What is the deep web?
The deep web is every part of the internet that search engines do not index: everything behind a login, a paywall or a private network. It is the vast majority of the web and, for the most part, perfectly legitimate, your online banking, your email inbox, your company's internal systems. It is not the same thing as the dark web.
The three layers of the web
The internet is often described in three layers. Understanding the difference keeps the ordinary from being confused with the dangerous.
Surface web
What search engines index and anyone can find: public sites, blogs, stores, open posts. It is only the visible tip of the web.
Deep web
Everything behind a login, a paywall or a private network: banking, email, internal systems, databases. It is the majority of the internet, and it is legitimate.
Dark web
A tiny, anonymous corner reachable only through tools like Tor, where illegal marketplaces hide. It is a fraction of the deep web, not the other way around.
Source: CrowdStrike and N-able Cyber Encyclopedia.
What lives in the deep web
- Online banking and financial apps
- Your email inbox and your documents in the cloud
- The company's internal systems: ERP, CRM, intranet
- Medical records and legal files
- Streaming content when you are logged in
- Academic, corporate and government databases
The deep web and the dark web are not the same
- Deep web Huge, legitimate and protected by a login. It is where everyday sensitive data lives, yours and your company's.
- Dark web Tiny and anonymous, reachable only through networks like Tor. It is where illegal marketplaces and stolen data circulate.
What the deep web means for your company
The most valuable part of your operation lives in the deep web, and that is normal: the email, the finance system, the customer records, all protected by a login. The deep web is huge precisely because almost everything that matters sits behind an access barrier. According to CrowdStrike, more than 90% of the internet's content is on the deep web, and only about 10% is the surface web that search engines reach. The risk, then, is not the deep web itself: it is when the key to one of those systems, a password, escapes and ends up for sale on the dark web. What protects your deep web is not fear of it, but care over who holds the key.
How to protect what lives in your deep web
The deep web is not a place to fear; it is where your data is. Protecting it means protecting access to it, in the order that reduces risk the most:
- A second identity checkThe login that guards your deep web systems needs more than a password to withstand a leaked credential.
- Access managementEach person sees only what they need. If an account is compromised, the damage stays far more contained.
- Unique passwords and a managerA leaked password from one system does not open the others if it was never reused.
- Leak monitoringKnowing early whether a credential to your systems appeared for sale on the dark web lets you change it before the attack.
- Isolated backup of critical systemsThe systems that keep the operation running also need a copy out of an attack's reach.
In practice
The deep web is not a dangerous place; the danger is a credential from your deep web ending up on the dark web. Protect the keys, do not fear the door.
How Zamak handles your deep web
Zamak Technologies protects access to what lives in your deep web, the systems that keep the operation running, with managed Cybersecurity across identity and endpoint, and watches beyond the perimeter, on the Anticipate front, to see whether any of those credentials has appeared for sale. The goal is simple: keep the keys to your deep web away from the dark web.