September 20, 2022

Modern Extortion: Detecting Data Theft From the Cloud

Darktrace highlights a handful of data theft incidents on shared cloud platforms, showing that cloud computing can be a vulnerable place for modern extortion.

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adrianne Marques

Senior Research Analyst

Sep 2022

Ransomware Industry

The ransomware industry has benefitted from a number of factors in recent years: inadequate cyber defenses, poorly regulated cryptocurrency markets, and geopolitical tensions have allowed gangs to extort increasingly large ransoms while remaining sheltered from western law enforcement [1]. However, one of the biggest success stories of the ransomware industry has been the adaptability and evolution of attacker TTPs (tactics, techniques and procedures). The WannaCry and NotPetya attacks of 2017 popularized a form of ransomware which used encryption algorithms to hold data to ransom in exchange for a decryption key. Last year in 2021, almost all ransomware strains evolved to use double extortion tactics: holding stolen data to ransom as well as encrypted data [2]. Now, some ransomware gangs have dropped encryption entirely, and are using data theft as their sole means of extortion.

Using data theft for extortion is not new. In 2020 the Finnish psychotherapy center Vastaamo had over 40,000 patient records stolen. Impacted patients were told that their psychiatric transcripts would be published online if they failed to pay a Bitcoin ransom. [3]. A later report by BlackFog in May 2021 predicted data theft extortion would become one of the key emerging cybersecurity trends that year [4]. Adoption of offline back-ups and endpoint detection had made encryption harder, while a large-scale move to Cloud and SaaS platforms offered new vectors for data theft. By moving from data encryption to data exfiltration, ransomware attackers pivoted from targeting data availability within the CIA triad (Confidentiality, Integrity, Availability) to threatening data confidentiality.

In November 2021, Darktrace detected a data theft incident following the compromise of two SaaS accounts within an American tech customer’s Office365 environment. The client was a longstanding user of Darktrace DETECT/Network, and was in the process of expanding their coverage by trialing Darktrace DETECT+RESPOND/ Apps + Cloud.

Attack Overview

On November 23^rd 2021, an Ask the Expert (ATE) ticket was raised prompting investigation into a breached SaaS model, ‘SaaS / Access / Unusual External Source for SaaS Credential Use’, and the activities of a user (censored as UserA) over the prior week.

1. Office365: UserA

The account UserA had been logging in from an unusual location in Nigeria on November 21^st. At the time of the incident there were no flags of malicious activity from this IP in widely used OSINT sources. It is also highly probable the attacker was not located in Nigeria but using Nigerian infrastructure in order to hide their true location. Regardless, the location of the login from this IP and ASN was considered highly unusual for users within the customer’s digital estate. The specific user in question most commonly accessed their account from IP ranges located in the US.

Figure 1: In the Geolocation tab of the External Sites Summary on the SaaS Console, UserA was seen logging in from Nigeria when previous logins were exclusively from USA

Further investigation revealed an additional anomaly in the Outlook Web activity of UserA. The account was using the Firefox browser to access their account for the first time in at least 4 weeks (the maximum period for which the customer stored such data). SaaS logs detailing the access of confidential folders and other suspicious actions were identified using the Advanced Search (AS) query:

@fields.saas_actor:"UserA@[REDACTED]" AND @fields.saas_software:"Firefox"

Most actions were ‘MailItemsAccessed’ events originating from IPs located in Nigeria [5,6] and one other potentially malicious IP located in the US [7].

‘MailItemsAccessed’ is part of the new Advanced Audit functionality from Microsoft and can be used to determine when email data is accessed by mail protocols and clients. A bind mail access type denotes an individual access to an email message [8].

Figure 2: AS logs shows UserA had not used Firefox to access Office365 for at least 4 weeks prior to the unusual login on the 21st November

Below are details of the main suspicious SaaS activities:

· Time: 2021-11-21 09:05:25 - 2021-11-22 16:57:39 UTC

· SaaS Actor: UserA@[REDACTED]

· SaaS Service: Office365

· SaaS Service Product: Exchange

· SaaS Software: Firefox

· SaaS Office365 Parent Folders:

          o   \Accounts/Passwords
          o   \Invoices
         o   \Sent Items
          o   \Inbox
          o   \Recoverable Items\Deletions

