May 21, 2020

Securing AWS Cloud Environments

Discover how self-learning AI in AWS environments detects and beats threats early with enterprise-wide analysis.

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Andrew Tsonchev

VP, Security & AI Strategy, Field CISO

May 2020

Cloud platforms transform the way we build digital infrastructure, allowing us to create incredibly innovative environments for business – but often, it’s at the cost of visibility and control.

With complex hybrid and multi-cloud infrastructures becoming an essential part of increasingly diverse digital estates, the journey to the cloud has fundamentally reshaped the traditional paradigm of the network perimeter, while expanding the attack surface at an alarming rate. Meanwhile, traditional security controls still only offer point solutions that rely on retrospective rules and threat signatures and fail to stop novel and advanced attacks.

To shoulder the weight of shared responsibility for cloud security, organizations require the approach offered by Darktrace DETECT & RESPOND. With Self-Learning AI, DETECT continuously learns what normal ‘patterns of life’ look like for every user, device, virtual machine, and container across an organization. By actively developing a bespoke understanding of ‘self,’ the DETECT can identify the subtle anomalies that point to an advanced attack, without any pre-defined assumptions of ‘good’ or ‘bad' and RESPOND can autonomously interfere to stop emerging threats without disrupting business operations.

As more and more businesses turn to AWS to leverage the benefits of cloud infrastructure, gaining visibility and security for AWS-hosted data and applications is absolutely crucial. The advent of AWS VPC traffic mirroring has allowed Darktrace to shine a light on blind spots in our customers’ AWS environments, ensuring that our Cyber AI security platform can stop any type of threat that emerges. With the AI-powered security securing your AWS environment, you can embrace all the benefits of the cloud with confidence.

Self-learning Cyber AI with granular, real-time visibility

VPC traffic mirroring gives our Self-Learning AI access to granular packet data, allowing DETECT to extract hundreds of features from the raw data and build rich behavioral models for our customers’ AWS cloud environments. This real-time visibility to the underlying fabric of AWS environments provided by VPC traffic mirroring helps Darktrace Cyber AI learn ‘on the job,’ continuously adapting as your business evolves. Darktrace provides the only security solution that learns in real time, a critical feature given the speed and scale of development in the cloud.

Unified control: Correlating patterns across infrastructure

Taking a fundamentally unique approach, DETECT actively correlates activity across AWS and beyond – whether your digital ecosystem includes other cloud environments, SaaS applications, or any range of on- and off-premise infrastructure. From a threat detection perspective, this is crucial, as security events detected in one part of an organization are often part of a broader security incident. This ensures that threats in the cloud are not siloed from monitoring of the rest of the infrastructure, nor are the implications for cloud security ignored when intrusions occur elsewhere in the network.

Neutralizing sophisticated and novel attacks

Legacy security controls miss novel and advanced attacks targeting cloud infrastructure. With VPC traffic mirroring supporting Darktrace Cyber AI’s understanding of an organization’s AWS environment, any slight changes from normal behavior that may indicate a potential threat can be detected immediately. This allows the DETECT to catch the full range of cloud-based attacks, from zero-day malware, to stealthy insider threats.

“Darktrace represents a new frontier in AI-based cyber defense. Our team now has complete real-time coverage across our SaaS applications and cloud containers.”

— CIO, City of Las Vegas

How it works: Using VPC traffic mirroring to analyze AWS traffic

For customers leveraging AWS within an IaaS model, Darktrace uses VPC traffic mirroring to collect metadata from mirrored VPC packets in a Darktrace probe known as a ‘vSensor’. The vSensor captures real-time traffic and selectively forwards relevant metadata to a Darktrace cloud instance or on-premise probe. From here, DETECT correlates VPC traffic with cloud, email, network, and SaaS traffic across a customer’s hybrid and multi-cloud infrastructure for analysis.

By utilizing VPC traffic mirroring in this way, the Immune System can perform deep packet inspection on traffic in the customer’s AWS cloud environment, up to and including the application layer. Hundreds of features are extracted from the raw data, ranging from high-level metrics of data flow quantities, to peer relationship meta-data, to specific application layer events. These features allow Darktrace Cyber AI to build rich behavioral models that let it understand normal patterns of life for the organization and detect malicious activity. It is important that Darktrace is able to construct these metrics from the raw data rather than relying on flow logs alone, as flow logs don't provide the required level of granularity or real-time events within connections.

