Exposed credential alerts
We identify staff credentials exposed on the dark web. Your team then knows which accounts need review and protection.
Dark web monitoring
FunctionOne dark web monitoring for business
A dark web password alert means FunctionOne dark web monitoring has found a staff member's credentials exposed, so the affected account needs review and protection. We pair the service with multifactor sign-in. That pairing helps defend against automated attacks that try stolen passwords. Our first step with any client is a security assessment of systems and accounts. We agree on scope and response rules before anything is switched on.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What does FunctionOne dark web monitoring include?
FunctionOne, with offices in Syracuse, New York and Tampa, Florida, includes dark web monitoring in everyday IT and security work.
Multifactor sign-in
We pair the service with multifactor sign-in as part of our defense against automated attacks that try stolen passwords.
Assessment before setup
Your service starts with a security assessment of systems and accounts. We agree on scope and response rules with you before anything is switched on.
Analysts on watch 24/7
Security analysts watch connected systems around the clock. Containment happens only within the response rules you approve.
Behavior analytics and intelligence
We use AI for behavior analytics and threat intelligence. Our analysts confirm findings and act within your approved rules.
Leadership reporting
Leadership gets a monthly summary and a regular security review. Our reports name owners and next steps.
Fully or co-managed
We run dark web monitoring within fully managed IT or beside your in-house IT team.
Why does a dark web password alert matter to FunctionOne clients?
According to Microsoft Learn's What are risk detections? Microsoft Entra ID Protection (2026), Microsoft's leaked-credentials alert fires only when credentials from dark web forums, breach dumps or paste sites match a current password hash. That detection describes Microsoft's service alone.
Microsoft Learn's Remediate risks and unblock users (2026) advises acting quickly on found risk and notes that dismissing a risk leaves the password unchanged. Once a compromise is confirmed, Microsoft Learn's Remediate risks and unblock users (2026) says to request a password change, block the user if needed and revoke refresh tokens. A refresh token keeps a person signed in without a new password. FunctionOne flags the exposed account so it can be reviewed and protected, and containment stays within the response rules you approve.
In the joint #StopRansomware Guide (2023), CISA, FBI, NSA and MS-ISAC advise organizations to consider credential monitoring services that watch the dark web. The same #StopRansomware Guide (2023) from CISA, FBI, NSA and MS-ISAC calls for phishing-resistant MFA, especially for email, VPNs and accounts that reach critical systems. MFA, or multifactor authentication, asks for a second proof of identity at sign-in. FunctionOne pairs dark web monitoring with multifactor sign-in so a leaked password meets a second check.
What happens after FunctionOne flags a leaked password?
FunctionOne handles leaked credentials in a set order that you approve ahead of time.
Security assessment first
FunctionOne reviews your systems and accounts. We agree on scope and response rules with you before anything is switched on.
Exposed credentials identified
We identify staff credentials exposed on the dark web so the affected accounts can be reviewed and protected.
Analysts confirm and act
Our security analysts watch connected systems around the clock. They confirm findings and act only within your approved response rules.
Multifactor sign-in paired
We pair the alerts with multifactor sign-in to defend against automated attacks that try stolen passwords.
Leadership kept informed
Your leaders get a monthly summary and a regular security review, with owners and next steps named.
Why FunctionOne pairs password alerts with multifactor sign-in
Outside guidance treats a password differently once a second sign-in factor backs it up.
| Password as the only factor | Password with multifactor sign-in |
|---|---|
| 15-character minimum in NIST's 2025 SP 800-63B-4 guidance | 8-character minimum in NIST's 2025 SP 800-63B-4 guidance |
| Automated attacks that try stolen passwords face the password alone | FunctionOne pairs dark web alerts with multifactor sign-in against those attacks |
Who FunctionOne's dark web monitoring is for
FunctionOne serves established mid-size and large organizations from Syracuse, New York and Tampa, Florida.
Leaders who report upward
You answer to a board, insurer, auditor or parent company. Our reports give you owners and next steps.
IT directors with teams
We work co-managed beside your in-house IT team, or we run IT fully managed.
Multi-office organizations
Your staff work across several offices on laptops and phones, and we run all of it from a single control point.
Teams past the help desk
We make security part of everyday IT work for high-stakes operations that have outgrown a help desk.
Dark web alert questions for FunctionOne
What does a dark web password alert mean?
It means a staff login was found exposed on the dark web. FunctionOne identifies those exposed credentials so the affected accounts can be reviewed and protected, and we pair that work with multifactor sign-in.
Does a dark web alert mean the password still works?
Not always. Microsoft Learn's 2026 page What are risk detections? says Microsoft's own leaked-credentials alert fires only on a confirmed match with current password hashes. That rule describes Microsoft's detection only.
What should we do when a password shows up on the dark web?
Act quickly. Microsoft Learn's 2026 guide Remediate risks and unblock users says dismissing a risk leaves the password unchanged and, once compromise is confirmed, advises a password change, a block if needed and revoked refresh tokens.
Is dark web monitoring worth it for a business?
Joint security guidance says to consider it. The 2023 #StopRansomware Guide from CISA, FBI, NSA and MS-ISAC says to consider credential monitoring services that watch the dark web, alongside phishing-resistant MFA. FunctionOne uses dark web monitoring as part of defending against automated attacks that try stolen passwords.
How long should staff passwords be?
Staff passwords should be at least 15 characters when a password is the only factor, or 8 with multifactor sign-in, according to NIST's 2025 Digital Identity Guidelines (SP 800-63B-4), which also drop forced composition rules and periodic changes. FunctionOne pairs dark web alerts with multifactor sign-in.
Will FunctionOne act on our accounts without approval?
No. FunctionOne security analysts watch connected systems around the clock, and they contain threats only within the response rules your organization approves. We agree on those rules with you during the security assessment, before anything is switched on.
Sources
- Microsoft Learn, What are risk detections? Microsoft Entra ID Protection, 2026
- Microsoft Learn, Remediate risks and unblock users, 2026
- CISA, FBI, NSA and MS-ISAC, #StopRansomware Guide, 2023
- NIST, Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B-4), 2025