Austin Berglas is Managing Director and Head of Cyber Operations at Nardello & Co. and the former head of FBI New York Cyber.
For decades, enterprise security spending has followed one pattern: Detect the intrusion, contain it, investigate and recover. The breach occurs, and the security team responds as fast as it can.
That approach is expensive and increasingly avoidable.
The Cost Of Waiting
IBM’s 2025 Cost of a Data Breach Report put the global average cost of a breach at $4.44 million and the average time to identify and contain at 241 days. Yes, this was a nine-year low, yet it still amounts to nearly eight months in which an attacker can sit inside a network, expand access and live off the land to conduct a larger-scale attack.
This is the limitation of post-breach incident response: It’s reactive. A SIEM can only correlate logs that exist, and an EDR platform can only flag malware after it’s been deployed. The industry has put enormous effort into faster detection and response and far less effort into stopping the incident from happening in the first place.
What’s Being Sold On The Dark Web
Most modern intrusions don’t begin with a zero-day exploit or custom malware. They begin with a transaction. Initial access brokers are criminals who specialize in breaching a network and selling that foothold to the highest bidder. These brokers supply a large share of the initial access used by ransomware crews and other individuals and groups conducting cyber-enabled crimes.
A gbhackers report noted that Rapid7 researchers tracked initial access listings across five major underground forums and found the average base price “rose from $2,726 in 2024 to $113,275 in the second half of 2025.” Additionally, Rapid7’s earlier dataset showed that more than 70% of listings “included some degree of privilege,” which means buyers were getting more than just a low-level login—they were purchasing a foothold from which to move laterally and expand access.
Once access is listed, it doesn’t sit there for long. KELA Cyber research from 2022 found that access was often sold within one to three days of listing and that victims were listed on ransomware leak sites an average of 23 to 36 days later. This is a fairly significant window to conduct an attack.
By the time the tech stack flags unusual activity, the access has already changed hands on a criminal forum. The attack that eventually triggers an alert is frequently the second or third step in a chain that began with a transaction on some dark web forum, completely unknown to the security team.
The Case For Getting Ahead Of The Transaction
Pre-breach intelligence inverts the model. Instead of waiting for, and reacting to, a compromise, it involves direct monitoring of and, in some cases, legally acquiring access to the criminal marketplaces where access and credentials are bought and sold. In this way, an organization can learn if access to its own network is for sale before an attacker completes the purchase and exploits it.
This changes what “detection” means. Pre-breach intelligence tells you that a specific method of access to your organization’s network is actively being marketed to buyers who intend to use it for a variety of crimes, such as ransomware, fraud or corporate espionage, while there’s still time to rotate credentials, patch the stolen access route and notify law enforcement before anything nefarious happens.
Pre-breach intelligence is also significant for third-party risk. Vendors and partners are often the weakest link in an organization’s security posture and are frequently the last to know when their own access has been compromised. Monitoring the marketplaces where access to those vendors is sold can surface a third-party compromise weeks before the vendor discloses it or it becomes public.
None of this replaces traditional security operations and best practices. Endpoint detection, patch management and a competent incident response plan are still nonnegotiable. Pre-breach intelligence adds a layer that sits earlier in the attack chain. This is the difference between finding out your house key was copied and finding out someone already used it to get inside.
Insurers have started to take the approach seriously. In March 2025, Reinsurance News reported that AXA XL’s specialty risk division had partnered with DarkwebIQ, a pre-attack intelligence provider that intercepts access sales by infiltrating forums, marketplaces and private channels.
Rethinking The ROI Conversation
Post-breach response has dominated budgets because its value is easy to explain. Here was the incident, here’s the cost and here’s what we spent fixing it. Prevention is a harder sell internally because success looks like nothing is happening. However, given how long it can take to remediate and recover from a data breach, and the significant cost associated, nothing happening is exactly the outcome worth paying for.
An organization that intercepts access before an attacker uses it avoids the costs that follow a breach. This can include months of containment, legal fees, incident response engagements, remediation and recovery, regulatory exposure and reputational damage.
Security leaders should ask whether access to their network is for sale today. If their current tools, vendors or partners can’t answer that, there’s no question that they’ll learn about their exposure on the attacker’s timeline rather than their own.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?