A managed provider holds logins that reach more than one customer. DarkThreat watches external sources for stolen technician credentials and for client names on leak sites, so the security team can act while those accounts are still trusted.
The useful object is a login the provider already trusts. Four patterns show up around that trust.
Managed service providers and managed security providers connect to customer environments on purpose. The connection is trusted, and the account is often privileged. A password stolen from one technician can therefore be more than an internal help-desk problem.
CISA, with the NSA, the FBI, and partner agencies, describes that path in the joint advisory Protecting Against Cyber Threats to Managed Service Providers and their Customers. The advisory says a vulnerable provider can be an initial access vector to multiple customer networks, because the provider already has trusted connectivity and privileged access.
The same advisory tells providers not to reuse admin credentials across customers, and it tells both sides to disable accounts that are no longer in use. DarkThreat helps when a stolen password for a domain you register shows up outside the company. It does not see which clients that account could reach. That map stays with the provider.
Remote monitoring and management tools, and professional services automation tools, are where technician work actually happens. A console can open a session on a client machine, reset a password, or read a ticket that contains a credential. The login to that console is compact and reusable.
Those passwords leave the same way other passwords leave: a technician laptop with a stealer, a browser profile synced off the company device, or a password reused from email. The leak often surfaces under the provider email domain, or under the hostname of the tool, which means a watch limited to a marketing site will miss it.
DarkThreat helps by flagging credentials tied to domains and hostnames you register, when those values appear in stealer logs, credential lists, or posts. It does not sit in the RMM console, and it does not enforce multifactor authentication on the accounts the advisory treats as privileged. For the remote path itself, see leaked VPN credentials.
The person who holds the powerful login is often a working engineer, not a named executive. Help-desk staff, on-call engineers, and contractors who cover nights all receive accounts that can reach tools and clients. A password stolen from that laptop is traded like any other corporate password.
Triage still depends on role. A password for an engineer who can open client sessions is a different hour of work from a password for a marketing alias. The provider resets the account, checks whether that identity was used, and looks for a second account from the same person.
DarkThreat helps by putting the external finding in front of that team. The reset and the log review happen inside the provider environment. Two notes go further on passwords that move between companies: third-party vendor credential monitoring and supply-chain credential leaks.
A ransomware post may name the provider, a client, or both. Files described in the post can be runbooks, exports from a ticketing system, or client documents that passed through the managed service. The post is public proof that a copy exists. It does not, by itself, prove which network was entered first.
What you can register is narrower than the client list. Domains the provider operates can go on the watch directly. A client domain can go on the watch when the contract allows the provider to monitor that name. A hostname that belongs only to the client cannot be monitored as if it were the provider network.
DarkThreat helps with that external watch. It does not investigate the client incident and it does not decide who notifies whom. For how leak sites are used as pressure, see monitoring ransomware leak sites.
Six exposure types a provider security team can investigate from an external alert.
Passwords for engineer and help-desk accounts that can be replayed against email, the VPN, or a tool that reaches client networks.
Logins for remote monitoring and professional-services tools, where one console can open sessions on many client machines.
A privileged MSP login reused, or trusted, across customer environments, so a single theft is not limited to one network.
Posts that name a client, or name the provider, and describe files that could have left through the managed-service path.
Pages that imitate a client portal or a remote-tool login in order to collect another round of technician passwords.
Vendor-support logins and client accounts that stay active after a technician leaves or a contract ends.
This watch is external. DarkThreat looks for identifiers you provide in places stolen data is posted or sold: stealer-log collections, credential lists, forums, paste sites, and ransomware leak sites. It answers questions a provider security lead can act on before calling a client.
Did a technician or engineer password for your domain show up in a stealer log? Is a VPN, RMM, or PSA username being passed around? Did an account you issued to a contractor appear in a credential list?
Is the provider, or a client you are allowed to name, on a ransomware leak site, with runbooks or client files described? Is someone offering access to the network in a forum post? Are lookalike domains imitating a support portal?
