Blog
/
Cloud
/
October 3, 2024

Introducing Real-Time Multi-Cloud Detection & Response Powered by AI

This blog announces the general availability of Microsoft Azure support for Darktrace / CLOUD, enabling real-time cloud detection and response across dynamic multi-cloud environments. Read more to discover how Darktrace is pioneering AI-led real-time cloud detection and response.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Stevens
Director of Product, Cloud Security
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
03
Oct 2024

We are delighted to announce the general availability of Microsoft Azure support for Darktrace / CLOUD, enabling real-time cloud detection and response across dynamic multi-cloud environments. Built on Self-Learning AI, Darktrace / CLOUD leverages Microsoft’s new virtual network flow logs (VNet flow) to offer an agentless-first approach that dramatically simplifies detection and response within Azure, unifying cloud-native security with Darktrace’s innovative ActiveAI Security Platform.

As organizations increasingly adopt multi-cloud architectures, the need for advanced, real-time threat detection and response is critical to keep pace with evolving cloud threats. Security teams face significant challenges, including increased complexity, limited visibility, and siloed tools. The dynamic nature of multi-cloud environments introduces ever-changing blind spots, while traditional security tools struggle to provide real-time insights, often offering static snapshots of risk. Additionally, cloud security teams frequently operate in isolation from SOC teams, leading to fragmented visibility and delayed responses. This lack of coordination, especially in hybrid environments, hinders effective threat detection and response. Compounding these challenges, current security solutions are split between agent-based and agentless approaches, with agentless solutions often lacking real-time awareness and agent-based options adding complexity and scalability concerns. Darktrace / CLOUD helps to solve these challenges with real-time detection and response designed specifically for dynamic cloud environments like Azure and AWS.

Pioneering AI-led real-time cloud detection & response

Darktrace has been at the forefront of real-time detection and response for over a decade, continually pushing the boundaries of AI-driven cybersecurity. Our Self-Learning AI uniquely positions Darktrace with the ability to automatically understand and instantly adapt to changing cloud environments. This is critical in today’s landscape, where cloud infrastructures are highly dynamic and ever-changing.  

Built on years of market-leading network visibility, Darktrace / CLOUD understands ‘normal’ for your unique business across clouds and networks to instantly reveal known, unknown, and novel cloud threats with confidence. Darktrace Self-Learning AI continuously monitors activity across cloud assets, containers, and users, and correlates it with detailed identity and network context to rapidly detect malicious activity. Platform-native identity and network monitoring capabilities allow Darktrace / CLOUD to deeply understand normal patterns of life for every user and device, enabling instant, precise and proportionate response to abnormal behavior - without business disruption.

Leveraging platform-native Autonomous Response, AI-driven behavioral containment neutralizes malicious activity with surgical accuracy while preventing disruption to cloud infrastructure or services. As malicious behavior escalates, Darktrace correlates thousands of data points to identify and instantly respond to unusual activity by blocking specific connections and enforcing normal behavior.

Figure 1: AI-driven behavioral containment neutralizes malicious activity with surgical accuracy while preventing disruption to cloud infrastructure or services.

Unparalleled agentless visibility into Azure

As a long-term trusted partner of Microsoft, Darktrace leverages Azure VNet flow logs to provide agentless, high-fidelity visibility into cloud environments, ensuring comprehensive monitoring without disrupting workflows. By integrating seamlessly with Azure, Darktrace / CLOUD continues to push the envelope of innovation in cloud security. Our Self-learning AI not only improves the detection of traditional and novel threats, but also enhances real-time response capabilities and demonstrates our commitment to delivering cutting-edge, AI-powered multi-cloud security solutions.

