Blog
/
/
February 9, 2021

Antigena Email Version 5: The Future of Email Protection

Version 5 of Antigena Email enhances security operations with AI-powered threat detection and intuitive reporting for busy security teams.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Dan Fein
VP, Product
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Feb 2021

Darktrace Version 5 signals a new chapter in AI-powered cyber security, offering a series of innovations across the entire Immune System platform – including AI augmentation and extended coverage across remote environments. This update also includes one-click integrations, on-demand automated investigations, and – the subject of this blog post – critical upgrades to Antigena Email, the world’s first autonomous email security technology.

Antigena Email uses a self-learning approach to stop every type of email threat, without relying on pre-existing lists or reputation checks. The technology autonomously interrogates every email in the context of its evolving understanding of ‘normal’ for the recipient, group, and organization as a whole. The features in Version 5 present several unique benefits to the user, not least in the various ways in which they can save time.

The self-learning AI technology provides a solution free from configuration, policy setting, and ongoing maintenance. The system’s accuracy results in negligible false positives, meaning security teams no longer need to release legitimate emails that legacy security tools have held back.

Furthermore, human security teams are augmented by Narrative – a new feature that automatically generates natural language reports on every email security incident. By surfacing a summary of what happened and why Antigena Email took the actions it did, Version 5 drastically reduces ‘time to meaning’ for overstretched human security teams.

Time to resolve a phishing attack

Email attacks are becoming increasingly targeted, and just one successful attack can give hackers the keys to an organization’s digital kingdom. Investigating the cause of a breach, cleaning up infected devices, and manually compiling incident reports can quickly drain a company’s resources.

Gateway tools tend to be time-consuming for security professionals, who must research malicious emails that were let through and tweak settings to stop them in the future, as well as release ‘false positive’ legitimate business emails that have been stopped for no good reason. Under such constraints, it is no wonder that phishing emails are reaching the inbox with alarming frequency – leading to wide-scale attacks.

While many traditional security tools put immense strain on human analysts, Antigena Email almost entirely removes the human from the equation. The self-learning technology accurately determines malicious from benign by taking a fundamentally different approach to email security. Rather than asking ‘is this email bad’ – Antigena Email uniquely sets to find out: ‘does this email belong’, in the context of ‘normal’ for the sender, the recipient, and the wider organization. It is this contextual understanding of the wider ‘patterns of life’ that enables the technology to catch sophisticated threats on the first encounter.

Time to find and release emails

Security teams too often spend their days ground down by repetitive tasks. For those who rely on legacy tools which present crude information and stop only the most basic threats, important trends are not found unless manually uncovered, and human experts are kept in the weeds.

With Antigena Email, this has now changed. Customers are now able to focus on gaining a holistic understanding of their organization. Such understanding is only possible when teams are not bogged down in details or trapped by an obscure user interface, tweaking complex settings which could inadvertently cause more harm than good.

The technology generates a bespoke dashboard for security teams, accounting for all specific preferences and interests. For example, organizations interested primarily in supply chain attacks on the C-suite can set Antigena Email to surface and chart anomalous emails tagged by Antigena Email as ‘Out of Character’, where specifically the recipient was C-suite.

Figure 1: With Antigena Email Version 5, there is no need to log in and no action to be taken. When users do log in, they are presented with high-level metrics of the email threats facing their organization.

In this way, IT teams can set the system once to exactly what interests them, and subsequently forget about it until they decide to log in and glance over key figures. When logging in, it is no longer to chase a specific email, and there is nothing to action – Antigena Email has already done it. Instead, IT teams can view the broad picture and use the information available to influence security decisions. They can now ask and fully understand which users are most exposed and why an organization is so at risk.

Time to understand what happened

Security professionals just need the answer. When looking at an email, no one should have to unpack and make sense of raw data. Instead, users should be presented with a recap summary – a Narrative – which is digestible in seconds and which even the most junior team members can easily grasp.

Antigena Email takes each complex case and words it in such a way that even a non-technical employee can understand. It uses advanced machine learning to present key information in plain English, allowing end users to perceive the situation at a glance.

Figure 2: An example of Antigena Email’s Narrative summary on the right hand side of the screen

Narrative tells the stories of what happened and why, and how aggressively an email was actioned. What was the sender’s intention? Were they trying to solicit the recipient into a bank transaction? Whatever the circumstances, if an email does not belong, that is the end of the story. There are no ongoing chapters, there is no fallout. Antigena Email neutralizes the email and ends the story before the threat has had the chance to develop.

And if a person wishes to dive deeper, Narrative provides one-click jumping off points that expose the underlying data (see the red text in the image above). But this is a choice. It is no longer business critical to scroll through emails and uncover information manually to stop future threats. As Antigena Email is proactive, the human no longer has to be.