For non-Nitro AWS instances, we deploy lightweight agents known as ‘OS-Sensors’ that feed relevant traffic to a local vSensor and, in turn, to a Darktrace cloud instance or on-premise probe. Once configured, OS-Sensors can easily be scaled as new instances are spun up. Darktrace also offers a specialized OS-Sensor that provides coverage in containerized systems like Docker and Kubernetes.

Richer context with AWS CloudTrail logs

In addition to analyzing data with VPC traffic mirroring, the DETECT also monitors management and data events within AWS. It does so via HTTP requests for logfiles generated by AWS CloudTrail, which monitors events from all AWS services, including:

EC2
IAM
S3
VPC
Lambda

Different event types produced via CloudTrail are organized by Darktrace into categories based on the action type and the AWS services that generate it. These different categories show up as metrics in the DETECT user interface, the Threat Visualizer. This information is used to provide even richer context in connection with mirrored traffic in VPCs, as well as all cloud, network, email, and SaaS traffic across a customer’s entire digital environment.

Darktrace deployment scenarios for AWS customers

For IaaS environments, Darktrace deploys a vSensor in each cloud environment. Within AWS environments, the vSensor captures real-time traffic with AWS VPC traffic mirroring. The receiving vSensor processes the data and feeds it back to the cloud-based Darktrace instance. AWS customers additionally have the option of deploying a ‘Darktrace Security Module’ to monitor IaaS management and data events at the API level, such as logins, editing virtual servers, or creating new access credentials.

Figure 1: A cloud-only deployment scenario — Darktrace manages a master cloud probe which receives traffic from sensors and connectors in IaaS and/or SaaS environments.

For hybrid IaaS deployments, Darktrace will similarly deploy vSensors, and OS-Sensors as appropriate. Cloud traffic and event data from AWS and any other cloud environments is then fed to a Darktrace probe in the cloud or on-premise network. For the latter scenario, Darktrace will deploy a physical appliance that ingests real-time network traffic via a SPAN port or network tap, allowing it to correlate patterns across the entire digital ecosystem.

Figure 2: A hybrid cloud deployment scenario, with multi-cloud infrastructure across AWS, Azure and GCP

For hybrid SaaS deployments, Darktrace will deploy provider-specific Darktrace Security Modules on either a physical or cloud-based Darktrace probe, in addition to any other relevant vSensors and OS-Sensors in place. SaaS data is then analyzed and correlated with traffic and user behaviors across AWS, other cloud environments, and any on- and off- premise cyber-physical infrastructure.

*Figure 3: A hybrid SaaS deployment scenario*

Defense against the full range of threats in the cloud

With the deep insight and powerful reaction capabilities of Cyber AI, Darktrace DETECT & RESPOND are the only proven technologies to stop the full range of cyber-threats in the cloud, including:

Critical misconfigurations
Insider threat
Compromised credentials
Novel and advanced malware
Password brute-force attacks
Data exfiltration
Lateral movement
Man-in-the-middle attacks
Crypto-jacking
Violations of policy

Case Studies

Crypto mining malware inadvertently installed

Darktrace detected a mistake from a junior DevOps engineer in a multinational organization with workloads across AWS and Azure and leveraging containerized systems like Docker and Kubernetes. The engineer accidentally downloaded an update that included a crypto miner, which led to an infection across multiple cloud production systems.

After the initial infection, the malware started beaconing out to an external command and control server, which was immediately picked up by Darktrace. With the external connection established and the attack mission instructions delivered, the crypto malware infection was then able to rapidly spread across the organization’s expansive cloud infrastructure at machine speed, infecting 20 cloud servers in under 15 seconds.

Extensive visibility into the organization’s AWS environment via VPC traffic mirroring was a key factor allowing Darktrace Cyber AI to identify the scale of the attack. With the dynamic and unified view across the company’s sprawling hybrid and multi-cloud infrastructure provided by Darktrace, the company’s security team was able to contain the attack within minutes, rather than hours or days. Even though the attack moved at machine speed, by leveraging solutions like VPC traffic mirroring to continuously analyze behavior in the cloud, Darktrace caught the threat at an early enough stage – well before the costs could start to mount.

Developer misuse of AWS cloud infrastructure

At an insurance group, a DevOps Engineer was attempting to build a parallel back-up infrastructure within AWS to replicate the organization’s data center production systems. The technical implementation was perfect, and the back-up systems were created – however, the cost of running the system would have been several million dollars per year.

