What the scan checks

Passguard’s scan searches for your domain across the most important criminal marketplaces, including dark web forums, Telegram, and Discord. It identifies infected devices that contain sessions, credentials, or cookies associated with your domain. This is fundamentally different from traditional breach monitoring, which only checks against leaked databases from past data breaches.

What to do when your company is found

If the scan reveals that your organization appears in stealer logs, you should:

• Revoke affected sessions: identify which sessions and credentials are compromised and revoke them immediately. Password resets alone are not sufficient, since stolen session tokens remain valid until explicitly revoked.

• Investigate the infected device: use the device information in the log, such as hostname, OS, and IP, to identify and isolate the compromised device.

• Set up continuous monitoring: a one-time scan shows current exposure, but new infections happen continuously. Ongoing monitoring ensures you are alerted to future compromises.

Why regular checking matters

Research by Hadrian and Passguard showed that organizations face multiple infostealer infections per year on average. A single scan shows your current exposure, while continuous monitoring catches new threats as they appear. Passguard offers both: a free one-time scan and ongoing monitoring that alerts your security team the moment stolen sessions linked to your domain appear on criminal markets.