June 25, 2024

Following up on our Conversation: Detecting & Containing a LinkedIn Phishing Attack with Darktrace

Darktrace/Email detected a phishing attack that had originated from LinkedIn, where the attacker impersonated a well known construction company to conduct a credential harvesting attack on the target. Darktrace’s ActiveAI Security Platform played a critical role in investigating the activity and initiating real-time responses that were outside the physical capability of human security teams.

Written by

Nicole Wong

Cyber Security Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Nicole Wong

Cyber Security Analyst

Jun 2024

Note: Real organization, domain and user names have been modified and replaced with fictitious names to maintain anonymity.

Social media cyber-attacks

Social media is a known breeding ground for cyber criminals to easily connect with a near limitless number of people and leverage the wealth of personal information shared on these platforms to defraud the general public. Analysis suggests even the most tech savvy ‘digital natives’ are vulnerable to impersonation scams over social media, as criminals weaponize brands and trends, using the promise of greater returns to induce sensitive information sharing or fraudulent payments [1].

LinkedIn phishing

As the usage of a particular social media platform increases, cyber criminals will find ways to exploit the increasing user base, and this trend has been observed with the rise in LinkedIn scams in recent years [2]. LinkedIn is the dominant professional networking site, with a forecasted 84.1million users by 2027 [3]. This platform is data-driven, so users are encouraged to share information publicly, including personal life updates, to boost visibility and increase job prospects [4] [5]. While this helps legitimate recruiters to gain a good understanding of the user, an attacker could also leverage the same personal content to increase the sophistication and success of their social engineering attempts.

Darktrace detection of LinkedIn phishing

Darktrace detected a Software-as-a-Service (SaaS) compromise affecting a construction company, where the attack vector originated from LinkedIn (outside the monitoring of corporate security tools), but then pivoted to corporate email where a credential harvesting payload was delivered, providing the attacker with credentials to access a corporate file storage platform.

Because LinkedIn accounts are typically linked to an individual’s personal email and are most commonly accessed via the mobile application [6] on personal devices that are not monitored by security teams, it can represent an effective initial access point for attackers looking to establish an initial relationship with their target. Moreover, user behaviors to ignore unsolicited emails from new or unknown contacts are less frequently carried over to platforms like LinkedIn, where interactions with ‘weak ties’ as opposed to ‘strong ties’ are a better predictor of job mobility [7]. Had this attack been allowed to continue, the threat actor could have leveraged access to further information from the compromised business cloud account to compromise other high value accounts, exfiltrate sensitive data, or defraud the organization.

LinkedIn phishing attack details

Reconnaissance

The initial reconnaissance and social engineering occurred on LinkedIn and was thus outside the purview of corporate security tools, Darktrace included.

However, the email domain “hausconstruction[.]com” used by the attacker in subsequent communications appears to be a spoofed domain impersonating a legitimate construction company “haus[.]com”, suggesting the attacker may have also impersonated an employee of this construction company on LinkedIn. In addition to spoofing the domain, the attacker seemingly went further to register “hausconstruction.com” on a commercial web hosting platform. This is a technique used frequently not just to increase apparent legitimacy, but also to bypass traditional security tools since newly registered domains will have no prior threat intelligence, making them more likely to evade signature and rules-based detections [8]. In this instance, open-source intelligence (OSINT) sources report that the domain was created several months earlier, suggesting this may have been part of a targeted attack on construction companies.

Initial Intrusion

It was likely that during the correspondence over LinkedIn, the target user was solicited into following up over email regarding a prospective construction project, using their corporate email account. In a probable attempt to establish a precedent of bi-directional correspondence so that subsequent malicious emails would not be flagged by traditional security tools, the attacker did not initially include suspicious links, attachments or use solicitous or inducive language within their initial emails.

Figure 1: Example of bi-directional email correspondence between the target and the attacker impersonating a legitimate employee of the construction company haus.com.

Figure 2: Cyber AI Analyst investigation into one of the initial emails the target received from the attacker.

