Disclaimer: This article has been written by Digital Transformation and Sustainability Evangelist Vijay Sethi. Also a member of Cyble’s Advisory Board, Vijay is an industry veteran with over 30 years of experience.
No, the dark web and the deep web are not the same thing. The deep web is any part of the internet not indexed by standard search engines — it includes everyday things like your email inbox, banking portal, and private social media pages. The dark web is a small, deliberately hidden subset of the deep web that requires special software like Tor to access, and it’s where most illicit online activity — from stolen credentials to illegal marketplaces — takes place. Every dark web page is technically part of the deep web, but the vast majority of the deep web has nothing to do with the dark web.
Ransomware attacks, data leaks, and personal information being sold online regularly make headlines — and the dark web is usually named as the culprit. But in conversations with IT professionals, we’ve noticed a persistent misconception: many use “dark web” and “deep web” interchangeably, when they’re actually two distinct layers of the internet. Understanding the difference matters, because it changes how organizations think about where their data ends up and how to monitor for it.
How Search Engines Divide the Internet
Search engines like Google and Bing use software called crawlers (or web spiders) to visit websites and “index” their content, which is what makes a page appear in search results. If a site blocks crawlers, or simply isn’t linked anywhere a crawler can reach, it doesn’t get indexed — and it doesn’t show up in a normal search.
That single distinction — indexed or not — is what separates the surface web from everything else.
What Is the Surface Web?
The surface web is the part of the internet that search engines like Google and Bing index. It’s what most people mean when they say “the internet”: news sites, company websites, social media profiles, videos, and blog content.
It feels enormous because a single search returns thousands of results. But long-cited estimates — originating from foundational research on the “invisible web” and still referenced by sources like Britannica — put the surface web at roughly 4% of all online content. The other 96%+ isn’t indexed by standard search engines at all. That’s the deep web.
What Is the Deep Web?
The deep web is the layer of the internet below the surface web. It’s not indexed, so a regular Google search won’t surface it, and its content typically lives in databases rather than static pages. Despite the ominous-sounding name, most of it is mundane and entirely legal.
The deep web generally falls into two categories:
- Obscure content: Pages that block search engine crawlers from indexing them, so they simply never appear in search results — even though nothing about them is illicit.
- Authenticated content: Pages that require valid credentials (a username and password) to access — your email inbox, online banking portal, or a company intranet, for example.
In other words, most people use the deep web every single day without thinking of it that way.
What Is the Dark Web?
The dark web (or darknet) is a relatively small part of the deep web, but it’s built for a different purpose: privacy and inaccessibility by design. Content on the dark web is hidden from both search engines and standard browsers, and it can only be reached with specific tools like Tor (The Onion Router) or I2P (Invisible Internet Project), typically alongside a VPN.
Because the dark web offers strong anonymity for both hosts and visitors, it’s become the preferred venue for illegal marketplaces — stolen credentials, drugs, hacking tools, counterfeit currency, and weapons all get traded there. That said, not everything on the dark web is illegal; it’s also used for legitimate anonymous communication, particularly by journalists, activists, and people in high-censorship regions.
Surface Web vs. Deep Web vs. Dark Web: Key Differences
| Surface Web | Deep Web | Dark Web | |
| Indexed by search engines? | Yes | No | No |
| Access method | Standard browser | Direct URL or login credentials | Tor, I2P, or similar + VPN |
| Approx. share of the internet | ~4% | ~90%+ | Less than 0.1% |
| Typical content | News, public sites, social media | Email, banking, medical records, private databases | Anonymous marketplaces, forums, leaked data |
| Legal to access? | Yes | Yes | Yes — the network itself isn’t illegal, though specific activity on it can be |
Common Myths, Debunked
Is the surface web most of the internet?
No. It’s a small fraction — roughly 4% by most estimates. The other 96%+ is deep web content that simply isn’t indexed by standard search engines.
Are the deep web and dark web the same thing?
No. The dark web is a small, deliberately hidden subset of the much larger deep web. Most deep web content — email, banking, private records — has no connection to dark web activity.
Is everything on the deep web and dark web illegal?
No. This is one of the most persistent myths. The deep web includes everyday tools like webmail, medical records, research papers, legal documents, and private social profiles, along with paid services like video-on-demand and digital publications. The dark web has a reputation for illegal activity because it hosts marketplaces for stolen data and contraband, but it’s also used for legitimate anonymous communication.
How Do You Access the Deep Web and Dark Web?
Unless you have a specific, legitimate reason to, it’s not advisable to access either. That said:
- Deep web content can often be reached with a direct URL or IP address, but usually requires valid login credentials.