  • Integration with Microsoft Virtual network flow logs for enhanced visibility
    Darktrace / CLOUD integrates seamlessly with Azure to provide agentless, high-fidelity visibility into cloud environments. VNet flow logs capture critical network traffic data, allowing Darktrace to monitor Azure workloads in real time without disrupting existing workflows. This integration significantly reduces deployment time by 95%1 and cloud security operational costs by up to 80%2 compared to traditional agent-based solutions. Organizations benefit from enhanced visibility across dynamic cloud infrastructures, scaling security measures effortlessly while minimizing blind spots, particularly in ephemeral resources or serverless functions.
  • High-fidelity agentless deployment
    Agentless deployment allows security teams to monitor and secure cloud environments without installing software agents on individual workloads. By using cloud-native APIs like AWS VPC flow logs or Azure VNet flow logs, security teams can quickly deploy and scale security measures across dynamic, multi-cloud environments without the complexity and performance overhead of agents. This approach delivers real-time insights, improving incident detection and response while reducing disruptions. For organizations, agentless visibility simplifies cloud security management, lowers operational costs, and minimizes blind spots, especially in ephemeral resources or serverless functions.
  • Real-time visibility into cloud assets and architectures
    With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures. This shared context enhances collaboration and accelerates threat detection and response, especially in complex environments like Kubernetes. Additionally, Cyber AI Analyst automates the investigation process, correlating data across networks, identities, and cloud assets to save security teams valuable time, ensuring continuous protection and efficient cloud migrations.
Figure 2: Real-time visibility into Azure assets and architectures built from network, configuration and identity and access roles.

Unified multi-cloud security at scale

As organizations increasingly adopt multi-cloud strategies, the complexity of managing security across different cloud providers introduces gaps in visibility. Darktrace / CLOUD simplifies this by offering agentless, real-time monitoring across multi-cloud environments. Building on our innovative approach to securing AWS environments, our customers can now take full advantage of robust real-time detection and response capabilities for Azure. Darktrace is one of the first vendors to leverage Microsoft’s virtual network flow logs to provide agentless deployment in Azure, enabling unparalleled visibility without the need for installing agents. In addition, Darktrace / CLOUD offers automated Cloud Security Posture Management (CSPM) that continuously assesses cloud configurations against industry standards.  Security teams can identify and prioritize misconfigurations, vulnerabilities, and policy violations in real-time. These capabilities give security teams a complete, live understanding of their cloud environments and help them focus their limited time and resources where they are needed most.

This approach offers seamless integration into existing workflows, reducing configuration efforts and enabling fast, flexible deployment across cloud environments. By extending its capabilities across multiple clouds, Darktrace / CLOUD ensures that no blind spots are left uncovered, providing holistic, multi-cloud security that scales effortlessly with your cloud infrastructure. diagrams, visualizes cloud assets, and prioritizes risks across cloud environments.

Figure 3: Unified view of AWS and Azure cloud posture and compliance over time.

The future of cloud security: Real-time defense in an unpredictable world

Darktrace / CLOUD’s support for Microsoft Azure, powered by Self-Learning AI and agentless deployment, sets a new standard in multi-cloud security. With real-time detection and autonomous response, organizations can confidently secure their Azure environments, leveraging innovation to stay ahead of the constantly evolving threat landscape. By combining Azure VNet flow logs with Darktrace’s AI-driven platform, we can provide customers with a unified, intelligent solution that transforms how security is managed across the cloud.

Unlock advanced cloud protection

Darktrace / CLOUD solution brief screenshot

Download the Darktrace / CLOUD solution brief to discover how autonomous, AI-driven defense can secure your environment in real-time.

  • Achieve 60% more accurate detection of unknown and novel cloud threats.
  • Respond instantly with autonomous threat response, cutting response time by 90%.
  • Streamline investigations with automated analysis, improving ROI by 85%.
  • Gain a 30% boost in cloud asset visibility with real-time architecture modeling.
  • Learn More:

    References

    1. Based on internal research and customer data

    2. Based on internal research

    Inside the SOC
    Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
    Written by
    Adam Stevens
    Director of Product, Cloud Security

    More in this series

    No items found.

    Blog

    /

    Email

    /

    July 21, 2025

    Global Telecom Provider: Powering and Protecting the World's Data Giants

    Default blog imageDefault blog image

    This global leader plays a critical role in keeping the world connected. The company works with some of the largest and most influential public and private organizations in the world to enable ultra-fast data transmission.

