Leaked credentials and lookalike domains join Ontinue's ION MXDR analyst queue

The threat here needs no exploit. Ontinue's release describes compromised credentials traded across criminal forums and lookalike domains created to impersonate trusted brands ^[16]. I think finding a leaked password is the cheaper part of the job. The expensive part is getting it changed before whoever bought it logs in, and the release says exposed credentials can show up on the dark web within 24 hours ^[13].

Ontinue says its analysts handle the expensive part. "Most dark web monitoring solutions stop at detection," said Moritz Mann, CEO of Ontinue. "ION for Dark Web Monitoring goes further by investigating findings, assessing risk, and helping customers take action before exposures become incidents." ^[8] Findings go through the ION SecOps Platform to the same Cyber Defense Center analysts and automation workflows that already cover customer environments around the clock ^[3]. They are worked with the processes behind what Ontinue calls its Agentic SOC ^[11].

The release attributes its 19% figure only to "reports" ^[14]. It puts the gap down to staffing: many organizations receive threat intelligence feeds and dark web alerts but lack the resources to investigate them, judge relevance or coordinate a response ^[15].

By that account the add-on sells triage labour. The one customer quoted describes it as an addition to what Epiq already runs. "ION for Dark Web Monitoring expands our visibility beyond our existing tools, giving us better insight into external risks and bringing validated findings into the managed security operations we already trust," said Jason Burzenski, Vice President, Global Head of Cyber Security at Epiq ^[9][10].

The release calls its intelligence sources curated and trusted, and says they cover the clear, deep and dark web ^[2]. It does not name them, list which response actions apply to a leaked account, or give a price ^[12].