To accomplish the next stage of their attack, the attacker shared a link, hidden behind the inducing text “VIEW ALL FILES”, to a malicious file using the Hightail cloud storage service. This is also a common method employed by attackers to evade detection, as this method of file sharing does not involve attachments that can be scanned by traditional security tools, and legitimate cloud storage services are less likely to be blocked.

OSINT analysis on the malicious link link shows the file hosted on Hightail was a HTML file with the associated message “Following up on our LinkedIn conversation”. Further analysis suggests the file contained obfuscated Javascript that, once opened, would automatically redirect the user to a malicious domain impersonating a legitimate Microsoft login page for credential harvesting purposes.

Figure 3: The malicious HTML file containing obfuscated Javascript, where the highlighted string references the malicious credential harvesting domain.

Screenshot of fraudulent Microsoft Sign In page hosted on the malicous credential harvesting domain. — Figure 4: Screenshot of fraudulent Microsoft Sign In page hosted on the malicious credential harvesting domain.

Although there was prior email correspondence with the attacker, this email was not automatically deemed safe by Darktrace and was further analyzed for unusual properties and unusual communications for the recipient and the recipient’s peer group.

Darktrace determined that:

It was unusual for this file storage solution to be referenced in communications to the user and the wider network
Textual properties of the email body suggested a high level of inducement from the sender, with a high level of focus on the phishing link.
The full link contained suspicious properties suggesting it is high risk.

Figure 5: Darktrace’s analysis of the phishing email, presenting key information about the unusual characteristics of this email, information on highlighted content, and an overview of actions that were initially applied.

Based on these anomalies, Darktrace initially moved the phishing email to the junk folder and locked the link, preventing the user from directly accessing the malicious file hosted on Hightail. However, the customer’s security team released the email, likely upon end-user request, allowing the target user to access the file and ultimately enter their credentials into that credential harvesting domain.

Figure 6: Darktrace alerts triggered by the malicious phishing email and the corresponding Autonomous Response actions.

Lateral Movement

Correspondence between the attacker and target continued for two days after the credential harvesting payload was delivered. Five days later, Darktrace detected an unusual login using multi-factor authentication (MFA) from a rare external IP and ASN that coincided with Darktrace/Email logs showing access to the credential harvesting link.

This attempt to bypass MFA, known as an Office365 Shell WCSS attack, was likely achieved by inducing the target to enter their credentials and legitimate MFA token into the fake Microsoft login page. This was then relayed to Microsoft by the attacker and used to obtain a legitimate session. The attacker then reused the legitimate token to log into Exchange Online from a different IP and registered their own device for MFA.

Figure 7: Screenshot within Darktrace/Email of the phishing email that was released by the security team, showing the recipient clicked the link to file storage where the malicious payload was stored.

‍

Figure 8: Event Log showing a malicious login and MFA bypass at 17:57:16, shortly after the link was clicked. Highlighted in green is activity from the legitimate user prior to the malicious login, using Edge. Highlighted in orange and red is the malicious activity using Chrome.

The IP addresses used by the attacker appear to be part of anonymization infrastructure, but are not associated with any known indicators of compromise (IoCs) that signature-based detections would identify [9] [10].

In addition to logins being observed within half an hour of each other from multiple geographically impossible locations (San Francisco and Phoenix), the unexpected usage of Chrome browser, compared to Edge browser previously used, provided Darktrace with further evidence that this activity was unlikely to originate from the legitimate user. Although the user was a salesperson who frequently travelled for their role, Darktrace’s Self-Learning AI understood that the multiple logins from these locations was highly unusual at the user and group level, and coupled with the subsequent unexpected account modification, was a likely indicator of account compromise.

Accomplish mission

Although the email had been manually released by the security team, allowing the attack to propagate, additional layers of defense were triggered as Darktrace's Autonomous Response initiated “Disable User” actions upon detection of the multiple unusual logins and the unauthorized registration of security information.