A new era of email security

Antigena Email takes care of all the daily repetitive tasks – stopping the bad, allowing the good – taking the least aggressive action to neutralize any given threat. As a result, security teams are no longer forced to spend their days determining which emails are malicious or dealing with complaints from users who have had legitimate emails blocked.

Now that human experts no longer have to worry about sifting through emails themselves, they can focus on what matters. Antigena Email gives time to security teams to define their email environment, pinpoint the biggest risks, and identify general business trends.

Find out more about Darktrace Version 5

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Dan Fein
VP, Product

More in this series

No items found.

Blog

/

Cloud

/

June 12, 2025

Breaking Silos: Why Unified Security is Critical in Hybrid World

laptop with statistics on itDefault blog imageDefault blog image

Hybrid environments demand end-to-end visibility to stop modern attacks

Hybrid environments are a dominant trend in enterprise technology, but they continue to present unique issues to the defenders tasked with securing them. By 2026, Gartner predicts that 75% of organizations will adopt hybrid cloud strategies [1]. At the same time, only 23% of organizations report full visibility across cloud environments [2].

That means a strong majority of organizations do not have comprehensive visibility across both their on-premises and cloud networks. As a result, organizations are facing major challenges in achieving visibility and security in hybrid environments. These silos and fragmented security postures become a major problem when considering how attacks can move between different domains, exploiting the gaps.

For example, an attack may start with a phishing email, leading to the compromise of a cloud-based application identity and then moving between the cloud and network to exfiltrate data. Some attack types inherently involve multiple domains, like lateral movement and supply chain attacks, which target both on-premises and cloud networks.

Given this, unified visibility is essential for security teams to reduce blind spots and detect threats across the entire attack surface.

Risks of fragmented visibility

Silos arise due to separate teams and tools managing on-premises and cloud environments. Many teams have a hand in cloud security, with some common ones including security, infrastructure, DevOps, compliance, and end users, and these teams can all use different tools. This fragmentation increases the likelihood of inconsistent policies, duplicate alerts, and missed threats. And that’s just within the cloud, not even considering the additional defenses involved with network security.

Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks. The lack of visibility between on-premises and cloud environments contributes to missed threats and delayed incident response. In fact, breaches involving stolen or compromised credentials take an average of 292 to identify and contain [3]. That’s almost ten months.

The risk of fragmented visibility runs especially high as companies undergo cloud migrations. As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations.

Unified visibility is the solution

Unified visibility is achieved by having a single-pane-of-glass view to monitor both on-premises and cloud environments. This type of view brings many benefits, including streamlined detection, faster response times, and reduced complexity.

This can only be accomplished through integrations or interactions between the teams and tools involved with both on-premises security and cloud security.

AI-driven platforms, like Darktrace, are especially well equipped to enable the real-time monitoring and insights needed to sustain unified visibility. This is because they can handle the large amounts of data and data types.

Darktrace accomplishes this by plugging into an organization’s infrastructure so the AI can ingest and analyze data and its interactions within the environment to form an understanding of the organization’s normal behavior, right down to the granular details of specific users and devices. The system continually revises its understanding about what is normal based on evolving evidence.

This dynamic understanding of normal means that the AI engine can identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. This helps reduce noise while surfacing real threats, across cloud and on-prem environments without manual tuning.

In this way, given its versatile AI-based, platform approach, Darktrace empowers security teams with real-time monitoring and insights across both the network and cloud.

Unified visibility in the modern threat landscape

As part of the Darktrace ActiveAI Security Platform™, Darktrace / CLOUD works continuously across public, private, hybrid, and multi-cloud deployments. With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures.

It is always on the lookout for changes, driven by user and service activity. For example, unusual user activity can significantly raise the asset’s score, prompting Darktrace’s AI to update its architectural view and keep a living record of the cloud’s ever-changing landscape, providing near real-time insights into what’s happening.

This continuous architectural awareness ensures that security teams have a real-time understanding of cloud behavior and not just a static snapshot.

Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.
Figure 1. Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.

With this dynamic cloud visibility and monitoring, Darktrace / CLOUD can help unify and secure environments.

Real world example: Remote access supply chain attacks

Sectop Remote Access Trojan (RAT) malware, also known as ‘ArchClient2,’ is a .NET RAT that contains information stealing capabilities and allows threat actors to monitor and control targeted computers. It is commonly distributed through drive-by downloads of illegitimate software via malvertizing.

Darktrace has been able to detect and respond to Sectop RAT attacks using unified visibility and platform-wide coverage. In one such example, Darktrace observed one device making various suspicious connections to unusual endpoints, likely in an attempt to receive C2 information, perform beaconing activity, and exfiltrate data to the cloud.