    Safeguarding the systems that keep the world connected

    Standing at the forefront of global connectivity, this industry leader designs and manages large-scale communications systems that power the world’s most data-intensive enterprises – including social media giants, hyperscale cloud providers, and major data center operators. Given the scale, confidentiality, and sensitivity of the systems and data it helps transport, the company faces complex cybersecurity challenges.

    Protecting sensitive customer data

    Most of the organization’s projects are custom-designed and highly proprietary, making data privacy and Intellectual Property (IP) protection critical to maintaining trust and confidentiality with customers. In an industry where every competitor knows the landscape intimately, any loss of data could cause significant damage.

    International security implications

    The company faces a broad range of advanced cyber threats – from corporate espionage and supply chain risks to cyber-physical attacks on critical infrastructure. Its international footprint adds complexity, including cross-border regulatory compliance. A successful attack could disrupt business, compromise IP, or trigger wider consequences like disruptions to international data transfers and other critical services.

    The global leader works closely with communities to anticipate threats that could impact the global communications network at large.

    In this environment, cybersecurity is a foundation for international trust,” said the organization’s CISO.

    Building a resilient cybersecurity strategy from the ground up

    The CISO had the rare opportunity to build the IT and cybersecurity infrastructure from scratch. "Initially, we bought what everyone else buys,” referencing the traditional mix of firewalls, routers, and antivirus tools. “But I knew we needed to do more.”

    Self-Learning AI – “the missing piece”

    With solid perimeter defenses in place, the security team sought deeper protection inside the network. Darktrace’s Self-Learning AI stood out. “Unlike other solutions, Darktrace’s AI looks beyond known threat signatures, learning what’s normal for our environment and flagging what’s not. That was the missing piece – something that could help us even when everything else failed.”

    A solution and partnership that delivered

    The CISO said he appreciated the ability to observe Darktrace in action before full deployment, noting that the Darktrace team was there every step of the way, providing guidance and expertise to ensure he got the most out of his investment.

    Partnership was especially valuable given the company’s explosive 400% growth over the last six years. As resources were stretched and priorities shifted, “Darktrace remained patient and responsive. We’re slow and methodical, but the Darktrace support team was phenomenal, never losing momentum and earning our trust.”

    A unified cybersecurity ecosystem

    Today, the global leader is using the Darktrace ActiveAI Security Platform™ as a core part of its layered defense strategy, including:

    The CISO appreciates how, as a unified cybersecurity platform, Darktrace has an intuitive user interface, which makes it easier for his team to investigate alerts visually, even without deep technical expertise.

    Advancing defenses while impacting the bottom line

    A 24/7 “safety net”

    The fact that this company has never been hacked is the clearest proof it made the right decision with Darktrace, said the CISO. Initially rolled out in Human Confirmation Mode, meaning it would not take autonomous action without explicit approval from the security team, Darktrace immediately uncovered threats and anomalies that other tools had missed.

    Darktrace acts as a must-have safety net—ready to step in when other tools fall short,” said the CISO.

    From monitoring internal behavior and identifying unusual attack patterns, to autonomously neutralizing threats after hours, the platform provides peace of mind in a high-stakes industry. “Darktrace is my dark horse – the thing I have in my back pocket if everything else fails. It’s here to save the day, save my company, and maybe even save my career.”

    Autonomous capabilities free up time for skilled analysts

    Darktrace’s AI-powered detection and response capabilities are deeply embedded in the team’s day-to-day operations, autonomously investigating and responding to the majority of potential threats. Cyber AI Analyst conducted a total of 2,776 total investigations within three months, averaging just 12 minutes to autonomously investigate an incident. Of those 2,776 investigations, Darktrace resolved 2,671 (96%) autonomously and escalated only 105 (4%) to analysts. Darktrace has dramatically reduced alert fatigue and freed up analysts to focus on what really matters, saving the security team 486 analyst hours on investigations within a 20-day period.

