Acronis has added dark web credential and domain monitoring to its MDR service for managed service providers, along with multilingual support in Spanish, Italian, Japanese, and Portuguese, direct incident communications to customer contacts, and self-activation options for telecoms partners. An early access managed ITDR service is also being prepared. The service is delivered through Acronis’s own Security Operations Centre and backed by the Acronis Threat Research Unit.
Dark Web Monitoring: The Core Addition
The new dark web monitoring capability has two parts, one available now and one coming later.
What’s available immediately: a one-off scan that partners can request for any customer domain. The scan looks for credentials, data, and other information linked to that domain that’s already in circulation across dark web sources. Results give the managed service provider concrete evidence of what’s already exposed , before any attack has happened using that exposure.
Ongoing domain-based monitoring is described as coming in a later update. When that launches, providers will have continuous visibility rather than a snapshot.
The immediate one-off scan is specifically useful as what Acronis describes as a way to “start client discussions with evidence of exposure while assessing follow-up actions.” That framing matters. A managed service provider walking into a client conversation with a spreadsheet of leaked staff credentials from dark web forums is having a fundamentally different conversation than one presenting a general risk overview.
Why this is relevant right now is hard to miss from the breach landscape of 2026. The CRIF Cyber Observatory’s H1 data showed 2.5 billion records circulating on the dark web in the first six months alone, with email-and-password combinations appearing together in 95.9% of cases. For any managed service provider with clients who have employees , which is all of them , the probability that some domain-linked credentials are already exposed is not small. It’s close to certain.
Identity Threat Detection: The Early Access Service Coming Next
Alongside the dark web monitoring addition, Acronis is preparing its managed identity threat detection and response service , ITDR , for selected partners in early access ahead of a broader launch.
Identity-based attacks have become the dominant initial access method for many threat actors. When an attacker obtains valid credentials, they don’t need to exploit a vulnerability. They log in as a legitimate user and move from there. Traditional endpoint monitoring is less effective against this approach because the access itself looks authorized.
Managed ITDR addresses this by monitoring for anomalous behavior tied to user identities and accounts , unusual login times, access from unexpected locations, privilege escalation, and other signals that suggest a credential is being misused rather than used legitimately.
The connection to dark web monitoring is direct. Credentials exposed on the dark web , the ones the new scan capability identifies , are exactly what ITDR is designed to detect when someone tries to use them. Finding the exposure first gives a provider the chance to force a password reset before the credential is ever used maliciously.
This combination follows the pattern we’ve seen across the industry this year. When Ontinue added dark web monitoring to its ION MXDR platform in October, the same logic applied: finding credentials in criminal markets before they’re deployed is what separates early detection from late discovery. IDC’s data found roughly one in three MDR customers globally still lacked this capability.
Language Support and Customer Communications
The operational updates are easier to understate but likely matter as much to partners as the monitoring features.
MDR service support now covers Spanish, Italian, Japanese, and Portuguese alongside English, with French to follow. For a managed service provider with clients across different markets, running security incidents through a service that only communicates in English creates friction at exactly the wrong moment. An incident notification that needs translation before a client board can read it has already lost time.
The new direct communications option sends incident notifications and reports to designated customer contacts , meaning the information reaches the people who need to act on it without being filtered first through the partner’s own team. This reduces the administrative work on the provider side and gets relevant stakeholders into the loop faster.
Telecom Self-Activation and the Healthcare Use Case
Two specific expansions speak to where Acronis is growing its partner base.
Eligible telecoms customers can now self-activate MDR through the management console once their provider has enabled the offering. This removes the friction that typically delays adoption in telecoms channels ,the manual enablement process that requires a conversation before any protection is active.
The healthcare application points to a different dimension of the MDR rollout’s value. Acronis cited Australian managed service provider IT&T, which serves medical practices, as an example of how the service is being used. IT&T uses the monthly security operations centre reports in customer conversations with boards , turning what’s essentially a technical monitoring output into a governance and reporting tool.
This is relevant in a healthcare context specifically because medical practices face dual pressures: real breach risk (healthcare is the second most targeted sector in Australia according to CyberCX’s 2026 report) and board-level accountability requirements that demand documented evidence of security posture. The Australian Medicare dark web exposure earlier this month made that pressure much more concrete for providers serving that sector.
The Partner Conversion Signal
Acronis noted that every partner that joined its MDR early access cohort continued into general availability , a 100% conversion rate. This is a metric worth taking at face value. Early access programmes attract the most motivated and technically capable partners; getting all of them to stay through general availability suggests the service actually delivered what they were testing it for.
Dutch MSP SIX ICT is the named example. CEO Robert Nieuwenhuijse said the service enabled continuous security monitoring without SIX ICT building its own in-house operation. “It shows the seniority of the experts protecting our systems,” he noted.
The staffing constraint he describes is the central business case for the whole MDR market. Building a security operations centre with 24/7 coverage requires not just headcount but experienced security analysts available across all hours, which very few mid-market managed service providers can sustain independently. Acronis’s service delivers the monitoring through its own SOC, backed by the Acronis Threat Research Unit, with partners essentially renting that capability rather than building it.
What This Means for the Broader Market
Acronis’s expansion follows a clear direction: security services for managed service providers are moving from endpoint-focused detection toward a broader model that covers identity, external exposure, data, and recovery as connected risks.
The dark web intelligence market is growing at over 21% annually, driven by exactly this kind of expansion , enterprise and mid-market security teams recognising that threats originate outside their perimeter, often weeks before they manifest internally. MSPs that can demonstrate visibility into that external exposure are differentiated from those offering only internal monitoring.
The advanced MDR tier’s integration of security response with backup recovery and remote management is the piece that separates Acronis’s approach from pure-play monitoring: an incident response that can include rollback and restoration, not just containment, matters for providers whose clients need to resume operations quickly after a breach rather than simply understand what happened.
Frequently Asked Questions
What did Acronis add to its MDR service?
Dark web monitoring (immediate one-off domain scan now, ongoing monitoring coming later), multilingual support in Spanish, Italian, Japanese, and Portuguese, direct incident notifications to customer contacts, and self-activation for telecom partners.
What is the dark web scan feature?
Partners can request a one-time scan for any customer domain to identify credentials, data, and exposed information already circulating on the dark web. It’s designed to give providers evidence of exposure before starting client conversations.
What is Acronis ITDR?
Managed Identity Threat Detection and Response , a new service in early access that monitors for misuse of compromised credentials and identity-based attacks, coming to selected partners before a wider launch.
Who delivers Acronis MDR?
The service runs through Acronis’s own Security Operations Centre, backed by the Acronis Threat Research Unit, operating 24/7.
What languages does the Acronis MDR service now support?
English, Spanish, Italian, Japanese, and Portuguese. French is listed as coming next.
What was the early access conversion rate?
100%. Every partner that joined the MDR early access programme continued into general availability.