The DevOps Engineer was unaware of the costs associated with the project and kept management in the dark. The cloud infrastructure was launched, and the costs started rising. Yet with real-time access to the company’s AWS environment provided by VPC traffic mirroring, Darktrace’s Cyber AI was immediately alerted to this unusual behavior, allowing the security team to take preventative action immediately.

With Darktrace Cyber AI, embrace the benefits of AWS

As organizations increasingly turn to the cloud and the threat surface continues to expand, security teams need self-learning AI on their side to gain the strongest insights, illuminate every blind spot, and stop all attacks.

By providing an enterprise-wide Cyber AI platform, Darktrace helps teams overcome the traditional security challenge of manually piecing together incidents across disparate corners of an organization. The unified visibility and control offered by Darktrace PREVENT, DETECT, RESPOND, & HEAL reduces the complexity and dashboard fatigue that many teams continue to struggle with, while the system’s multi-dimensional insight enhances its decision-making and threat confidence. Darktrace further augments this process with the Immune System’s AI Analyst capability, which takes the additional step of automatically investigating threats detected by Darktrace and producing concise, AI-generated reports that communicate the full scope of an incident.

With the granular, real-time visibility of VPC traffic mirroring Darktrace, you can be certain your AWS cloud environments are always protected.

Written by

Andrew Tsonchev

VP, Security & AI Strategy, Field CISO

Inside the SOC

Written by

Andrew Tsonchev

VP, Security & AI Strategy, Field CISO

•

June 11, 2025

Nicole Wong

Cyber Security Analyst

Compliance

•

June 5, 2025

The Darktrace Community

Watch the NIS2 Webinar

Blog

OT

June 11, 2025

Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi

Understanding supply chain risk in manufacturing

For industries running Industrial Control Systems (ICS) such as manufacturing and fast-moving consumer goods (FMCG), complex supply chains mean that disruption to one weak node can have serious impacts to the entire ecosystem. However, supply chain risk does not always originate from outside an organization’s ICS network.

The implicit trust placed on software or shared services for maintenance within an ICS can be considered a type of insider threat [1], where defenders also need to look ‘from within’ to protect against supply chain risk. Attackers have frequently mobilised this form of insider threat:

Many ICS and SCADA systems were compromised during the 2014 Havex Watering Hole attack, where via operators’ implicit trust in the trojanized versions of legitimate applications, on legitimate but compromised websites [2]. ‍
In 2018, the world’s largest manufacturer of semiconductors and processers shut down production for three days after a supplier installed tainted software that spread to over 10,000 machines in the manufacturer’s network [3].
During the 2020 SolarWinds supply chain attack, attackers compromised a version of Orion software that was deployed from SolarWinds’ own servers during a software update to thousands of customers, including tech manufacturing companies such as Intel and Nvidia [4].

Traditional approaches to ICS security have focused on defending against everything from outside the castle walls, or outside of the ICS network. As ICS attacks become more sophisticated, defenders must not solely rely on static perimeter defenses and prevention.

A critical part of active defense is understanding the ICS environment and how it operates, including all possible attack paths to the ICS including network connections, remote access points, the movement of data across zones and conduits and access from mobile devices. For instance, original equipment manufacturers (OEMs) and vendors often install remote access software or third-party equipment in ICS networks to facilitate legitimate maintenance and support activities, which can unintentionally expand the ICS’ attack surface.

This blog describes an example of the convergence between supply chain risk and insider risk, when a vendor left a Raspberry Pi device in a manufacturing customer’s ICS network without the customer’s knowledge.

Case study: Using unsupervised machine learning to detect pre-existing security issues

Raspberry Pi devices are commonly used in SCADA environments as low-cost, remotely accessible data collectors [5][6][7]. They are often paired with Industrial Internet of Things (IIoT) for monitoring and tracking [8]. However, these devices also represent a security risk because their small physical size and time-consuming nature of physical inspection makes them easy to overlook. This poses a security risk, as these devices have previously been used to carry out USB-based attacks or to emulate Ethernet-over-USB connections to exfiltrate sensitive data [8][9].

In this incident, a Darktrace customer was unaware that their supplier had installed a Raspberry Pi device on their ICS network. Crucially, the installation occurred prior to Darktrace’s deployment on the customer’s network.