· SaaS Event:

          o   MailItemsAccessed
          o   UserLoggedIn
          o   Update

· SaaS Office365 Mail Access Type: Bind (47 times)

· Source IP addresses:

          o   105.112.59[.]83
          o   105.112.36[.]212
          o   154.6.17[.]16
          o   45.130.83[.]129

· SaaS User Agents:

o Client=OWA;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0;
o Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

· Total SaaS logs: 57

At the start of the month on the 5^th November, the user had also been seen logging in from a potentially malicious endpoint [9] in Europe, performing ‘MailItemsAccessed’ and ‘Updates’ events with subjects and a resource location related to invoices and wire transfers from the Sent items folder. This suggests the initial compromise had been earlier in the month, giving the threat actor time to make preparations for the final stages of the attack.

Figure 3: Event log showing the activity of UserA from IP 45.135.187[.]108

2. Office365: UserB

Looking into the model breach ‘SaaS / Access / Suspicious Credential Use And Login User-Agent’, it was seen that a second account, UserB, was also observed logging in from a rare and potentially malicious location in Bangladesh [7]. Similar to UserA, this user had previously logged in exclusively from the USA, and no other accounts within the digital estate had been observed interacting with the Bangladeshi IP address. The login event appeared to bypass MFA (Multi-factor Authentication) and a suspicious user agent, BAV2ROPC, was used. Against misconfigured accounts, this Microsoft user agent is commonly used by attackers to bypass MFA on Office365. It targets Exchange’s Basic Authentication (normally used in POP3/IMAP4 conditions) and results in an OAuth flow which circumvents the additional password security brought by MFA [10].

During the session, additional resources were accessed which appear to be associated with bill and invoice payments. In addition, on the 4^th November, two new suspicious email rules named “..” were created from rare IPs (107.10.56[.]48 and 76.189.202[.]66). This type of behavior is commonly seen during SaaS compromises to delete or forward emails. Typically, an email rule created by a human user will be named to reflect the change being made, such as ‘Move emails from Legal to Urgent’. In contrast, malicious email rules are often short and undescriptive. The rule “..” is likely to blend in without arousing suspicion, while also being easy for the attacker to create and remember.

Details of these rule changes are as follows:

·      Time: 2021-11-04 13:25:06, 2021-11-05 15:50:00 [UTC]
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: True
·      SaaS Source IP addresses: 107.10.56[.]48, 76.189.202[.]66
·      SaaS Account Name: O365
·      SaaS Actor: UserB@[REDACTED]
·      SaaS Event: SetInboxRule
·      SaaS Office365 Modified Property Names:
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, MoveToFolder, Name, FromAddressContainsWords, StopProcessingRules
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, Name, FromAddressContainsWords, StopProcessingRules
·      SaaS Resource Name: ..

During cloud account compromises, attackers will often use sync operations to download emails to their local email client. During the operations, these clients typically download a large set of mail items from the cloud to a local computer. If the attacker is able to sync all mail items to their mail client, the entire mailbox can be compromised. The attacker is able to disconnect from the account and review and search the email without generating additional event logs.

Both accounts UserA and UserB were observed using ‘MailItemsAccessed’ sync operations between the 1^st and 23^rd November when this attack occurred. However, based on the originating IP of the sync operations, the activity is likely to have been initiated by the legitimate, US-based users. Once the security team were able to confirm the events were expected and legitimate, they could establish that the contents of the mailbox were not a part of the data breach.

Accomplish Mission

After gaining access to the Office365 accounts, sensitive data was downloaded by the attackers to their local system. Either on or before 14^th December, the attacker had seemingly uploaded the documents onto a data leak website. In total, 130MB of data had been made available for download in two separate packages. The packages included audit and accounting financial documents, with file extensions such as DB, XLSX, and PDF.

Figure 4: The two data packages uploaded by the attacker and the extracted contents

In a sample of past SaaS activity of UserA, the subject and attachments appear related to the ‘OUTSTANDING PREPAY WIRES 2021’ excel document found from the data leak website in Figure 4, suggesting a further possibility that the account was associated with the leaked data.