However, the customer had configured Autonomous Response to require human confirmation, therefore no actions were taken until the security team manually approved them over two hours later. In that time, access to mail items and other SharePoint files from the unusual IP address was detected, suggesting a potential loss of confidentiality to business data.

Figure 9: Advanced Search query showing several FilePreviewed and MailItemsAccessed events from either the IPs used by the attacker, or using the software Chrome. Note some of the activity originated from Microsoft IPs which may be whitelisted by traditional security tools.

However, it appears that the attacker was able to maintain access to the compromised account, as login and mail access events from 199.231.85[.]153 continued to be observed until the afternoon of the next day.

Conclusion

This incident demonstrates the necessity of AI to security teams, with Darktrace’s ActiveAI Security Platform detecting a sophisticated phishing attack where human judgement fell short and initiated a real-time response when security teams could not physically respond as fast.

Security teams are very familiar with social engineering and impersonation attempts, but these attacks remain highly prevalent due to the widespread adoption of technologies that enable these techniques to be deployed with great sophistication and ease. In particular, the popularity of information-rich platforms like LinkedIn that are geared towards connecting with unknown people make it an attractive initial access point for malicious attackers.

In the second half of 2023 alone, over 200 thousand fake profiles were reported by members on LinkedIn [11]. Fake profiles can be highly sophisticated, use professional images, contain compelling descriptions, reference legitimate company listings and present believable credentials.

It is unrealistic to expect end users to defend themselves against such sophisticated impersonation attempts. Moreover, it is extremely difficult for human defenders to recognize every fraudulent interaction amidst a sea of fake profiles. Instead, defenders should leverage AI, which can conduct autonomous investigations without human biases and limitations. AI-driven security can ensure successful detection of fraudulent or malicious activity by learning what real users and devices look like and identifying deviations from their learned behaviors that may indicate an emerging threat.

Appendices

Darktrace Model Detections

DETECT/ Apps

SaaS / Compromise / SaaS Anomaly Following Anomalous Login

SaaS / Compromise / Unusual Login and Account Update

SaaS / Unusual Activity / Multiple Unusual External Sources For SaaS Credential

SaaS / Access / Unusual External Source for SaaS Credential Use

SaaS / Compliance / M365 Security Information Modified

‍

RESPOND/ Apps

Antigena / SaaS / Antigena Suspicious SaaS Activity Block

Antigena / SaaS / Antigena Unusual Activity Block

DETECT & RESPOND/ Email

· Link / High Risk Link + Low Sender Association

· Link / New Correspondent Classified Link

· Link / Watched Link Type

· Antigena Anomaly

· Association / Unknown Sender

· History / New Sender

· Link / Link to File Storage

· Link / Link to File Storage + Unknown Sender

· Link / Low Link Association

List of IoCs

· 142.252.106[.]251 - IP - Possible malicious IP used by attacker during cloud account compromise

· 199.231.85[.]153 – IP - Probable malicious IP used by attacker during cloud account compromise

· vukoqo.hebakyon[.]com – Endpoint - Credential harvesting endpoint

MITRE ATT&CK Mapping

· Resource Development - T1586 - Compromise Accounts

· Resource Development - T1598.003 – Spearphishing Link

· Persistence - T1078.004 - Cloud Accounts

· Persistence - T1556.006 - Modify Authentication Process: Multi-Factor Authentication

· Reconnaissance - T1593.001 – Social Media

· Reconnaissance - T1598 – Phishing for Information

· Reconnaissance - T1589.001 – Credentials

· Reconnaissance - T1591.002 – Business Relationships

· Collection - T1111 – Multifactor Authentication Interception

· Collection - T1539 – Steal Web Session Cookie

· Lateral Movement - T1021.007 – Cloud Services

· Lateral Movement - T1213.002 - Sharepoint

References

[1] Jessica Barker, Hacked: The secrets behind cyber attacks, (London: Kogan Page, 2024), p. 130-146.

