The deep web is all online content that search engines do not index: your email, bank account pages, company intranets and paywalled databases. The dark web is a much smaller part of it that needs special software, such as Tor, to reach. Most of the deep web is ordinary and legal. Not all of the dark web is criminal.
Are these terms defined by a standard?
No. These are informal terms without a formal definition from a standards body. People use them loosely, and the news often blurs them. The definitions in this post describe common usage, so check what a writer means before comparing numbers or claims.
What counts as the deep web?
Anything behind a login or otherwise not crawled by search engines. A constructed example of one person's Monday: read email in a web client, check a bank balance, open a hospital portal, edit a shared document, and log in to a work wiki. None of those pages appears in a search engine, and none is suspicious. All of it is the deep web.
For a security team, the point is that most of your company's sensitive material lives here, in places that need authentication. Its safety depends on access control, not on being hard to find.
What is the dark web?
The dark web is made of sites and services that sit on overlay networks which hide where a service is hosted and who connects to it. A well known example is Tor. The Tor Project describes onion services, formerly called hidden services, as services such as websites that are accessible only through the Tor network. Their location and IP address are hidden, traffic between Tor users and the service is end-to-end encrypted, and the address is generated automatically, so the operator does not need to buy a domain name. An onion address is 56 letters and numbers followed by .onion.
That design serves people who need to avoid surveillance or censorship, and it also serves people who want to hide illegal activity. Both exist there.
Why does it matter to a security team?
You do not need to browse these places yourself, and on work devices you generally should not. What matters is what shows up there about you:
- Stolen credentials. Employee emails and passwords from breaches get traded or posted.
- Leaked data. Groups that steal data and threaten publication, often as part of ransomware cases, may post samples.
- Access for sale. Listings that offer remote access to a company's network.
- Brand abuse. Fake shops and phishing kits using your name.
Where a leak is found, it is evidence that something already happened elsewhere. Usually the fix is in your own systems: reset passwords, revoke tokens, find how the data left.
What is a sensible way to handle it?
Do not buy anything, pay anyone, or contact sellers. Legal and ethical risks are real, and that is the work of specialists. If you want visibility, use a reputable monitoring service or a trusted partner, and set a clear scope: which domains, brand names and executive accounts to watch, and what happens when a hit arrives.
Ask what the source of each alert is, how recent it is, and whether it can be verified. Treat unverified claims, including a criminal's claim of a breach, as leads to check against your own logs, not as facts.
How to check or apply this
- Know what your company's deep web looks like: list the logins and portals that hold sensitive data, and confirm each has multi-factor authentication.
- Check employee and customer email addresses against known breach data using a legitimate service.
- Decide on a monitoring approach for credentials, brand and leaked data.
- Write a response step for each alert type: credential reset, token revoke, investigation.
- Block Tor on corporate networks only if it fits your policy and legal advice, and document why.
- Brief staff that they should report suspicious listings, not engage.
Quick check
Is the dark web illegal to visit?
Using Tor is legal in many countries, and the network has legitimate uses. What you do there can be illegal. Rules differ by country, so ask counsel for your situation.
Is my email in the deep web?
Yes. Email inboxes are not indexed by search engines, so by common usage they are part of the deep web.
Sources
Last reviewed: 18 October 2026.