- Dark web content requires dedicated software — Tor or I2P — combined with a VPN for an added layer of anonymity.
How to Protect Your Data From Ending Up on the Dark Web
Three habits go a long way as a first line of defense:
- Use strong, unique passwords. Combine uppercase and lowercase letters, numbers, and symbols, aiming for at least 8 characters. A password should be easy for you to remember but hard for anyone else to guess.
- Avoid public Wi-Fi. Free public networks are a common vector for interception — steer clear when handling anything sensitive.
- Watch for phishing. Attackers often spoof familiar brands to trick people into handing over usernames and passwords. If you’re unsure about a sender or a link, don’t enter any credentials.
What Is Dark Web Monitoring?
Dark web monitoring is the continuous scanning of dark web marketplaces, underground forums, paste sites, and encrypted messaging channels for an organization’s exposed data, such as employee credentials, customer records, source code, or chatter about planned attacks. The goal is to spot that exposure early, before threat actors use it.
As explained above, the dark web isn’t indexed and can only be reached with tools like Tor or I2P. That means search engine alerts and manual checks can’t see it. Organizations need purpose-built dark web monitoring to know whether their data is circulating there.
How Do Enterprises Monitor the Dark Web?
Enterprises monitor the dark web by continuously scanning underground forums, marketplaces, ransomware leak sites and messaging channels for their own data, then alerting the security team when something appears. Because these sources are unindexed and often invite-only, monitoring depends on specialized collection and analyst access rather than search engines.
A dark web monitoring program typically watches for:
- Leaked employee and customer credentials, including stealer-log dumps
- The company’s name or data appearing on ransomware leak sites
- Initial access brokers selling entry into the company’s network
- Confidential documents, source code or databases offered for sale
- Impersonation of the brand or its executives
When choosing a service, compare source coverage, how fast alerts arrive, whether findings are verified by analysts, and whether the provider can act on them, for example through credential resets or takedowns. See our guide on how to choose a dark web monitoring tool.
How Cyble Helps Monitor the Deep Web and Dark Web
Cyble’s enterprise dark web monitoring runs this full cycle continuously. Its flagship platform, Cyble Vision, combines AI-driven detection, powered by Cyble Blaze AI, with human-led validation across the surface, deep, and dark web. Security teams get real-time alerts on leaked credentials, stolen data, ransomware activity, and brand impersonation, so they can act before exposure turns into an incident.
Want to know if your organization’s data is already on the dark web? Request a demo to see Cyble’s dark web monitoring in action.
Frequently Asked Questions
Is the dark web and the deep web one and the same?
No. The deep web is any unindexed part of the internet, including everyday things like email and banking portals. The dark web is a small, specially hidden subset of the deep web that requires tools like Tor to access and is commonly associated with illicit marketplaces.
What percentage of the internet is the dark web?
The dark web makes up less than 0.1% of the total internet — a small fraction even of the deep web, which itself accounts for over 90% of online content.
Can you accidentally end up on the dark web?
No. The dark web requires specific software (like Tor) and deliberate action to access — you can’t stumble onto it through normal browsing or search.
Is it illegal to access the dark web?
No. Accessing the dark web itself isn’t illegal in most countries. What can be illegal is specific activity conducted there, such as buying stolen data or illicit goods.
How do I find out if my company’s data is on the dark web?
Check for exposed employee credentials with breach-notification services, then use a dark web monitoring service that scans forums, marketplaces and ransomware leak sites for your company’s domains, brand and executives. Ongoing monitoring matters more than a one-time check, because new leaks appear daily.
What is dark web monitoring?
Dark web monitoring is the continuous scanning of hidden forums, marketplaces, and leak sites for an organization’s stolen data, credentials, or mentions, with alerts so security teams can respond before the data is used in an attack. Learn how Cyble Vision monitors the dark web.
About Cyble
Cyble is a global, AI-native cybersecurity company that helps enterprises, government agencies, and MSSPs move from reactive security to proactive, intelligence-led defense. Its platform brings together threat intelligence, digital risk protection, dark web monitoring, attack surface management, and endpoint security, all powered by Cyble Blaze AI, the company’s agentic intelligence engine. Its flagship product, Cyble Vision, continuously monitors the surface, deep, and dark web to detect exposed credentials, ransomware activity, phishing, brand impersonation, and fraud. Cyble was named a Challenger in the inaugural 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies, ranked No. 576 on the 2026 Inc. 5000, and is trusted by organizations in more than 50 countries. Backed by Y Combinator (W21), Blackbird Ventures, King River Capital, and Summit Peak Ventures, Cyble is headquartered in Cupertino, California, with a global presence across Asia-Pacific, the Middle East, and India.