[2] https://www.bitdefender.co.uk/blog/hotforsecurity/5-linkedin-scams-and-how-to-avoid-them/

[3] https://www.washingtonpost.com/technology/2023/08/31/linkedin-personal-posts/

[4] https://www.forbes.com/sites/joshbersin/2012/05/21/facebook-vs-linkedin-whats-the-difference/

[5] https://thelinkedblog.com/2022/3-reasons-why-you-should-make-your-profile-public-1248/

[6] https://www.linkedin.com/pulse/50-linkedin-statistics-every-professional-should-ti9ue

[7] https://www.nytimes.com/2022/09/24/business/linkedin-social-experiments.html

[8] https://darktrace.com/blog/the-domain-game-how-email-attackers-are-buying-their-way-into-inboxes

[9] https://spur.us/context/142.252.106[.]251

[10] https://spur.us/context/199.231.85[.]153

[11]https://www.statista.com/statistics/1328849/linkedin-number-of-fake-accounts-detected-and-removed

Written by

Nicole Wong

Cyber Security Analyst

Inside the SOC

Written by

Nicole Wong

Cyber Security Analyst

•

August 3, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

Watch the NIS2 Webinar

Blog

AI

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

Darktrace successfully detected and quarantined a prompt injection email before it could be processed by an enterprise AI agent.
Prompt injection attacks increasingly rely on natural language rather than traditional malware, making behavioral analysis an important complement to signature-based detection.
Organizations deploying AI agents should combine model guardrails with behavioral monitoring to reduce the risk of malicious instructions reaching enterprise systems.

How behavioral detection helps stop prompt injection attacks

A Darktrace customer running a Gemini AI agent in Google Cloud asked us two simple questions:

“If my agent can read inbound emails and access internal data, what stops an attacker from hiding malicious instructions in the message? Couldn’t the agent be tricked into deleting or exfiltrating sensitive data?”

The scenario centers on an indirect prompt injection attack, where malicious instructions are hidden inside content that an AI model later interprets as trusted input. The same weakness was exposed by EchoLeak (CVE-2025-32711), a zero-click Microsoft 365 Copilot vulnerability enabled data exfiltration from a single well-crafted email..

This blog follows the Darktrace team’s investigation of the customer’s hypothesis and examines how the attack interacted with their existing security stack. The results highlight which defenses held, where gaps emerged, and how behavioral detection mattered more than guardrails. This investigation also demonstrates why behavioral detection is becoming increasingly important for AI security, as prompt injections often contain no traditional indicators of compromise.

How do prompt injection attacks work?

Prompt injection works by carefully crafting the content and structure of the prompt to alter the LLM’s behavior or output in unintended ways. This can cause models to violate guardrails, generate harmful content or enable unauthorised access.

Prompt injection attack example

The well-known example, EchoLeak (CVE-2025-32711), was a zero-click vulnerability in Microsoft 365 Copilot that relied on a carefully crafted email containing hidden instructions that the AI system interpreted as commands rather than content, creating a pathway for unauthorized access to sensitive information without any user interaction.

While Darktrace / SECURE AI is designed to prevent agents from producing unintended outcomes, we wanted to see if we could catch and prevent this threat type earlier in the attack life-cycle, at the email security layer.

How we tested prompt injection attacks on an enterprise agent

Summary:

Claude generated a prompt injection payload.
Hidden instructions were embedded in an email.
The email passed traditional validation checks.
Darktrace analyzed the language and sender behavior.
The email was quarantined before the AI agent could process it.

To test Darktrace / EMAIL against this attack class, we opened Claude, gave it the customer's context and problem statement (Gemini agent with inbox access, internal tool calls), told it we were validating Darktrace / EMAIL's detection of prompt injections, and asked for a test payload. See below:

Despite the guardrails supposedly built into the model, Claude surprisingly gave us the entire exploit in plaintext (albeit very basic), illegible to a human as the text was sent in white text (see Figure 1) but framed as an authoritative override for anything downstream reading the mail programmatically (i.e. the Gemini agent).

