A disclosure before anything else: SphereTI sells credential exposure monitoring. You should read what follows knowing that, and you should use these questions on us as readily as on anyone else. The reason for writing them down is that a buyer armed with them gets a better service from whoever they choose, and a vendor who cannot answer them deserves to lose the deal.
The problem with this category is not that the products are bad. It is that the marketing is structurally uncomparable. Every provider says it monitors the dark web. Each means something different by it, none of them publishes what they miss, and the result is a procurement exercise conducted entirely on adjectives.
Start with the sources, not the dashboard
Every demo looks good. A dashboard is a solved problem. What differs between providers is what flows into it.
Ask which source types they cover, and insist on the list. There are three that matter and they behave completely differently. Breach data comes from a specific organisation’s compromise, so the source is known and dateable. Stealer logs are the output of malware on an individual machine, usually a personal one, and arrive with session cookies and device detail attached. Combolists are credential pairs reshaped for bulk use, with provenance usually destroyed in the aggregation. A provider strong in one is not automatically strong in the others.
Ask how often each source refreshes, separately. Not the product, the sources. Continuous in a brochure often means one source polls continuously and the others arrive monthly.
Ask what they do not see, and treat a straight answer as a positive signal. Nobody sees everything. Material that moves privately, inside closed groups, or through channels nobody is in, is invisible to every vendor in this market. A provider claiming full coverage is describing an ambition. The useful answer sounds like a limitation.
Then ask what a finding actually contains
This is where providers separate, and it is the part demos skip.
Does a finding name its source type? Breach, stealer log or combolist. This single field decides your response. A breach-sourced credential needs a password reset. A stealer-log-sourced credential means malware was reading a browser profile, so the device comes first, because resetting on a still-infected machine just produces a new exposed password. A combolist appearance points at your login endpoint rather than at one user. A report that omits this is handing you a guess.
Does it tell you what the credential authenticated to? A username alone starts an investigation. A username plus the service starts a remediation.
Does it carry a date, and do they explain what the date means? Most reports carry one date per record, and it usually marks when the record became visible rather than when the credential left the machine. Those can be far apart, because logs are collected, repackaged and resold before anyone indexes them. Ask which theirs is. Many vendors have never been asked and will have to check.
Does it report what arrived alongside the credential? Session cookies matter disproportionately, because a stolen session can be resumed without the password and without the second factor, so a reset and an MFA prompt both miss it.
Can you test an exposed value against your own directory without handling plaintext? This is the highest-value filter in the whole workflow and it is frequently absent. A credential rotated out eighteen months ago is noise. One matching a live password is an incident.
Ask how they count, before you compare any numbers
Vendors publish volume figures and buyers compare them. The comparison is almost always meaningless, because the unit differs.
Ask what one record means. One credential, one log file, one infected host, or one line in a file. A provider counting lines will report numbers an order of magnitude larger than one counting hosts, for identical visibility.
Ask what gets deduplicated and on what key. A rule that treats the same credential as new whenever it reappears under a different breach date will inflate counts without adding information.
Then stop comparing totals. Two providers' volume figures measure their own collection, not the threat. The useful comparison is whether each finding is actionable, not how many arrive.
Be sceptical of the market share claim
The most common claim in this category is some version of: most stolen data is now found here, and we are strongest there.
That claim is circular. A vendor whose collection concentrates on a particular channel will naturally find most of its data there, and almost none publish a denominator, a sampling frame or a deduplication method. The figure describes their pipeline, not the world.
There are exceptions worth knowing about, because they show what a real measurement looks like. Flare Research analysed roughly 44 million stealer logs collected between June 2024 and June 2026 and published findings with significance testing in September 2026. That is a stated corpus, a stated window and a stated method. Ask any vendor quoting a market figure which of those three they are willing to put in writing.
Know what the free option already does
Before paying anyone, know the baseline, because several providers price against a gap that has partly closed.
Have I Been Pwned added stealer log data in February 2025: 23 billion rows obtained from a Telegram channel, covering 284.1 million unique email addresses. An organisation that has verified control of a domain and holds a suitable subscription can query which websites an address appeared next to, drawn from a set of around 220 million domain pairs covering 69 million of 71 million addresses.
So the old pitch that free tools only know about publicly disclosed breaches is no longer true, and a vendor still using it either has not noticed or is hoping you have not.
What the free option does not give you is equally clear, and its own documentation says so. It returns the domains an address appeared next to, not the password. It does not identify the infected machine. It does not say whether that machine is still infected. Its author describes the data as prepared and sold by criminals who provide zero guarantees as to accuracy, notes that the owner of an address may never have visited the indicated website, and calls the feature experimental. Results are not surfaced automatically on a domain search.
Those gaps are the honest case for paying for something. We see things free tools cannot is not.
Test the trial properly
Most providers will run a free report. Use it as an experiment rather than a demo.
Give them a domain and see what comes back unprompted. Do not supply known-exposed accounts. You are testing discovery, not recall.
Check whether you can tell, from the output alone, what to do first. If you have to ask the vendor to interpret their own report, that is the product you are buying.
Count how many findings are actionable rather than how many there are. Deduplicate by person and by apparent device yourself. A hundred rows from one compromised laptop is one incident, not a hundred.
Ask what they would have missed. A vendor who can describe the shape of their blind spot has thought about it.
One thing nobody will tell you to do
Read the current standard, because it changes what you are buying for.
NIST SP 800-63B Revision 4, section 3.1.1.2, states that verifiers and credential service providers shall not require subscribers to change passwords periodically, and in the same item that verifiers shall force a change if there is evidence that the authenticator has been compromised.
Scheduled rotation is now prohibited. Rotation on evidence is required. That pairing only functions if evidence reaches you, which is the actual thing this category sells. Not visibility for its own sake, but the trigger that a standard already requires you to act on. A provider who understands that will talk about how findings reach your process. One who does not will talk about the size of their database.
Check your own exposure
SphereTI monitors credential exposure across breach data, infostealer logs and credential lists, and reports which of your domains appear, where the credential came from and when it surfaced. Request a free exposure report. No password is needed, and the questions above apply to us too.