Estimated reading time: 8 minutes
Think like a criminal. Act like an angel. Twenty-six years in cybersecurity have led Jonathan Palmer to that motto. On the CINI podcast, the CDL Cyber Intelligence CEO explains how dark web monitoring spots attackers sizing up a target. He also covers why underwriters need that intelligence and what CISOs struggle to tell their boards.
Get The Podcast Here
This episode is brought to you in association with CDL Cyber Intelligence.
Criminals case a target before they strike. Jonathan Palmer says the dark web shows them doing it.
Palmer is CEO of CDL Cyber Intelligence, a UK dark web intelligence firm. To him, most of cybersecurity is “good old fashioned crime.”
“There are only two real motivations there, maybe three if you count disruption,” Palmer said. Criminals want information they can turn into money, or a direct financial gain. A state actor may simply want to cause damage.
So he tells leadership teams to start with the attacker, not the technology. Think about “who’s going to come after you and why they’re going to do it,” he said. Then ask, “What provisions can I take to stop that happening?”
Dark Web Monitoring As An Early Warning
Palmer compares cyber risk to a dark alley. “Late at night and you’re on your own, and you’re in an area that maybe you don’t know, you wouldn’t walk down the dark alley,” he said. Yet companies ask staff to click links all day.
The dark web is where stolen data goes for sale. “Ninety percent of the time it’s used to trade illicit information,” Palmer said. Access brokers package it and price it, he said, much like brokers and underwriters in the insurance market. Some of the data is ten years old.
CDL works with Searchlight Cyber on dark web monitoring that watches for an earlier signal. Searchlight can see criminals probing a company from the dark web, Palmer said. “They’re giving you a poke. They’re having a look.”
The attack can follow about nine months later. “If you’re being looked at on the dark web, it probably means that someone’s targeting you.”
A study by Marsh McLennan with Searchlight Cyber put numbers to the risk. Organizations with compromised accounts on the dark web were about 2.5 times as likely to suffer a cyber incident. Every dark web signal in the study carried higher risk.
Executives widen the view without meaning to. “If you’ve got things like Google mail that is linked to your work account in any shape or form, we can see a lot,” Palmer said. CDL builds a picture of a leadership team “just like the bad guys do.”
It Started With A Cup Of Tea
Palmer never planned a career in cybersecurity. In the early 2000s, his investors sent him to a meeting in Leeds. It was in the basement of a disused bank branch.
The owners were leaving as he arrived. They had just sold the business. Palmer asked if he could make a cup of tea before heading home.
Two men sat in the basement. They had just lost their jobs. “We do something called encryption,” they told him. Palmer asked what that meant. “Moving things securely from A to B.”
“That sounds really cool. You’re going to come and work for me,” Palmer said. His company went on to export encryption technology to the US market.
Dark Web Exposure And The Boring Stuff
The lesson from those early years still holds, Palmer said. Security “was more about doing the boring stuff.” Know what you have. Check that it is up to date. Work through a short checklist before buying anything new.
He tests clients with one question. “Can you restore your data?” he said. “Everyone backs it up, but you’d be amazed how many people can’t restore the data.”
He also urges a pause before acting on any urgent request. “Just take a five-second pause,” he said.
A small yoga studio near his home shows why. The studio has five staff. A fraudster sent payment requests made to look like they came from the owner. The owner’s assistant, trying to do her job, followed them and transferred the money. Her bank, Barclays, stopped the fourth payment. Palmer has seen the same trick fool staff at large companies, even where the CEO and CFO sit almost desk to desk.
Big brands face a quieter route in. “If you are a well-known brand, as a bad guy, I’m probably not going to come after you,” Palmer said. “I’m going to come after your third-party suppliers.”
Dark Web Intelligence And Cyber Underwriting
Cyber applications typically ran to 18 pages of self-certification, Palmer said. That left insurers taking answers at face value.