How Darktrace detected a prompt injection attack

We then sent the Claude-crafted email from a freemail address to the target recipient’s inbox. Despite the email containing no malicious payload, the freemail address having no malicious reputation, and the validation checks all passing, Darktrace /EMAIL flagged the email as a 93/100 anomaly and moved it to junk, out of scope for the AI agent.

Figure 3: *The test email sent with the hidden prompt injection*

*Figure 4: The email analysis in Darktrace / EMAIL*

Figure 5: Darktrace / EMAIL detection of malicious activity

The interesting part is what triggered the detection (see Figure 5)

Possible machine prompt content: text in the body detected as instructions written for a machine to execute, not for a human to read

Possible machine prompt content + basic suspicious correspondence: the same content, correlated with sender-side anomalies: freemail domain (yahoo[.]com), unknown correspondent, no prior mail history with the recipient, and suspicious references to payment information

Neither of those is a signature match. Nothing in the email was on a blacklist. There was no malware, no link and no attachment. Darktrace analyzed the context in which the email was delivered and flagged it as likely risky. The anomalous language features and the context of the sender relative to the recipient's normal behavior, combined with the unusual hidden text (prompt) were enough for Darktrace / EMAIL to act on the risk.

Result: Darktrace / EMAIL autonomously junked the email, out of scope for any AI agent parsing the inbox.

Why behavioral security makes a difference detecting prompt injection attacks

Cyberattacks don't look like traditional exploits anymore. They now operate in natural language, not strictly code.

That breaks the traditional stack. AV, firewalls, static scanning and signature-based SEGs all assume a payload to inspect.

A prompt injection has no payload. It's just an instruction, written in natural language, dressed up as anything the attacker wants: an invoice, an HR request, a calendar invite, some simple PowerPoint slides.

EchoLeak proved that hidden instructions can sit inside an email invisible to the user but fully readable by the LLM, and the LLM will follow them blindly.

This test and GTG-1002 proved that the LLM itself can be socially engineered. Tell it you're an authorized tester and it will hand you the attack.

Rules and static classifiers can catch the obvious cases. But natural language has infinite variants, and the attack surface is the model's innate functionality to comply.

The deeper problem here is intent: an LLM can't reliably tell whether an instruction in its context came from its developer, its user, or an attacker who slipped it into an email. To the LLM, everything reads as language and looks like a legitimate ask. This is why behavioural detection wins, as you become aware of intent when you look at the context of an interaction. Does this sender normally send this kind of message to this recipient? Does this prompt fit the user's normal pattern? Is this agent behaving the way this agent normally behaves?

Intent can't be read off a single email, it emerges from behavioral context. Which is how Darktrace enables threat detection, through behavioral understanding.

Why enterprise AI security requires more than guardrails

Claude didn't roll over immediately… the first section of the response was a (slight) pushback, but then it wrote the payload anyway without having to ask twice.

Here the framing of the prompt did all the work. The “testing security capabilities” angle moved the model from refusal to unquestioned compliance to the user prompt.

This isn't the first time this has happened, of course. Anthropic disclosed in November 2025 that a Chinese state-sponsored group they tracked as GTG-1002 ran the first documented AI-orchestrated espionage campaign against ~30 targets by posing as employees of a legitimate cybersecurity firm doing authorised penetration testing.

The takeaway isn't that AI guardrails are ineffective. They raise the cost of low-effort attacks and remain an important first layer of defense. However, for most organizations today, they’re the only line of defense when deploying AI agents. If a prompt injection bypasses those controls, organizations still need a way to detect and stop malicious behavior elsewhere in the attack chain.

Attackers will continue to have working prompt injections easily and quickly. The question is what stops one when it lands in an inbox your agent is reading.

That's where behavioral detection comes in.

How Darktrace detects prompt injection attacks in emails

Two things Darktrace does that a model-level guardrail or static rules and signatures can't:

Natural language analysis at the email or prompt layer. The email is assessed on its own merits: is this content shaped like instructions for a machine, regardless of what the receiving agent decides to do about it?