For other anomaly detection tools, this order of events meant that this third-party device would likely have been treated as part of the customer’s existing infrastructure. However, after Darktrace was deployed, it analyzed the metadata from the encrypted HTTPS and DNS connections that the Raspberry Pi made to ‘call home’ to the supplier and determined that these connections were unusual compared to the rest of the devices in the network, even in the absence of any malicious indicators of compromise (IoCs).

Darktrace triggered the following alerts for this unusual activity that consequently notified the customer to the pre-existing threat of an unmanaged device already present in their network:

Compromise / Sustained SSL or HTTP Increase
Compromise / Agent Beacon (Short Period)
Compromise / Agent Beacon (Medium Period)
Compromise / Agent Beacon (Long Period)
Tags / New Raspberry Pi Device
Device / DNS Requests to Unusual Server
Device / Anomaly Indicators / Spike in Connections to Rare Endpoint Indicator

‍*Figure 1: Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.*

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the activity, correlating related events into a broader incident and generating a report outlining the potential threat along with supporting technical details.

Darktrace’s anomaly-based detection meant that the Raspberry Pi device did not need to be observed performing clearly malicious behavior to alert the customer to the security risk, and neither can defenders afford to wait for such escalation.

Why is this significant?

In 2021 a similar attack took place. Aiming to poison a Florida water treatment facility, attackers leveraged a TeamViewer instance that had been dormant on the system for six months, effectively allowing the attacker to ‘live off the land’ [10].

The Raspberry Pi device in this incident also remained outside the purview of the customer’s security team at first. It could have been leveraged by a persistent attacker to pivot within the internal network and communicate externally.

A proactive approach to active defense that seeks to minimize and continuously monitor the attack surface and network is crucial.

The growing interest in manufacturing from attackers and policymakers

Significant motivations for targeting the manufacturing sector and increasing regulatory demands make the convergence of supply chain risk, insider risk, and the prevalence of stealthy living-off-the-land techniques particularly relevant to this sector.

Manufacturing is consistently targeted by cybercriminals [11], and the sector’s ‘just-in-time’ model grants attackers the opportunity for high levels of disruption. Furthermore, under NIS 2, manufacturing and some food and beverage processing entities are now designated as ‘important’ entities. This means stricter incident reporting requirements within 24 hours of detection, and enhanced security requirements such as the implementation of zero trust and network segmentation policies, as well as measures to improve supply chain resilience [12][13][14].

How can Darktrace help?

Ultimately, Darktrace successfully assisted a manufacturing organization in detecting a potentially disruptive 'near-miss' within their OT environment, even in the absence of traditional IoCs. Through passive asset identification techniques and continuous network monitoring, the customer improved their understanding of their network and supply chain risk.

While the swift detection of the rogue device allowed the threat to be identified before it could escalate, the customer could have reduced their time to respond by using Darktrace’s built-in response capabilities, had Darktrace’s Autonomous Response capability been enabled. Darktrace’s Autonomous Response can be configured to target specific connections on a rogue device either automatically upon detection or following manual approval from the security team, to stop it communicating with other devices in the network while allowing other approved devices to continue operating. Furthermore, the exportable report generated by Cyber AI Analyst helps security teams to meet NIS 2’s enhanced reporting requirements.

Sophisticated ICS attacks often leverage insider access to perform in-depth reconnaissance for the development of tailored malware capabilities. This case study and high-profile ICS attacks highlight the importance of mitigating supply chain risk in a similar way to insider risk. As ICS networks adapt to the introduction of IIoT, remote working and the increased convergence between IT and OT, it is important to ensure the approach to secure against these threats is compatible with the dynamic nature of the network.

Credit to Nicole Wong (Principal Cyber Analyst), Matthew Redrup (Senior Analyst and ANZ Team Lead)

[related-resource]

Appendices

MITRE ATT&CK Mapping

Infrastructure / New Raspberry Pi Device - INITIAL ACCESS - T1200 Hardware Additions
Device / DNS Requests to Unusual Server - CREDENTIAL ACCESS, COLLECTION - T1557 Man-in-the-Middle
Compromise / Agent Beacon - COMMAND AND CONTROL - T1071.001 Web Protocols

References

[1] https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats

[2] https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/web-attack/139/havex-targets-industrial-control-systems

[3]https://thehackernews.com/2018/08/tsmc-wannacry-ransomware-attack.html

[4] https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack

[5] https://www.centreon.com/monitoring-ot-with-raspberry-pi-and-centreon/

[6] https://ieeexplore.ieee.org/document/9107689

[7] https://www.linkedin.com/pulse/webicc-scada-integration-industrial-raspberry-pi-devices-mryff

[8] https://www.rowse.co.uk/blog/post/how-is-the-raspberry-pi-used-in-the-iiot

[9] https://sepiocyber.com/resources/whitepapers/raspberry-pi-a-friend-or-foe/#:~:text=Initially%20designed%20for%20ethical%20purposes,as%20cyberattacks%20and%20unauthorized%20access

[10] https://edition.cnn.com/2021/02/10/us/florida-water-poison-cyber/index.html

[11] https://www.mxdusa.org/2025/02/13/top-cyber-threats-in-manufacturing/

[12] https://www.shoosmiths.com/insights/articles/nis2-what-manufacturers-and-distributors-need-to-know-about-europes-new-cybersecurity-regime

[13] https://www.goodaccess.com/blog/nis2-require-zero-trust-essential-security-measure#zero-trust-nis2-compliance

[14] https://logisticsviewpoints.com/2024/11/06/the-impact-of-nis-2-regulations-on-manufacturing-supply-chains/

About the author

Nicole Wong

Cyber Security Analyst

Blog

Compliance

June 9, 2025

Modernising UK Cyber Regulation: Implications of the Cyber Security and Resilience Bill

Two individuals sitting at a desk working on a document

The need for security and continued cyber resilience

The UK government has made national security a key priority, and the new Cyber Security and Resilience Bill (CSRB) is a direct reflection of that focus. In introducing the Bill, Secretary of State for Science, Innovation and Technology, Peter Kyle, recognised that the UK is “desperately exposed” to cyber threats—from criminal groups to hostile nation-states that are increasingly targeting the UK's digital systems and critical infrastructure^[1].

Context and timeline for the new legislation

First announced during the King’s Speech of July 2024, and elaborated in a Department for Science, Innovation and Technology (DSIT) policy statement published in April 2025, the CSRB is expected to be introduced in Parliament during the 2025-26 legislative session.

For now, organisations in the UK remain subject to the 2018 Network and Information Systems (NIS) Regulations – an EU-derived law which was drafted before today’s increasing digitisation of critical services, rise in cloud adoption and emergence of AI-powered threats.

Why modernisation is critical

Without modernisation, the Government believes UK’s infrastructure and economy risks falling behind international peers. The EU, which revised its cybersecurity regulation under the NIS2 Directive, already imposes stricter requirements on a broader set of sectors.

The urgency of the Bill is also underscored by recent high-impact incidents, including the Synnovis attack which targeted the National Health Service (NHS) suppliers and disrupted thousands of patient appointments and procedures^[2]. The Government has argued that such events highlight a systemic failure to keep pace with a rapidly evolving threat landscape^[3].

What the Bill aims to achieve

This Bill represents a decisive shift. According to the Government, it will modernise and future‑proof the UK’s cyber laws, extending oversight to areas where risk has grown but regulation has not kept pace^[4]. While the legislation builds on previous consultations and draws lessons from international frameworks like the EU’s NIS2 directive, it also aims to tailor solutions to the UK’s unique threat environment.

Importantly, the Government is framing cybersecurity not as a barrier to growth, but as a foundation for it. The policy statement emphasises that strong digital resilience will create the stability businesses need to thrive, innovate, and invest^[5]. Therefore, the goals of the Bill will not only be to enhance security but also act as an enabler to innovation and economic growth.

Recognition that AI changes cyber threats

The CSRB policy statement recognises that AI is fundamentally reshaping the threat landscape, with adversaries now leveraging AI and commercial cyber tools to exploit vulnerabilities in critical infrastructure and supply chains. Indeed, the NCSC has recently assessed that AI will almost certainly lead to “an increase in the frequency and intensity of cyber threats”^[6]. Accordingly, the policy statement insists that the UK’s regulatory framework “must keep pace and provide flexibility to respond to future threats as and when they emerge”^[7].

To address the threat, the Bill signals new obligations for MSPs and data centres, timely incident reporting and dynamic guidance that can be refreshed without fresh primary legislation, making it essential for firms to follow best practices.

What might change in day-to-day practice?

New organisations in scope of regulation

Under the existing Network and Information Systems (NIS) Regulations^[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant Digital Service Providers, RDSPs).

The Cyber Security and Resilience Bill retains this foundation and adds Managed Service Providers (MSPs) and data centres to the scope of regulation to “better recognise the increasing reliance on digital services and the vulnerabilities posed by supply chains”^[9]. It also grants the Secretary of State for Science, Innovation and Technology the power to add new sectors or sub‑sectors via secondary legislation, following consultation with Parliament and industry.

Managed service providers (MSPs)

MSPs occupy a central position within the UK’s enterprise information‑technology infrastructure. Because they remotely run or monitor clients’ systems, networks and data, they hold privileged, often continuous access to multiple environments. This foothold makes them an attractive target for malicious actors.

The Bill aims to bring MSPs in scope of regulation by making them subject to the same duties as those placed on firms that provide digital services under the 2018 NIS Regulations. By doing so, the Bill seeks to raise baseline security across thousands of customer environments and to provide regulators with better visibility of supply‑chain risk.

The proposed definition for MSPs is a service which:

Is provided to another organisation
Relies on the use of network and information systems to deliver the service
Relates to ongoing management support, active administration and/or monitoring of AI systems, IT infrastructure, applications, and/or IT networks, including for the purpose of activities relating to cyber security.
Involves a network connection and/or access to the customer’s network and information systems.

Data centres

Building on the September 2024 designation of data centres as critical national infrastructure, the CSRB will fold data infrastructure into the NIS-style regime by naming it an “relevant sector" and data centres as “essential service”^[10].

About 182 colocation facilities run by 64 operators will therefore come under statutory duties to notify the regulator, maintain proportionate CAF-aligned controls and report significant incidents, regardless of who owns them or what workloads they host.

New requirements for regulated organisations

Incident reporting processes

There could be stricter timelines or broader definitions of what counts as a reportable incident. This might nudge organisations to formalise detection, triage, and escalation procedures.

The Government is proposing to introduce a new two-stage incident reporting process. This would include an initial notification which would be submitted within 24 hours of becoming aware of a significant incident, followed by a full incident report which should be submitted within 72 hours of the same.

Supply chain assurance requirements

Supply chains for the UK's most critical services are becoming increasingly complex and present new and serious vulnerabilities for cyber-attacks. The recent Synnovis ransomware attacks on the NHS^[11] exemplify the danger posed by attacks against the supply chains of important services and organisations. This is concerning when reflecting on the latest Cyber Security Breaches survey conducted by DSIT, which highlights that fewer than 25% of large businesses review their supply chain risks^[12].

Despite these risks, the UK’s legacy cybersecurity regulatory regime does not explicitly cover supply chain risk management. The UK instead relies on supporting and non-statutory guidance to close this gap, such as the NCSC’s Cyber Assessment Framework (CAF)^[13].

The CSRB policy statement acts on this regulatory shortcoming and recognises that “a single supplier’s disruption can have far-reaching impacts on the delivery of essential or digital services”^[14].

To address this, the Bill would make in-scope organisations (OES and RDPS) directly accountable for the cybersecurity of their supply chains. Secondary legislation would spell out these duties in detail, ensuring that OES and RDSPs systematically assess and mitigate third-party cyber risks.

Updated and strengthened security requirements

By placing the CAF into a firmer footing and backing it with a statutory Code of Practice, the Government is setting clearer expectations about government expectations on technical standards and methods organisations will need to follow to prove their resilience.

How Darktrace can help support affected organizations

Demonstrate resilience

Darktrace’s Self-Learning AI^TM continuously monitors your digital estate across cloud, network, OT, email, and endpoint to detect, investigate, and autonomously respond to emerging threats in real time. This persistent visibility and defense posture helps organizations demonstrate cyber resilience to regulators with confidence.

Streamline incident reporting and compliance

Darktrace surfaces clear alerts and automated investigation reports, complete with timeline views and root cause analysis. These insights reduce the time and complexity of regulatory incident reporting and support internal compliance workflows with auditable, AI-generated evidence.

Improve supply chain visibility

With full visibility across connected systems and third-party activity, Darktrace detects early indicators of lateral movement, account compromise, and unusual behavior stemming from vendor or partner access, reducing the risk of supply chain-originated cyber-attacks.

Ensure MSPs can meet new standards

For managed service providers, Darktrace offers native multi-tenant support and autonomous threat response that can be embedded directly into customer environments. This ensures consistent, scalable security standards across clients—helping MSPs address increasing regulatory obligations.

[related-resource]