One insurance CEO told Palmer his clients were “leaving the keys in the car with it running.” They meant no harm. They simply did not understand the risk. A declined claim then strains the broker relationship, which may carry far more business in other lines.
Palmer says intelligence should inform both sides of the deal. The client wants to avoid overpaying. The underwriter wants “the most accurate position” on the risk.
“We’ve built the walls of the castle as high as we can, but we need to be able to see over and look to see what’s coming at us,” he said.
Cyber also resists the methods that work for cars or planes, Palmer said. The variables are almost infinite, so underwriters often price the worst case. CDL is working on AI that pulls those variables together, he said. The aim is to price the real risk “rather than have to go every time to the worst case scenario.”
For buyers, the policy’s real value is the help that arrives on the worst day. “It’s going to be when, not if,” Palmer said. Buying the same incident response at short notice would cost far more, he said. He put it at “a factor of at least 10.”
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
What CISOs Struggle To Tell The Board
In Europe, the CISO role is still often seen as technical, Palmer said. Boards hear a request for technology. That’s the wrong take. “Nine times out of ten, they’re not,” he said. “They want support.”
Patching shows the gap. A CISO asks for a fix, and the business says it is busy. “If it’s not patched, it’s not secure,” Palmer said. If an attack follows, the CISO usually gets the blame.
He wants a board member who speaks both languages and can push the work through. Otherwise, the risk just climbs the register.
Collateral Damage And Shadow AI
Geopolitics has widened the target list. “You can just be collateral damage,” Palmer said. A small business can now face the same firepower a state actor aims at a bank.
AI cuts both ways. Palmer expects AI to take over the first two levels of security operations work. “I reckon the SOC companies will not be around in five years’ time,” he said. Attackers, meanwhile, can scan for unpatched software in seconds.
Asked what streetwise cybersecurity looks like in 2026, Palmer started with AI already on company desktops. “If you can’t audit AI on your desktops at the minute and shadow AI, that’s the first thing you want to do as an organization,” he said.
He closed on a hopeful note. “I don’t want people to walk away from this podcast to think there isn’t any hope,” he said. “They just need to be aware.”
Take The Cyber Insurance News Survey
Respondents Get Results First
Full Transcript
The transcript is machine-generated and lightly edited. It may contain errors. Please check the audio before quoting.
FAQ – Dark Web Monitoring
What is dark web monitoring?
Watching criminal marketplaces, forums and messaging channels for a company’s stolen data, credentials or signs that attackers are probing it. CDL Cyber Intelligence works with Searchlight Cyber to do this.
Can dark web activity warn of an attack?
Jonathan Palmer says criminal probing tends to peak every three months, with an attack often following about nine months later. If someone is looking at you on the dark web, he says, someone is probably targeting you.
Does dark web exposure raise breach risk?
Yes. A Marsh McLennan study with Searchlight Cyber found organizations with compromised accounts on the dark web were about 2.5 times as likely to suffer a cyber incident.
How can dark web intelligence help cyber underwriting?
Palmer says it gives underwriters a more accurate view of a client’s risk than self-certified questionnaires, so they need not always price for the worst case.
What should a business do if it is being targeted?
Test that you can actually restore your data, remind staff about phishing, and pause before acting on urgent payment or credential requests.
What does streetwise cybersecurity look like in 2026?
Palmer says start by auditing the AI tools on company desktops, including shadow AI that staff use without approval.
Related Cyber Insurance Posts
- A Ransomware Firm Promised Not To Pay Hackers. Prosecutors Say It Paid Them And Marked Up The Bill.
- Cyber Insurance Costs Crushing Your Business?(Opens in a new browser tab)
- Cyber Insurance Companies Face Loss Ratio Impact from Amazon Outage(Opens in a new browser tab)
- Dark Web Exposure’s Impact on Cyber Insurance Risk – Report(Opens in a new browser tab)
- Dark Web Exposure’s Impact on Cyber Insurance Risk – Report(Opens in a new browser tab)
1 thought on “Criminals Case The Joint First. The Dark Web Shows When.”