Historic SaaS activity associated with UserA:

·      Time: 2021-11-05 21:21:18 [UTC]
·      SaaS Office365 Logon Type: Owner
·      Protocol: OFFICE365
·      SaaS Account Name: O365
·      SaaS Actor: UserA@[REDACTED].com
·      SaaS Event: Send
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: Succeeded
·      SaaS Office365 Attachment: WIRE 2021.xlsx (92406b); image.png (9084b); image.png (1454b); image.png (1648b); image.png (1691b); image.png (1909b); image.png (2094b)
·      SaaS Office365 Subject: Wires 11/8/21
·      SaaS Resource Location: \Drafts
·      SaaS User Agent: Client=OWA;Action=ViaProxy

Based on the available evidence, it is highly likely that the data packages contain the data stolen during the account compromise the previous month.

Once the credentials of an Office365 account are stolen, an attacker can not only access the user's mailbox, but also a full range of Office365 applications such as SharePoint folders, Teams Chat, or files in the user's OneDrive [11]. For example, files shared in Teams chat are stored in OneDrive for Business in a folder named Microsoft Teams Chat Files in the default Document library on SharePoint. One of the files visible on the data leak website, called ‘[REDACTED] CONTRACT.3.1.2020.pdf’, was also observed in the default document folder of a third user account (UserC) within the victim organization, suggesting the compromised accounts may have been able to access shared files stored on other accounts by moving laterally via other O365 applications such as Teams.

One example can be seen in the below AS logs:

·      Time: 2021-11-11 01:58:35 [UTC]
·      SaaS Resource Type: File
·      Protocol: OFFICE365
·      SaaS Account Name: 0365
·      SaaS Actor: UserC@[REDACTED]
·      SaaS Event: FilePreviewed
·      SaaS Service Product: OneDrive
·      SaaS Metric: ResourceViewed
·      SaaS Office365 Application Name: Media Analysis and Transformation Service
·      SaaS Office365 File Extension: pdf
·      SaaS Resource Location: https://[REDACTED]-my.sharepoint.com/personal/userC_[REDACTED]_com/Documents/Microsoft Teams Chat Files/[REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Resource Name: [REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Service: Office365
·      SaaS Service Product: OneDrive
·      SaaS User Agent: OneDriveMpc-Transform_Thumbnail/1.0

In the period between the 1^st and 30^th November, the customer’s Darktrace DETECT/Apps trial had raised multiple high-level alerts associated with SaaS account compromise, but there was no evidence of file encryption.

Establish Foothold

Looking back at the start of the attack, it is unclear exactly how the attacker evaded the customer’s pre-existing security stack. At the time of the incident, the victim was using a Barracuda email gateway and Microsoft 365 Threat Management for their cloud environment.

Darktrace detected no indication the accounts were compromised via credential bruteforcing, which would have enabled the attacker to bypass the Azure Active Directory smart lockout (if enabled). The credentials may have been harvested via a phishing campaign which successfully evaded the list of known ‘bad’ domains maintained by their email gateway.

Upon gaining access to the account, the Microsoft Defender for Cloud Apps anomaly detection policies would have been expected to raise an alert [12]. In this instance, the unusual login from Nigeria occurred over 16 hours after the previous login from the US, potentially evading anomaly detection policies such as the ‘Impossible Travel’ rule.

Figure 5: Event log showing the user accessing mail from USA a day before the suspicious usage from Nigeria

Darktrace Coverage

Darktrace DETECT

Throughout this event, high scoring model breaches associated with the attack were visible in the customer’s SaaS Console. In addition, there were two Cyber AI Analyst incidents for ‘Possible Account Hijack’ associated with the two compromised SaaS Office365 accounts, UserA and UserB. The visibility given by Darktrace DETECT also enabled the security team to confirm which files had been accessed and were likely part of the data leak.

Figure 6: Example Cyber AI Analyst incident of UserB SaaS Office365 account

Darktrace RESPOND

In this incident, the attackers successfully compromised O365 accounts in order to exfiltrate customer data. Whilst Darktrace RESPOND/Apps was being trialed and suggested several actions, it was configured in human confirmation mode. The following RESPOND/Apps actions were advised for these activities:

· ‘Antigena [RESPOND] Unusual Access Block’ triggered by the successful login from an unusual IP address, would have actioned the ‘Block IP’ inhibitor, preventing access to the account from the unusual IP for up to 24 hours
· ‘Suspicious Source Activity Block’, triggered by the suspicious user agent used to bypass MFA, would have actioned the ‘Disable User’ inhibitor, disabling the user account for up to 24 hours

During this incident, Darktrace RESPOND/Network was being used in fully autonomous mode in order to prevent the threat actor from pivoting into the network. The security team were unable to conclusively say if any attempts by the attacker to do this had been made.