This type of supply chain attack can jump from the network to the cloud, so a unified view of both environments helps shorten detection and response times, therefore mitigating potential impact. Darktrace’s ability to detect these cross-domain behaviors stems from its AI-driven, platform-native visibility.

Conclusion

Organizations need unified visibility to secure complex, hybrid environments effectively against threats and attacks. To achieve this type of comprehensive visibility, the gaps between legacy security tools across on-premises and cloud networks can be bridged with platform tools that use AI to boost data analysis for highly accurate behavioral prediction and anomaly detection.

Read more about the latest trends in cloud security in the blog “Protecting Your Hybrid Cloud: The Future of Cloud Security in 2025 and Beyond.”

References:

1. Gartner, May 22, 2023, “10 Strategic Data and Analytics Predictions Through 2028

2. Cloud Security Alliance, February 14, 2024, “Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats

3. IBM, “Cost of a Data Breach Report 2024

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

OT

/

June 11, 2025

Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi

man working on computerDefault blog imageDefault blog image

Understanding supply chain risk in manufacturing

For industries running Industrial Control Systems (ICS) such as manufacturing and fast-moving consumer goods (FMCG), complex supply chains mean that disruption to one weak node can have serious impacts to the entire ecosystem. However, supply chain risk does not always originate from outside an organization’s ICS network.  

The implicit trust placed on software or shared services for maintenance within an ICS can be considered a type of insider threat [1], where defenders also need to look ‘from within’ to protect against supply chain risk. Attackers have frequently mobilised this form of insider threat:

  • Many ICS and SCADA systems were compromised during the 2014 Havex Watering Hole attack, where via operators’ implicit trust in the trojanized versions of legitimate applications, on legitimate but compromised websites [2].
  • In 2018, the world’s largest manufacturer of semiconductors and processers shut down production for three days after a supplier installed tainted software that spread to over 10,000 machines in the manufacturer’s network [3].
  • During the 2020 SolarWinds supply chain attack, attackers compromised a version of Orion software that was deployed from SolarWinds’ own servers during a software update to thousands of customers, including tech manufacturing companies such as Intel and Nvidia [4].

Traditional approaches to ICS security have focused on defending against everything from outside the castle walls, or outside of the ICS network. As ICS attacks become more sophisticated, defenders must not solely rely on static perimeter defenses and prevention. 

A critical part of active defense is understanding the ICS environment and how it operates, including all possible attack paths to the ICS including network connections, remote access points, the movement of data across zones and conduits and access from mobile devices. For instance, original equipment manufacturers (OEMs) and vendors often install remote access software or third-party equipment in ICS networks to facilitate legitimate maintenance and support activities, which can unintentionally expand the ICS’ attack surface.  

This blog describes an example of the convergence between supply chain risk and insider risk, when a vendor left a Raspberry Pi device in a manufacturing customer’s ICS network without the customer’s knowledge.

Case study: Using unsupervised machine learning to detect pre-existing security issues

Raspberry Pi devices are commonly used in SCADA environments as low-cost, remotely accessible data collectors [5][6][7]. They are often paired with Industrial Internet of Things (IIoT) for monitoring and tracking [8]. However, these devices also represent a security risk because their small physical size and time-consuming nature of physical inspection makes them easy to overlook. This poses a security risk, as these devices have previously been used to carry out USB-based attacks or to emulate Ethernet-over-USB connections to exfiltrate sensitive data [8][9].

In this incident, a Darktrace customer was unaware that their supplier had installed a Raspberry Pi device on their ICS network. Crucially, the installation occurred prior to Darktrace’s deployment on the customer’s network. 

For other anomaly detection tools, this order of events meant that this third-party device would likely have been treated as part of the customer’s existing infrastructure. However, after Darktrace was deployed, it analyzed the metadata from the encrypted HTTPS and DNS connections that the Raspberry Pi made to ‘call home’ to the supplier and determined that these connections were  unusual compared to the rest of the devices in the network, even in the absence of any malicious indicators of compromise (IoCs).  

Darktrace triggered the following alerts for this unusual activity that consequently notified the customer to the pre-existing threat of an unmanaged device already present in their network:

  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Agent Beacon (Short Period)
  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Tags / New Raspberry Pi Device
  • Device / DNS Requests to Unusual Server
  • Device / Anomaly Indicators / Spike in Connections to Rare Endpoint Indicator
Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  
Figure 1: Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the activity, correlating related events into a broader incident and generating a report outlining the potential threat along with supporting technical details.

