Dark web and stolen-credential threat intelligence: what Hold Security's work shows CISOs

The firm and the leader behind it

The question here has two parts: how a threat-intelligence firm watches criminal activity, and what a security leader can take from what that firm publishes. Three pages from one company's website form the source base. They are its About page, its News page and one page of its webinar archive. All three are the company's own descriptions of its work. This explainer reads them in that light.

Hold Security's About page describes a company that works across several security disciplines, with threat intelligence as one of them.

The same page names its founder and gives him the security chief's title inside the firm he built.

Before he founded the firm, the company says, he spent a long stretch as an in-house security chief.

The About page credits him with finding several well-known breaches. It describes some of these as independent discoveries.

This career path is a familiar one for readers of this site. A leader moves from defending one company to studying the attackers who target many companies. His public profile now rests largely on that second role.

How the firm says it watches dark-web actors

The company presents its method as a focus on people first and data second. It says it builds profiles of individual criminals and tracks them over time.

The About page names the places where that watching happens. Criminal forums are one of several sources it lists.

On collection, the company says it draws on both open and closed sources. It then links what it finds across those sources.

The firm also describes a human review step before anything reaches a client. That step is meant to filter out noise.

The company also stresses language skills. It says most of its gathering is done by people working in their native languages, which it says helps its staff blend in.

Its Solutions menu lists credential and domain monitoring as separate services, alongside general threat intelligence.

The three pages do not explain how the Credential Integrity Service works. On credential tracking in particular, the record is therefore limited to the company's general account of collection and review above.

What its published research reports

The News page shows how this method turns into public findings. One item is a stolen dataset the firm says it found for sale. On August 11, 2022, the company said it had tied that dataset to a major telecom provider's customers.

Much of the firm's research centers on two linked criminal groups, Conti and Trickbot. In a March 3, 2022 post, the company said its view into Conti came from more than one source.

An April 13, 2026 item about a Cybernews feature gives the firm's account of its role in the decline of both groups.

The firm's work also reaches into product changes aimed at problems a security team can see from the outside. A February 2, 2026 post describes an upgrade to its domain monitoring service.

A January 30, 2026 item points to an RSAC blog post featuring Holden on people who pose as employees during hiring. It cites an outside forecast on the scale of the problem.

What the webinars tell security leaders

The webinar archive is where the firm speaks most directly to security leaders. The talks below date from November 2024 to June 2025. A March 6, 2025 CIO Summit talk makes the case for dark-web monitoring in terms of an organization's own exposure.

A February 6, 2025 session ties stolen identity data to identity and access defense. Its description frames the topic as a question of how attackers use that data.

Several talks link threat intelligence to testing. The June 3, 2025 session lists this as its first takeaway.

A May 13, 2025 talk turns the firm's attention to the attackers themselves. In it, Holden describes social engineering as a long-standing tool the firm uses against criminals.

The January 14, 2025 session on ransomware takes a position on crisis response that does not depend on how a company views paying.

Reading the record as a security leader

Taken together, the three pages describe a consistent approach. The firm watches people and their conversations, gathers data in the criminals' own languages, and puts that data through analyst review. It then applies what it learns to testing, identity defense and incident response.

The webinars carry the most direct guidance for a CISO. The guidance is to measure dark-web monitoring against threats to your own organization or industry. Testing should reflect the methods real attackers use. Teams should plan for ransomware negotiation before a crisis forces the question.

The research items show what that monitoring produced in specific cases: a large stolen customer dataset, and close visibility into Conti and Trickbot. The hiring-fraud and certificate items show the same attention turned to newer entry points.

For readers following careers, the record also shows a security chief whose second act is built on knowing attackers closely. The firm's own framing of that work also appears on the About page.