Concluding Thoughts

Data theft extortion has become a widely used attack technique, and ransomware gangs may increasingly use this technique alone to target organizations without secure data encryption and storage policies.

This case study describes a SaaS data theft extortion incident which bypassed MFA and existing security tools. The attacker appeared to compromise credentials without bruteforce activity, possibly with the use of social engineering through phishing. However, from the first new login, Darktrace DETECT identified the unusual credential use in spite of it being an existing account. Had Darktrace RESPOND/Apps been configured, it would have autonomously responded to halt this login and prevent the attacker from accomplishing their data theft mission.

Thanks to Oakley Cox, Brianna Leddy and Shuh Chin Goh for their contributions.

Appendices

References

[1] https://securelist.com/new-ransomware-trends-in-2022/106457/

[2] https://www.itpro.co.uk/security/ransomware/367624/the-rise-of-double-extortion-ransomware

[3] https://www.malwarebytes.com/blog/news/2020/10/vastaamo-psychotherapy-data-breach-sees-the-most-vulnerable-victims-extorted

[4] https://www.blackfog.com/shift-from-ransomware-to-data-theft-extortion/

[5] https://www.abuseipdb.com/check/105.112.59.83

[6] https://www.abuseipdb.com/check/105.112.36.212

[7] https://www.abuseipdb.com/check/45.130.83.129

[8] https://docs.microsoft.com/en-us/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide

[9] https://www.abuseipdb.com/check/45.135.187.108

[10] https://www.virustotal.com/gui/ip-address/45.137.20.65/details

[11] https://tidorg.com/new-bec-phishing-attack-steals-office-365-credentials-and-bypasses-mfa/

[12] https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Written by

Adrianne Marques

Senior Research Analyst

Chief Information Security Officer

Watch the NIS2 Webinar

Blog

Email

June 26, 2026

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

In my role as CIO, I bring years of experience leading IT for healthcare organizations. I’ve seen firsthand the unique cybersecurity challenges that nonprofit health centers face: limited budgets, small IT teams, and the constant pressure to prioritize patient care over technology investments. Yet, the threat landscape for health is relentless, and the stakes for protecting patient data and ensuring operational continuity have never been higher. It’s a balancing act.

The search for a better solution

Like many nonprofits, organizations I work at start with Microsoft’s security stack. The discounted pricing for nonprofits makes it an obvious choice, and Microsoft Defender provided a solid foundation for endpoint and email security. However, I quickly realized that relying on a single vendor, even one as robust as Microsoft, left gaps in our defenses. Cybersecurity is never one-size-fits-all, which is why my preference was to layer an additional solution on top of our native security to improve our security posture.

Teams needed a solution that could layer seamlessly on top of Microsoft, without adding complexity or draining limited resources. That’s when I found Darktrace. I had heard of their reputation after seeing how other organizations used Darktrace to secure their infrastructure and was impressed by their AI-native, agentless approach and agreed to a proof of value (POV).

Our goal was to elavate Microsoft with an additional layer of intelligence- one that could seamlessly integrate, operate autonomously, and support a small team without increasing overhead. We turned to Darktrace because its AI-native, agentless approach offered a fundamentally different way to detect and respond to threats, learning our environment in real time and filling gaps that traditional tools can miss. With a quick POV, we were able to validate how effectively Darktrace works alongside Microsoft to deliver a more complete and resilient security architecture.

Why Darktrace stood out

From the start, Darktrace differentiated itself in several critical ways:

Deep visibility: Unlike other solutions that rely simply on host-based monitoring with endpoint agents, Darktrace operates passively at the network layer and integrates via APIs for email and identity security. This gave full visibility into network traffic that we previously didn’t have, going beyond our existing endpoint-based tools without adding additional maintenance overhead for our small IT team.
AI-native from the ground up: Darktrace wasn’t just layering AI on top of an existing product; it was built with AI at its core. Their autonomous detection and response to threats immediately reduced the need for constant human supervision. In a world where cyber-attacks are increasingly sophisticated and subtle, having an AI that learns our environment and adapts in real time is invaluable.
Comprehensive coverage: We started with a POV focused on email security, but quickly expanded to full deployment across our entire infrastructure. Darktrace’s products now protect our email, network, and identity layers, providing visibility and defense against lateral movement and abnormal behavior that traditional tools often miss.