The same watch will not show sessions inside the RMM console or traffic on a client network. Those belong in the tools and logs the provider already runs. An external credential finding is a reason to check whether that identity was used. It does not replace that check.
Employee and technician logins for domains the MSP registers, including accounts reused from a laptop onto a remote tool.
Tool hostnames the provider is willing to register. A console that belongs only to the software vendor is outside that watch.
Client domains and names the contract allows you to watch. A hostname that belongs only to the client is not your network.
Posts that name the provider or a client, including descriptions of runbooks, credential exports, or client files.
Underground posts offering network access or files that match provider or client names you asked DarkThreat to watch.
Published plans include email notifications and web UI access, so a finding can be read without a separate integration project.
Someone names the identifiers, someone reads the alert, someone resets the account on systems the provider already runs, and someone keeps the record.
Start with identifiers you can share. That list usually includes the provider domains, the email domains technicians use, remote-tool hostnames you are willing to disclose, and client names the contract allows you to watch. A client server you do not control is a contract topic.
When a match appears, published plans include email notifications and web UI access, so the security contact can read the finding directly. Triage by role. A password for an engineer who can open client sessions is a different hour of work from a password for a billing alias.
The team resets the account, checks whether that identity was used on the remote tool, and looks for a second account from the same person. DarkThreat helps by putting the external finding in front of that team. Which clients to call, and what the contract says about notice, stay with the provider.
Keep the alert, the time, the account, and the action you took. Stolen logs are copied, so leave the same identifiers on the watch list and look for a repost after the reset. The record helps the people who own the incident. DarkThreat does not make the organization compliant with any framework.
Provider domains, remote-tool hostnames you can disclose, and client names the contract allows you to register.
A security contact reviews the finding in the web UI or from the email notification included on published plans.
The provider resets the account on its own systems and checks which client environments that identity could reach.
Save the alert, the account, and the action taken. The record helps the incident conversation. It is not a certification.
There is no single statute that turns every MSP into a regulated cybersecurity utility. The public guidance that speaks directly to this sector is a joint advisory. DarkThreat supports external exposure awareness inside the program the provider already runs. Using DarkThreat does not make a provider compliant with that advisory.
AA22-131A, Protecting Against Cyber Threats to Managed Service Providers and their Customers, was published by CISA with the NSA, the FBI, and the cybersecurity agencies of the United Kingdom, Australia, Canada, and New Zealand. It defines an MSP as an entity that delivers, operates, or manages ICT services for customers under a contract. The text is AA22-131A.
The advisory is guidance. It says organizations should implement the measures as appropriate to their environments and in line with regulations that already apply to them. It recommends multifactor authentication on accounts that access customer environments, a stop to reusing admin credentials across customers, and disabling accounts that are no longer in use, including MSP accounts left behind when a contract ends.
DarkThreat helps when a stolen technician credential, or a post that names the provider or a registered client, shows up outside the company. That finding can support the account review and the incident conversation the advisory describes. It does not log customer networks, it does not enforce authentication, and it does not make an MSP or an MSSP compliant with the advisory.
Published plans that list a price start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Those plans include email notifications and web UI access. They are the plans described on the pricing page for a listed monthly rate.
DarkThreat also lists an MSSP (white-label) plan at custom pricing. A quote for that plan is a conversation, not a rate printed on the card. The pricing page is the source for that offer. This page does not add features beyond what that page states.
Many providers also map their own IT to the NIST Cybersecurity Framework and operate an ISO/IEC 27001 information security management system. DarkThreat helps those efforts with external credential and file-exposure evidence the security team can attach to its own risk record. The guides below describe each framework. They are not a statement that DarkThreat satisfies the CISA advisory or creates a certified management system.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. The MSSP (white-label) plan is listed at custom pricing. Tell us which technician domains, tool hostnames, and client names you need watched.