    From noise to actionable insight

    Darktrace delivers meaningful data and meaningful alerts. “If Darktrace escalates an incident, we drop everything and work on that. We trust in Darktrace.” When analysts do need to investigate an incident, Darktrace’s forensic logs and guided remediation suggestions have slashed the time analysts spend on investigations by four to five times.

    Stronger security. Lower cost.

    The CISO says, “Darktrace is a money-saver for our organization, making continued investments an easy sell to the CEO and the board.”  When he found himself down a resource after a member of the security team left the organization, the CISO turned to Darktrace Managed Threat Detection and Response services for 24/7 expert support. “It was a no brainer. We got better coverage, higher skill levels, and around-the-clock support – all for less than what we would pay to employ a single analyst.”

    Scaling securely into the future

    Securing networks in motion  

    The organization is preparing to scale both its operations and security posture across existing distributed, mobile and deployable communications networks that historically have been disconnected. Some of these networks are in constant motion and operating in some of the world’s most volatile regions. “Darktrace will act as an autonomous defender, monitoring for anomalous behavior and intervening, when necessary, especially during those dangerous times when an asset ‘goes dark’ and becomes disconnected from the broader network,” said the CISO.

    Applying AI strategically

    As the organization continues to evaluate where and how to apply AI, its emphasis will be on technologies that can act independently to contain threats – especially in environments where human response may be delayed. “It’s about using the right kind of AI for the right challenge. That’s why we’re investing in Darktrace, with tools that can adapt and learn even in isolation and provide real-time protection wherever we operate.”

    Continue reading
    About the author
    The Darktrace Community

    Blog

    /

    AI

    /

    July 17, 2025

    Introducing the AI Maturity Model for Cybersecurity

    AI maturity model for cybersecurityDefault blog imageDefault blog image

    AI adoption in cybersecurity: Beyond the hype

    Security operations today face a paradox. On one hand, artificial intelligence (AI) promises sweeping transformation from automating routine tasks to augmenting threat detection and response. On the other hand, security leaders are under immense pressure to separate meaningful innovation from vendor hype.

    To help CISOs and security teams navigate this landscape, we’ve developed the most in-depth and actionable AI Maturity Model in the industry. Built in collaboration with AI and cybersecurity experts, this framework provides a structured path to understanding, measuring, and advancing AI adoption across the security lifecycle.

    Overview of AI maturity levels in cybersecurity

    Why a maturity model? And why now?

    In our conversations and research with security leaders, a recurring theme has emerged:

    There’s no shortage of AI solutions, but there is a shortage of clarity and understanding of AI uses cases.

    In fact, Gartner estimates that “by 2027, over 40% of Agentic AI projects will be canceled due to escalating costs, unclear business value, or inadequate risk controls. Teams are experimenting, but many aren’t seeing meaningful outcomes. The need for a standardized way to evaluate progress and make informed investments has never been greater.

    That’s why we created the AI Security Maturity Model, a strategic framework that:

    • Defines five clear levels of AI maturity, from manual processes (L0) to full AI Delegation (L4)
    • Delineating the outcomes derived between Agentic GenAI and Specialized AI Agent Systems
    • Applies across core functions such as risk management, threat detection, alert triage, and incident response
    • Links AI maturity to real-world outcomes like reduced risk, improved efficiency, and scalable operations

    [related-resource]

    How is maturity assessed in this model?

    The AI Maturity Model for Cybersecurity is grounded in operational insights from nearly 10,000 global deployments of Darktrace's Self-Learning AI and Cyber AI Analyst. Rather than relying on abstract theory or vendor benchmarks, the model reflects what security teams are actually doing, where AI is being adopted, how it's being used, and what outcomes it’s delivering.

    This real-world foundation allows the model to offer a practical, experience-based view of AI maturity. It helps teams assess their current state and identify realistic next steps based on how organizations like theirs are evolving.

    Why Darktrace?