Integration and workflow: Smooth and simple

One of the most impressive aspects of Darktrace is how easy it was to integrate into an existing environment. For network security, it was as simple as plugging an appliance into our top-of-rack switch – no downtime, no complex configuration. For email and identity, API integrations meant we could be up and running in hours, not weeks.

This simplicity extended to day-to-day operations. Our IT team received regular security reports, and any time we had questions or needed to adjust policies, Darktrace’s support team was there with white-glove service. Their responsiveness- even in the middle of the night- gave us confidence that we had true partners, not just a vendor.

Real-world impact: Threats stopped, time saved

The results spoke for themselves. During the time with Darktrace, I did not experience any security incidents. The team slept better at night knowing that Darktrace was monitoring for anomalies and proactively blocking suspicious activity, alerting us even before we noticed anything was wrong.

A memorable example was during an Electronic Health Record (EHR) upgrade, when my team forgot to adjust the policy in advance. Darktrace’s autonomous response was so effective that it blocked our upgrade activities- proof that nothing, not even internal changes, could slip by unnoticed. This level of vigilance meant that ransomware, data exfiltration attempts, or insider threats would be detected and contained before causing harm.

While I can’t share specific ROI numbers, the value was clear: we’ve avoided costly breaches, reduced the time spent investigating alerts, and eliminated the performance drag of agent-based tools. With Darktrace layered on top of Microsoft, I’ve hit the right balance of maximum protection with minimal spending. The cost of Darktrace / EMAIL was competitive, especially when factoring in the included Managed Detection and Response (MDR) service, which provides expert human oversight on top of the AI.

Key differentiators over the competition

Extending visibility beyond the endpoint: Traditional host-based monitoring solutions, such as EDR, play a critical role in securing individual devices. By adding a network detection and response (NDR) layer, we gained visibility into activity across our wider digital environment, surfacing threats that move laterally, operate between devices, or bypass endpoint controls. Darktrace also stood out for its ability to learn our normal patterns of behavior and identify subtle deviations in real time, not just known indicators of compromise. Because this is delivered through passive, non-disruptive monitoring, we were able to strengthen our defenses without adding complexity or impacting performance.
Layered security without complexity: Darktrace elevated our Microsoft foundation without creating conflicts or requiring us to disable existing protections. This layered approach maximized our security posture without adding operational burden.
Expert partnership: Beyond technology, Darktrace’s team acted as true partners, guiding us through deployment, providing ongoing support, and helping us interpret findings. This partnership was as valuable as the technology itself.

Advice for other nonprofits

If you’re an IT leader in a nonprofit, my advice is simple: look for solutions that are easy to deploy, intelligent in their response, and cost-effective. Don’t settle for more endpoint based tools that overlap with what you already have. Seek out a layered approach that covers your blind spots – especially at the network and email layers- at a price point that suits your organization.

Most importantly, don’t be afraid to evaluate new solutions. Even if you’re inundated with vendor pitches, you owe it to your organization to explore options that could save you time, money, and sleepless nights.

For organizations I work at, combining Microsoft’s security stack with Darktrace’s AI-native, platform struck the right balance between protection and practicality. We gained enterprise-grade security without sacrificing performance or stretching our budget. In the end, that meant more resources for what matters most: delivering care to our patients. If you’re facing similar challenges, I encourage you to consider how Darktrace could transform your security posture, and give your team the peace of mind they deserve.

For the organization I work in, combining Microsoft with Darktrace delivered a clear step-change in our security posture. Microsoft provided the foundation, while Darktrace’s behavioral intelligence added visibility into the unknown, surfacing emerging threats based on deviations in real-time activity, not just known indicators.

The result was enterprise-grade protection without added overhead, allowing us to stay focused on patient outcomes, not security operations. For organizations facing similar pressures, this layered approach offers a smarter, more efficient path to securing modern environments.

About the author

Mice Chen

Chief Information Security Officer

Blog

AI

June 25, 2026

Shadow AI Detection: The First Step Toward Securing AI

Why shadow AI is emerging

Imagine you’re an employee under pressure, deadlines stacking up, repetitive tasks piling higher by the day. You find a free AI tool online that promises to automate the work in seconds; no approvals are needed. It feels like a simple win, paste in some data, write a quick prompt, and move faster.

