Cybersecurity That Acts Before the Attack: Early Detection of Stolen Credentials on the Dark Web

Today's attackers don't hack systems: they log in with valid credentials. 81% of security breaches occur because someone used credentials that were already compromised — and the organization didn't know it.

How attackers operate today

For years, the dominant attack model was technical: exploiting system vulnerabilities, looking for open ports, injecting malicious code. Technological defenses — firewalls, antivirus, patches — were designed to block that type of intrusion.

That model changed. Attackers discovered it is much easier to log in with valid credentials than to force a technical entry. And thanks to the thousands of data breaches over the last decade, there is an underground market with hundreds of millions of username and password combinations available for anyone who wants to buy them.

Why MFA is no longer enough

Multi-factor authentication (MFA) significantly reduced the risk of unauthorized access with a simple password. But attackers adapted. Today there are specific techniques to bypass MFA:

• Session cookie theft: once the user authenticates, the session is stored in a cookie. If that cookie is stolen via malware or a man-in-the-browser attack, the attacker can use the active session without needing a password or second factor.
• MFA fatigue: bombarding the user with approval requests until they accept one by mistake or exhaustion.
• SIM swapping: transferring the victim's phone number to intercept the SMS code of the second factor.

HEROIC specifically detects stolen session cookies circulating in criminal environments, allowing action before the attacker uses them.

What Dark Web monitoring is and how it works

The Dark Web is the part of the internet not accessible through conventional browsers and not indexed by search engines. It hosts illegal markets, criminal forums, and stolen data exchange channels. It is where corporate credentials, leaked databases, and access to compromised systems are bought and sold.

Dark Web monitoring consists of systematically tracking those spaces for information associated with a specific organization: corporate email domains, usernames, IP addresses, client data. When a match is detected, an immediate alert is generated so the organization can act before the attacker does.

HEROIC DarkWatch: continuous preventive detection

HEROIC is the Dark Web Monitoring platform that Cynersis implements in organizations in Chile. Its DarkWatch technology performs continuous preventive surveillance and offers:

• Real-time alerts when corporate credentials are detected in criminal spaces
• Identity integrity verification to confirm whether a credential is compromised before it causes damage
• Stolen session cookie detection that allows access even with active MFA
• Automatic rotation of compromised credentials to reduce exposure time
• Automated playbooks with response steps for each type of alert

The regulatory context in Chile: Law 21.663

The pressure to adopt preventive cybersecurity controls is not only technical: it is also legal. Law 21.663 on Cybersecurity and Digital Infrastructure, in force in Chile, establishes specific obligations for operators of vital importance (OIV): companies in critical sectors such as energy, water, telecommunications, health, and financial services.

Among those obligations is the timely detection and reporting of incidents. A breach caused by compromised credentials circulating on the Dark Web — that the organization did not detect because it had no monitoring — is exactly the type of scenario the law seeks to prevent and that can lead to sanctions.

From reactive to preventive security

The difference between an organization that detects a breach in minutes and one that discovers it weeks later is not luck: it is the security model. Reactive organizations wait for something to fail before acting. Preventive ones have visibility into threats before they materialize.

Dark Web monitoring is one of the controls that makes that difference. It does not replace perimeter controls or MFA: it complements them with intelligence on external threats that would otherwise be invisible.