two facts are easy to confuse: "the scanner runs daily" is true, "your address is checked daily" is not.
On each run, for every active (paid) tenant the scanner builds the roster of
addresses it monitors — your active CRM contacts that hold an email address, plus
any enrolled learner who has no CRM contact record — and asks Enzoic which known
breach exposures each of those addresses appears in. Each match is stored as a
dark-web finding, feeds the tenant's security-culture score, appears on the Dark Web
page for triage, and is projected onto the contact's CRM record. Genuinely new
findings also emit a platform event (cypher.dark_web.finding_detected) so
downstream workflows can react.
If a run cannot get through everything due that day, the addresses it did not reach are recorded and checked first on the next run — they are late, never dropped.
The first scan establishes a baseline: it returns every known breach each managed address has appeared in, not just newly added ones. Re-scans update existing findings in place (preserving any status you set — acknowledged, resolved, or false-positive) rather than duplicating them.
What Gets Checked
Monitoring is per-account by email, and it is automatic — there is no enrolment step. The addresses checked are your active CRM contacts that hold an email address, plus any enrolled learner who does not yet have a CRM contact record. You do not add individual monitors, domains, or keywords — the roster is derived from your contact records on every run, so coverage tracks the people you actually manage with no manual list to maintain.
Not currently supported: domain-wide monitors, keyword monitors, and paste-site scanning are not part of the live Enzoic integration. Enzoic gates domain search behind domain-ownership verification, and the integration deliberately avoids it to stay setup-free and in-platform. If an address is not being covered, the thing to check is the contact record — it must be active and hold that email address.
Reviewing Findings
Findings appear on the Dark Web page. Each finding includes:
- The breach title and date
- The data classes exposed (passwords, hashes, phone numbers, addresses, etc.)
- A severity derived from the exposed data classes
- The managed email address the exposure was found for
Set a finding's status to acknowledged, resolved, or false-positive as you work it; the status you set is preserved across future scans.
FAQ
How often does the scan run? Once per day. The exact schedule is set by the background worker.
Which addresses are monitored? The email addresses of the users you manage — your enrolled phishing/training roster. There are no manual monitors to add.
Can I monitor a whole domain or a keyword? Not with the current integration. Monitoring is per-managed-account by email only. See "What Gets Checked" above.
Will I see breaches from years ago? Yes. The first scan returns every known breach exposure Enzoic has on record for each managed address.
Why did a scan return nothing for an address I know was breached? Confirm the Enzoic credentials are configured for the platform and that the user is enrolled (present in your phishing/training roster) so their address is in the scanned set. Enzoic's corpus may also simply not contain that particular exposure.