But in that moment, something changed.

Sensitive customer information is entered into a tool your organization doesn’t monitor, doesn’t govern, and can’t see and suddenly, that data is no longer where it should be, and no one knows where it’s gone.

This is the reality of Shadow AI: employees using unsanctioned AI tools to move faster, while unintentionally creating risk that exists entirely outside visibility and control.

This is not just a one off case, research across businesses indicate that nearly half of employees report using unsanctioned AI tools, often prioritizing speed and productivity over security. Additionally, 51% of employees report connecting AI tools to work systems or apps without IT approval, creating significant operational risk where the average cost of security incidents in organizations with a high level of shadow AI usage can reach $670k.

While shadow AI is often top of mind for security professionals, it is just one component of how AI use can increase risk. Understanding and managing shadow AI use should be considered as part of a broader, comprehensive risk management strategy that aims to secure AI systems, including human and agent identities, interactions, human-AI partnerships, and behaviors operating across the digital enterprise from visibility and governance through detection, response, and recovery.

Effective risk management calls for a layered and interdisciplinary strategy. It requires addressing issues across governance and visibility; identity, access and agent control, data security and privacy, secure MLOps / LLMOps, runtime security, behavior-based detection, autonomous response and recovery.

This blog explores a specific governance and visibility use case linked to shadow AI and reveals the challenges it presents as well as the defensive strategies that security teams can adopt.

Why shadow AI is hard to detect

When it comes to AI, what organizations can easily see does not always reflect the full scope of AI activity occurring within the tools, applications, and workflows used across an enterprise. As a result, organizations using traditional rule-based methods to flag unusual activity may struggle to distinguish unsanctioned AI usage from legitimate operational behavior, particularly as SaaS applications, APIs, and orchestration layers increasingly have AI embedded into normal business workflows. Identifying threats using previously observed intelligence or depending on hard to maintain allow and block lists does not provide a dynamic enough strategy to manage risk. Also, many organizations are focusing on identifying Shadow AI in their governed infrastructure, like gateways, endpoints, or SASE, which is foundational. But, organizations require visibility and Shadow AI detection across all networked infrastructure from on-prem, hybrid, data centers, and cloud infrastructure that may not have endpoint agent visibility. This uncovers the utilization of MCP, data flows, and autonomous agents across these domains.

For example, employees interact with AI assistants across approved SaaS platforms every day. However, browser extensions and other types of plug-ins can route prompts that include enterprise data to embedded AI services in ways that are not visible to the security team. AI enabled workflows may invoke multiple APIs, orchestration layers, and cloud services behind the scenes, making it difficult for traditional security tooling to determine where data is processed, stored, or retransmitted. Because much of this activity occurs within trusted browser sessions and encrypted SaaS traffic, conventional network monitoring, DLP, and application allowlisting controls often lack the context needed to accurately identify or govern these interactions

Identifying AI tools in the environment is one part of the equation. Understanding the behavior surrounding their use is where the real challenge lies. An AI application is not inherently risky, but the way users or other assets interact with it may be. Sensitive data exposure, abnormal access patterns, and misuse of AI-assisted workflows often appear legitimate in isolation and only become visible through behavioral analysis across the broader environment.

What Shadow AI visibility does and doesn’t show

Comprehensive Shadow AI visibility allows organizations to answer several important questions:

What types of AI are we using? What AI platforms, agents, MCP clients/servers, and services are active across the enterprise?

Who is using AI services? Which users, business units, or systems are interacting with those AI services?

Is our data safe? Is sensitive or regulated data being exposed through prompts, workflows, or integrations?

Are AI systems behaving as expected? Are AI systems behaving anomalously or operating outside approved governance processes?

Are our AI systems under attack? Is an attacker attempting to manipulate prompts, influence agent behavior, or abuse AI-enabled workflows?

Answering these questions is foundational to broader AI governance efforts. However, it is limited to helping teams understand initial interactions and fails to offer insight into dependencies and outcomes that are critical to securing AI across an enterprise.

Deeper visibility that includes the ability to understand dependencies and outcomes are not always available in AI security point products. Answering the questions below requires understanding runtime behavior and operational outcomes:

What actions did the AI interaction trigger?

