Iffa Jayyana
In an era where cybersecurity is increasingly defined by the race toward automation, large language models (LLMs), and automated scraping tools, a fundamental shift is occurring in how high-stakes threat intelligence is gathered. While the market for dark web monitoring is crowded with industry titans like Recorded Future, Flashpoint, and ReliaQuest (via Digital Shadows), a new narrative is emerging that challenges the supremacy of automated data collection.
Kobe Shwartz, CEO of Underdark, posits that in the shadows of the internet, machines can only see so much. By engaging directly with threat actors through human-to-human interaction, Underdark is carving out a niche that separates "intelligence" from mere "data collection."
Main Facts: The Shift from Automation to Human Engagement
The cybersecurity industry has spent the last decade perfecting the art of the "crawler." These automated systems scan vast swathes of the dark web, indexing mentions of company assets, leaked credentials, and potential attack vectors. While efficient, these systems are inherently reactive. They see the output of a threat actor’s work, but they rarely see the intent or the negotiation process behind it.
Underdark operates on a fundamentally different premise. According to Shwartz, the company does not rely on automated scraping as its primary value proposition. Instead, the firm utilizes a strategy of "Human Intelligence" (HUMINT) adapted for the digital age. By infiltrating closed communities and directly engaging with threat actors, Underdark gains access to intelligence that is invisible to traditional automated tools—specifically, the internal motivations, future roadmaps, and private negotiations of cybercriminal syndicates.
Core Distinctions
- The Industry Standard: Reliance on AI-assisted human oversight of massive datasets scraped by automated crawlers.
- The Underdark Model: Direct, personal engagement with threat actors to extract intelligence that exists only in private, human-to-human conversations.
- Value Proposition: Converting "threat data" (passive indicators) into "threat intelligence" (active, actionable, and human-verified insights).
Chronology: The Evolution of Dark Web Intelligence
The trajectory of threat intelligence can be viewed in three distinct waves, each necessitating a more sophisticated approach than the last.
The Era of Static Defense (2000–2010)
In the early days, cybersecurity was primarily defensive. Firewalls and antivirus software were the gold standards. Intelligence was reactive, based on known malware signatures and historical attack data. The dark web was a fringe concern, largely ignored by enterprise security teams.
The Rise of Automation (2010–2020)
As cybercrime became professionalized, the "dark web monitoring" industry exploded. Companies like Recorded Future and Flashpoint revolutionized the space by building massive, automated indexing engines. These companies transformed the way CISOs viewed the dark web, providing real-time alerts on leaked data. This period established the "crawler" as the industry’s primary tool.
The Human-Centric Turn (2020–Present)
As threat actors moved from public forums to encrypted messaging apps and private, invite-only communities, traditional crawlers began to lose efficacy. The "noise" of the internet increased, making it harder to discern actual threats from posturing. Underdark’s rise marks the beginning of a third phase: the return to human intelligence. By shifting the focus from collecting data to engaging actors, firms like Underdark are attempting to get ahead of the attack lifecycle rather than simply reporting on its aftermath.
Supporting Data: The Market Landscape
The cyber threat intelligence (CTI) market is projected to reach billions in valuation by the end of the decade, driven by the increasing sophistication of ransomware-as-a-service (RaaS) models.
The Competitive Field
The market is currently dominated by:
- Recorded Future: Known for its vast, automated intelligence cloud.
- Flashpoint: A leader in business risk intelligence with a strong emphasis on global threat actor tracking.
- ReliaQuest (Digital Shadows): A powerhouse in digital risk protection, known for its comprehensive monitoring capabilities.
Underdark’s entry into this field is a bold gamble. While the aforementioned companies have massive scale, Underdark is betting on depth. In the intelligence world, the "depth vs. breadth" debate is a classic. Breadth allows a company to cover every asset for every client, but depth—achieved through human interaction—allows for the granular understanding of an adversary’s next move before it is executed.
Operational Metrics
While automated crawlers can index millions of pages per day, their "hit rate" on high-value, non-public threats remains low. Underdark’s model, by contrast, focuses on a lower volume of high-quality interactions. For an enterprise, the difference is significant: an alert from a crawler might tell you your data is leaked; a human engagement might tell you who leaked it, why they leaked it, and who they are selling it to next.
Official Responses and Strategic Philosophy
When asked about his firm’s place in the market, Kobe Shwartz is explicit about the limitations of his competitors. "Many of those companies are primarily engaged with automation and monitoring the dark web via crawlers," he notes. "The difference between them and us is that they’re mostly using humans assisted by AI to do the job, while what we do is called human intelligence."
This statement highlights a divergence in operational philosophy. The industry at large views AI as the "lead" and humans as the "assistants." Underdark flips this hierarchy, treating human interaction as the primary vehicle for intelligence, with AI serving only as a secondary tool to organize the resulting information.
Shwartz emphasizes that the core of their service is the interaction itself. In the world of threat intelligence, the ability to build rapport with a threat actor is a skill set more akin to field intelligence work in traditional espionage than to standard software engineering. By personally engaging with actors, Underdark removes the "filter" that automated systems inadvertently create.
Implications: The Future of CTI
What does this shift mean for the future of enterprise cybersecurity? Several implications emerge from Underdark’s business model.
1. The Death of "Passive" Monitoring
If the industry follows the path of human-centric intelligence, passive monitoring may eventually be relegated to a commodity service. If companies can get the same information from a basic automated tool as they do from a premium vendor, the premium vendors must provide something that automation cannot: human insight, context, and negotiation capabilities.
2. The Rise of "Active" Intelligence
Underdark represents a shift toward active intelligence. This involves not just watching the adversary, but interacting with them. This is a high-risk, high-reward strategy. It requires a level of legal and ethical sophistication that is rare in the cybersecurity world. Navigating the murky waters of dark web engagement while remaining compliant with international law is the next major challenge for the CTI industry.
3. The Need for Contextual Clarity
As LLMs become better at mimicking human conversation, the distinction between "human interaction" and "AI-generated interaction" will blur. For Underdark and its competitors, the challenge will be to prove to their customers that the intelligence provided is the result of genuine human intuition and relationship-building. Transparency regarding the "human" element will become a key differentiator in the market.
4. A New Class of Cybersecurity Professional
The success of firms like Underdark suggests a need for a new type of professional in the cybersecurity sector. The ideal analyst of the future may not be the traditional network engineer or software developer, but rather someone with a background in investigative journalism, intelligence analysis, or behavioral psychology—professionals capable of navigating the social engineering aspects of the dark web.
Conclusion
The market for dark web monitoring is clearly at an inflection point. While the scale provided by automated crawlers remains a necessity for broad security coverage, the future of high-value intelligence appears to be moving back toward the human element. Underdark’s insistence on direct engagement with threat actors is a testament to the fact that, even in a digital world, the most critical intelligence is often held in the minds of people—and it takes a human to extract it.
As cyber threats become more complex and adversarial, the ability to "talk" to the threat—rather than just observe it—may be the ultimate defensive advantage. Whether the rest of the market will pivot toward this human-centric model or continue to double down on the promise of pure automation remains to be seen. However, for organizations dealing with sophisticated, state-sponsored, or highly motivated criminal actors, the choice between "data" and "intelligence" has never been clearer.
Neng Nana
Ammar Sabilarrohman