Behavioral context around the language. An AI agent behaves like an extremely agreeable human, and it will go above and beyond to comply with the user’s request. That's exactly why you must consider the business context, such sender behaviour, mailing history, and organisational norms, as these matter even more when the recipient is an AI.

Darktrace has been perfecting behavioral anomaly detection for over a decade; the same self-learning approach that catches BEC and account takeover applies directly to prompt injection delivery. Our multi-layered AI stack extracts content from the message, builds behavioural understanding through social graphing and Pattern of Life analysis, and then combines natural language, topic, inducement, sender relationship and anomaly signals before deciding what action to take.

This matters for prompt injection because the threat is not the plain language itself, but the intent behind the language that can cause an AI agent to respond in unexpected ways.

How to secure enterprise AI operations from prompt injection attacks

Email was the entry point in this case, but it is only one of many possible vectors.

Anywhere an agent can retrieve information, an attacker can potentially introduce a prompt injection.

Emails, documents, SharePoint sites, web pages, knowledge bases, chat platforms, and third-party integrations all provide opportunities to influence an agent's behavior. Wherever an agent finds its orders, a prompt injection opportunity exists.

This is why securing AI requires more than blocking malicious inputs. Organizations also need visibility into how agents behave after consuming information from across their environment. If an agent begins accessing unexpected data, taking unusual actions, or operating outside its normal patterns, those behaviors may provide the strongest signal that something has gone wrong.

Effective AI security requires defense in depth: reducing the likelihood of malicious instructions reaching the agent while maintaining the ability to detect and investigate suspicious behavior if they do.

The challenge isn't protecting a single entry point. It's recognizing that, in an AI-powered environment, every source of information is also a potential source of influence.

Are you deploying autonomous agents across your enterprise and want to see this tested in your environment? Let's talk.

About the author

Carlo Loregian

Solutions Engineer

Blog

AI

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

AI agents are rapidly becoming embedded in everyday business operations, helping employees automate workflows, access information, and accelerate decision-making. As organizations embrace agentic AI, security teams face a growing challenge: understanding how AI is being used, what agents can access, and where risk may emerge.

As agents take on more business-critical work, security teams often need to move across multiple portals to understand risks spanning identity, data, and threat activity. This fragmented view can make it difficult to assess an agent's overall risk posture and determine where attention is needed. Organizations need a way to bring these signals together without disrupting existing security investments or workflows.

Today, Darktrace is announcing an integration between Darktrace / SECURE AI and Microsoft Agent 365 that brings Darktrace's Adaptive AI-driven risk signals directly into the Microsoft 365 Admin Center. By extending the visibility and risk understanding provided by Darktrace / SECURE AI into the Microsoft ecosystem, organizations can gain a more unified understanding of AI agent risk across their environments.

As one of the first security companies to partner with Microsoft to contribute third-party risk signals to the Agent Registry, Darktrace is helping shape how organizations understand and manage AI agent risk.

Extending visibility into the Microsoft Agent 365 experience

Microsoft Agent 365 provides administrators with a centralized registry of AI agents operating within their environment. As organizations expand their use of AI agents, this centralized visibility becomes increasingly important for governance and oversight.

This new integration extends that visibility by allowing Darktrace-generated risk signals to be surfaced directly within the Microsoft Agent 365 experience. By combining Microsoft's agent management and security capabilities with Darktrace's AI-powered risk analysis, organizations gain greater awareness of potential security concerns associated with AI agents operating across their environments.

By integrating Darktrace telemetry into Agent 365, customers can:

Surface Darktrace-detected risks and signals alongside Microsoft-native signals in a single interface

Identify potentially compromised or anomalous AI agents more quickly

Gain unified understanding of context and agent behavior

This approach reinforces a single control plane for AI security while allowing organizations to continue leveraging existing investments across both platforms.

Why unified visibility of AI agent risk signals matters

As AI adoption accelerates across Microsoft environments, organizations must manage new forms of behavior, access patterns, and risk. Security teams need more than inventories and permissions. They need visibility into how AI systems operate and how risk evolves over time.