Darktrace’s anomaly-based detection meant that the Raspberry Pi device did not need to be observed performing clearly malicious behavior to alert the customer to the security risk, and neither can defenders afford to wait for such escalation.

Why is this significant?

In 2021 a similar attack took place. Aiming to poison a Florida water treatment facility, attackers leveraged a TeamViewer instance that had been dormant on the system for six months, effectively allowing the attacker to ‘live off the land’ [10].  

The Raspberry Pi device in this incident also remained outside the purview of the customer’s security team at first. It could have been leveraged by a persistent attacker to pivot within the internal network and communicate externally.

A proactive approach to active defense that seeks to minimize and continuously monitor the attack surface and network is crucial.  

The growing interest in manufacturing from attackers and policymakers

Significant motivations for targeting the manufacturing sector and increasing regulatory demands make the convergence of supply chain risk, insider risk, and the prevalence of stealthy living-off-the-land techniques particularly relevant to this sector.

Manufacturing is consistently targeted by cybercriminals [11], and the sector’s ‘just-in-time’ model grants attackers the opportunity for high levels of disruption. Furthermore, under NIS 2, manufacturing and some food and beverage processing entities are now designated as ‘important’ entities. This means stricter incident reporting requirements within 24 hours of detection, and enhanced security requirements such as the implementation of zero trust and network segmentation policies, as well as measures to improve supply chain resilience [12][13][14].

How can Darktrace help?

Ultimately, Darktrace successfully assisted a manufacturing organization in detecting a potentially disruptive 'near-miss' within their OT environment, even in the absence of traditional IoCs.  Through passive asset identification techniques and continuous network monitoring, the customer improved their understanding of their network and supply chain risk.  

While the swift detection of the rogue device allowed the threat to be identified before it could escalate, the customer could have reduced their time to respond by using Darktrace’s built-in response capabilities, had Darktrace’s Autonomous Response capability been enabled.  Darktrace’s Autonomous Response can be configured to target specific connections on a rogue device either automatically upon detection or following manual approval from the security team, to stop it communicating with other devices in the network while allowing other approved devices to continue operating. Furthermore, the exportable report generated by Cyber AI Analyst helps security teams to meet NIS 2’s enhanced reporting requirements.  

Sophisticated ICS attacks often leverage insider access to perform in-depth reconnaissance for the development of tailored malware capabilities.  This case study and high-profile ICS attacks highlight the importance of mitigating supply chain risk in a similar way to insider risk.  As ICS networks adapt to the introduction of IIoT, remote working and the increased convergence between IT and OT, it is important to ensure the approach to secure against these threats is compatible with the dynamic nature of the network.  

Credit to Nicole Wong (Principal Cyber Analyst), Matthew Redrup (Senior Analyst and ANZ Team Lead)

[related-resource]

Appendices

MITRE ATT&CK Mapping

  • Infrastructure / New Raspberry Pi Device - INITIAL ACCESS - T1200 Hardware Additions
  • Device / DNS Requests to Unusual Server - CREDENTIAL ACCESS, COLLECTION - T1557 Man-in-the-Middle
  • Compromise / Agent Beacon - COMMAND AND CONTROL - T1071.001 Web Protocols

References

[1] https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats

[2] https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/web-attack/139/havex-targets-industrial-control-systems

[3]https://thehackernews.com/2018/08/tsmc-wannacry-ransomware-attack.html

[4] https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack

[5] https://www.centreon.com/monitoring-ot-with-raspberry-pi-and-centreon/

[6] https://ieeexplore.ieee.org/document/9107689

[7] https://www.linkedin.com/pulse/webicc-scada-integration-industrial-raspberry-pi-devices-mryff

[8] https://www.rowse.co.uk/blog/post/how-is-the-raspberry-pi-used-in-the-iiot

[9] https://sepiocyber.com/resources/whitepapers/raspberry-pi-a-friend-or-foe/#:~:text=Initially%20designed%20for%20ethical%20purposes,as%20cyberattacks%20and%20unauthorized%20access

[10] https://edition.cnn.com/2021/02/10/us/florida-water-poison-cyber/index.html

[11] https://www.mxdusa.org/2025/02/13/top-cyber-threats-in-manufacturing/

[12] https://www.shoosmiths.com/insights/articles/nis2-what-manufacturers-and-distributors-need-to-know-about-europes-new-cybersecurity-regime

[13] https://www.goodaccess.com/blog/nis2-require-zero-trust-essential-security-measure#zero-trust-nis2-compliance

[14] https://logisticsviewpoints.com/2024/11/06/the-impact-of-nis-2-regulations-on-manufacturing-supply-chains/

Continue reading
About the author
Nicole Wong
Cyber Security Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI