Cloud environments operate at speed, with workloads spinning up and down in seconds. This agility is great for business and is one of the main reasons for cloud adoption. But this same agility and speed presents new challenges for security teams. When a threat emerges, every second counts—yet many organizations struggle with slow Mean Time to Respond (MTTR) due to operational bottlenecks, outdated tooling, and the complexity of modern cloud infrastructure.
To minimize disruption and potential damage, containment is a critical step in incident response. By effectively responding to contain a threat, organizations can help prevent lateral movement limiting an attack’s impact.
However, containment is not the end goal. Full remediation requires a deep understanding of exactly what happened, how far the threat spread, and what assets were involved and what changes may be needed to prevent it from happening again.
This is why Darktrace’s recent acquisition of Cado is so exciting. Darktrace / CLOUD provides real-time threat detection and automated cloud native response for containment. With Cado, Darktrace / CLOUD ensures security teams have the forensic insights that are required to fully remediate and strengthen their defenses.
Why do organizations struggle with MTTR in the cloud?
Many security teams experience delays in fully responding to cloud threats due to several key challenges:
1. Limited access to cloud resources
Security teams often don’t have direct access to cloud environments because often infrastructure is managed by a separate operations team—or even an outsourced provider. When a threat is detected, analysts must submit access requests or escalate to another team, slowing down investigations.
This delay can be particularly costly in cloud environments where attacks unfold rapidly. Without immediate access to affected resources, the time to contain, investigate, and remediate an incident can increase significantly.
2. The cloud’s ephemeral nature
Cloud workloads are often dynamic and short-lived. Serverless functions, containers, and auto-scaling resources can exist for minutes or even seconds. If a security event occurs in one of these ephemeral resources and it disappears before forensic data is captured, understanding the full scope of the attack becomes nearly impossible.
Traditional forensic methods, which rely on static endpoints, fail in these environments—leaving security teams blind to what happened.
3. Containment is critical, but businesses require more
Automated cloud native response for containment is essential for stopping an attack in progress. However, regulatory frameworks underline the need for a full understanding to prove the extent of an incident and determine the root cause, this goes beyond just containing a threat.
Digital Operational Resilience Act (DORA): [1] Enacted by the European Union, DORA requires financial entities to establish robust incident reporting mechanisms. Organizations must detect, manage, and notify authorities of significant ICT-related incidents, ensuring a comprehensive understanding of each event's impact. This includes detailed analysis and documentation to enhance operational resilience and compliance.
Network and Information Security Directive 2 (NIS2): [2]This EU directive imposes advanced reporting obligations on essential and important entities, requiring them to report significant cybersecurity incidents to relevant authorities. Organizations must conduct thorough post-incident analysis to understand the incident's scope and prevent future occurrences.
Forensic analysis plays a critical role in full remediation, particularly when organizations need to:
- Conduct post-incident investigations for compliance and reporting.
- Identify affected data and impacted users.
- Understand attacker behavior to prevent repeat incidents.
Without a clear forensic understanding, security teams are at risk of incomplete remediation, potentially leaving gaps that adversaries can exploit in a future attack.
How Darktrace / CLOUD & Cado reduce MTTR and enable full remediation
By combining Darktrace / CLOUD’s AI-driven platform with Cado’s automated forensics capture, organizations can achieve rapid containment and deep investigative capabilities, accelerating MTTR metrics while ensuring full remediation in complex cloud environments.
Darktrace / CLOUD: Context-aware anomaly detection & cloud native response
Darktrace / CLOUD provides deep visibility into hybrid cloud environments, by understanding the relationships between assets, identity behaviours, combined with misconfiguration data and runtime anomaly activity. Enabling customers to:
- Detect and contain anomalous activity before threats escalate.
- Understand how cloud identities, permissions, and configurations contribute to organizational risk.
- Provide visibility into deployed cloud assets and services logically grouped into architectures.
Even in containerized services like AWS Fargate, where traditional endpoint security tools often struggle due to the lack of persistent accessible infrastructure, Darktrace / CLOUD monitors for anomalous behavior. If a threat is detected, security teams can launch a Cado forensic investigation from the Darktrace platform, ensuring rapid evidence collection and deeper analysis.
Ensuring:
- Complete timeline reconstruction to understand the full impact.
- Identification of persistence mechanisms that attackers may have left behind.
- Forensic data preservation to meet compliance mandates like DORA, NIS2, and ISO 27001.
The outcome: Faster, smarter incident response
Darktrace / CLOUD with Cado enables organizations to detect, contain and forensically analyse activity across hybrid cloud environments
- Reduce MTTR by automating containment and enabling forensic analysis.
- Seamlessly pivot to a forensic investigation when needed—right from the Darktrace platform.
- Ensure full remediation with deep forensic insights—even in ephemeral environments.
Stopping an attack is only the first step—understanding its impact is what prevents it from happening again. Together, Darktrace / CLOUD and Cado empower security teams to investigate, respond, and remediate cloud threats with speed and confidence.
References
[1] eiopa.europa.eu
[2] https://zcybersecurity.com/eu-nis2-requirements