This integration addresses a critical gap: how to bring behavioral AI security insights into the same control plane as identity, access, and agent management.

With Darktrace and Microsoft Agent 365 together, organizations benefit from:

Unified visibility: A single pane of glass for understanding AI agent risk signals across Microsoft and Darktrace signals

Faster detection of abnormal agent behavior: Darktrace's Adaptive AI highlights deviations that may not be captured by static controls

Operational efficiency: Security teams can triage and prioritize risk signals without switching between systems

Stronger trust in AI deployments: Clear attribution, context, and investigation pathways improve confidence in AI agent usage

Extending Microsoft's AI security model, not replacing it

Securing AI requires a layered approach that combines governance, visibility, threat detection, and risk management. This integration is designed to complement Microsoft's security capabilities, not duplicate them.

Through Darktrace / SECURE AI, Darktrace contributes:

Identification of risk via advanced prompt analysis

Behavioral anomaly detection across AI agents

Cross-environment threat correlation

Autonomous insight into emerging or unknown risks

Microsoft provides:

Centralized agent management

Identity and access governance

Native detection of risk signals and enforcement capabilities

Together, these capabilities create a more complete, layered approach to securing AI-driven enterprises. Organizations gain the governance and policy controls needed to manage AI adoption while benefiting from continuous visibility into how AI is used across the business.

Building the future of secure AI

As AI agents become more deeply embedded in business processes, organizations need more than inventories and static controls. They need to understand how AI is being used, how agents behave, and where risk is emerging across the enterprise.

Darktrace / SECURE AI delivers that understanding through continuous visibility into AI activity, helping security teams assess intent, identify behavioral drift, and uncover emerging risk across both human and agent-driven workflows. Powered by Adaptive AI, it provides the context needed to secure AI as it evolves.

The integration with Microsoft Agent 365 extends those insights into the workflows organizations already use. Agent 365 provides a unified control plane for governing and securing AI agents, while Darktrace contributes complementary behavioral risk signals that can be surfaced within the Agent 365 experience. Together, they give customers broader context on agent activity and risk while preserving the value of their existing Microsoft and Darktrace investments.

As enterprises move from AI experimentation to AI-powered execution, Microsoft and Darktrace help bring together governance, compliance, behavioral understanding, and oversight in a unified approach to AI security. For organizations adopting Microsoft 365 E7, Darktrace / SECURE AI further strengthens that foundation by providing continuous visibility into AI activity, agent behavior, and emerging risk as AI adoption scales.

About the author

The Darktrace Community

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Following up on our Conversation: Detecting & Containing a LinkedIn Phishing Attack with Darktrace

Following up on our Conversation: Detecting & Containing a LinkedIn Phishing Attack with Darktrace

Social media cyber-attacks

LinkedIn phishing

Darktrace detection of LinkedIn phishing

LinkedIn phishing attack details

Reconnaissance

Initial Intrusion

Lateral Movement

Accomplish mission

Conclusion

Appendices

Darktrace Model Detections

List of IoCs

MITRE ATT&CK Mapping

References

Why Trust is the New Attack Surface: Darktrace’s Mid-Year Threat Update 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Enjoying the blog?

More in this series

Darktrace / EMAIL Expands Behavioral Defense Across Email and Collaboration Workflows

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL

Blog

AI

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

How behavioral detection helps stop prompt injection attacks

How do prompt injection attacks work?

Prompt injection attack example

How we tested prompt injection attacks on an enterprise agent

How Darktrace detected a prompt injection attack

Why behavioral security makes a difference detecting prompt injection attacks

Why enterprise AI security requires more than guardrails

How Darktrace detects prompt injection attacks in emails

How to secure enterprise AI operations from prompt injection attacks

Blog

AI

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

Extending visibility into the Microsoft Agent 365 experience

Why unified visibility of AI agent risk signals matters

Extending Microsoft's AI security model, not replacing it

Building the future of secure AI