What systems, applications, or data did it access? Did the AI operate beyond its intended permissions or scope?

Could a low-risk interaction lead to high-risk outcomes?

What is the risk and context understanding of an anomalous activity to assist in prioritization of analysis and autonomous response action?

The distinction between these two sets of questions offers two different layers of AI security. The first set of questions focuses on discovery and interaction visibility. The second set focuses on providing visibility that includes the context and outcomes that are critical for managing follow-on risks associated with obfuscated downstream activities.

Together, these layers help organizations move beyond simply identifying AI usage toward understanding how AI behaves operationally across the enterprise.

How organizations are addressing shadow AI

Most organizations still approach shadow AI as an application control problem, relying on policies, browser restrictions, and allow/block lists. However, AI adoption is evolving faster than most governance processes can realistically keep pace with. New assistants, plugins, and embedded AI features appear continuously, creating pressure to enable business productivity while simultaneously containing risk.

Existing governance processes were designed for a more traditional SaaS adoption cycle, where new applications could be reviewed, approved, and monitored over longer time horizons. AI adoption operates differently. New capabilities can appear overnight inside existing platforms employees already use, making it difficult for security and governance teams to maintain an accurate understanding of enterprise AI exposure. This means that many organizations are experiencing significant operational overhead, particularly in large environments where AI usage is decentralized across teams, departments, and third-party services.

Where should organizations start when securing their AI systems?

Shadow AI identification is an on-going critical component for AI Risk/Governance Boards as well as security organizations. As organizations seek AI certifications like ISO 42001 AI Management Systems, visibility into all AI adoption from enterprise use to custom innovation and development is crucial. Shadow AI identification provides organizations with the visibility needed to decide whether an AI tool should be brought into governed environments to reduce data loss (DLP) risks or whether policies should be established and enforced to restrict their use.

As organizations rapidly innovate and adopt AI, they are taking on more and more risk. Organizations need to have a strategy in place to mitigate the assumed risk, especially with third-party adoption. Visibility, monitoring, governance enforcement, behavioral-based detection of non-deterministic systems, and autonomous investigation and containment becomes critical to mitigating the risk of AI systems.

How Darktrace secures AI and shadow AI

Attackers are using AI to move faster, scale tactics, and make threats more adaptive and convincing. Internally, organizations are grappling with new forms of risk created by generative AI, autonomous agents, shadow AI, and increasingly complex digital environments.

Darktrace helps organizations protect both people and AI in a world where AI is now central to how business gets done. Darktrace / SECURE AI helps organizations discover and control shadow AI by surfacing unsanctioned or unexpected AI activity where it appears – including MCP detections, distinguishing misuse of legitimate tools and unapproved services, and applying policy to contain data exposure while guiding users toward sanctioned options.

Stay up to date on AI security

Sign up for the Secure AI Readiness Program here: This gives you exclusive access to the latest news on the latest AI threats, updates on emerging approaches shaping AI security, and insights into the latest innovations, including Darktrace’s ongoing work in this area.

Ready to talk with a Darktrace expert on securing AI? Register here to receive practical guidance on the AI risks that matter most to your business, paired with clarity on where to focus first across governance, visibility, risk reduction, and long-term readiness.

About the author

Nicole Carignan

SVP, Security & AI Strategy, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Modern Extortion: Detecting Data Theft From the Cloud

Modern Extortion: Detecting Data Theft From the Cloud

Ransomware Industry

Attack Overview

Accomplish Mission

Establish Foothold

Darktrace Coverage

Darktrace DETECT

Darktrace RESPOND

Concluding Thoughts

Appendices

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

Enjoying the blog?

More in this series

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

Inside Cloud Compromise: Investigating Attacker Activity with Darktrace / Forensic Acquisition & Investigation

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Blog

Email

June 26, 2026

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

The search for a better solution

Why Darktrace stood out

Integration and workflow: Smooth and simple

Real-world impact: Threats stopped, time saved

Key differentiators over the competition

Advice for other nonprofits

Blog

AI

June 25, 2026

Shadow AI Detection: The First Step Toward Securing AI

Why shadow AI is emerging

Why shadow AI is hard to detect

What Shadow AI visibility does and doesn’t show

How organizations are addressing shadow AI

Where should organizations start when securing their AI systems?

How Darktrace secures AI and shadow AI

Stay up to date on AI security