    AI has been central to Darktrace’s mission since its inception in 2013, not just as a feature, but the foundation. With over a decade of experience building and deploying AI in real-world security environments, we’ve learned where it works, where it doesn’t, and how to get the most value from it. This model reflects that insight, helping security leaders find the right path forward for their people, processes, and tools

    Security teams today are asking big, important questions:

    • What should we actually use AI for?
    • How are other teams using it — and what’s working?
    • What are vendors offering, and what’s just hype?
    • Will AI ever replace people in the SOC?

    These questions are valid, and they’re not always easy to answer. That’s why we created this model: to help security leaders move past buzzwords and build a clear, realistic plan for applying AI across the SOC.

    The structure: From experimentation to autonomy

    The model outlines five levels of maturity :

    L0 – Manual Operations: Processes are mostly manual with limited automation of some tasks.

    L1 – Automation Rules: Manually maintained or externally-sourced automation rules and logic are used wherever possible.

    L2 – AI Assistance: AI assists research but is not trusted to make good decisions. This includes GenAI agents requiring manual oversight for errors.

    L3 – AI Collaboration: Specialized cybersecurity AI agent systems  with business technology context are trusted with specific tasks and decisions. GenAI has limited uses where errors are acceptable.

    L4 – AI Delegation: Specialized AI agent systems with far wider business operations and impact context perform most cybersecurity tasks and decisions independently, with only high-level oversight needed.

    Each level reflects a shift, not only in technology, but in people and processes. As AI matures, analysts evolve from executors to strategic overseers.

    Strategic benefits for security leaders

    The maturity model isn’t just about technology adoption it’s about aligning AI investments with measurable operational outcomes. Here’s what it enables:

    SOC fatigue is real, and AI can help

    Most teams still struggle with alert volume, investigation delays, and reactive processes. AI adoption is inconsistent and often siloed. When integrated well, AI can make a meaningful difference in making security teams more effective

    GenAI is error prone, requiring strong human oversight

    While there is a lot of hype around GenAI agentic systems, teams will need to account for inaccuracy and hallucination in Agentic GenAI systems.

    AI’s real value lies in progression

    The biggest gains don’t come from isolated use cases, but from integrating AI across the lifecycle, from preparation through detection to containment and recovery.

    Trust and oversight are key initially but evolves in later levels

    Early-stage adoption keeps humans fully in control. By L3 and L4, AI systems act independently within defined bounds, freeing humans for strategic oversight.

    People’s roles shift meaningfully

    As AI matures, analyst roles consolidate and elevate from labor intensive task execution to high-value decision-making, focusing on critical, high business impact activities, improving processes and AI governance.

    Outcome, not hype, defines maturity

    AI maturity isn’t about tech presence, it’s about measurable impact on risk reduction, response time, and operational resilience.

    [related-resource]

    Outcomes across the AI Security Maturity Model

    The Security Organization experiences an evolution of cybersecurity outcomes as teams progress from manual operations to AI delegation. Each level represents a step-change in efficiency, accuracy, and strategic value.

    L0 – Manual Operations

    At this stage, analysts manually handle triage, investigation, patching, and reporting manually using basic, non-automated tools. The result is reactive, labor-intensive operations where most alerts go uninvestigated and risk management remains inconsistent.

    L1 – Automation Rules

    At this stage, analysts manage rule-based automation tools like SOAR and XDR, which offer some efficiency gains but still require constant tuning. Operations remain constrained by human bandwidth and predefined workflows.

    L2 – AI Assistance

    At this stage, AI assists with research, summarization, and triage, reducing analyst workload but requiring close oversight due to potential errors. Detection improves, but trust in autonomous decision-making remains limited.

    L3 – AI Collaboration

    At this stage, AI performs full investigations and recommends actions, while analysts focus on high-risk decisions and refining detection strategies. Purpose-built agentic AI systems with business context are trusted with specific tasks, improving precision and prioritization.

    L4 – AI Delegation

    At this stage, Specialized AI Agent Systems performs most security tasks independently at machine speed, while human teams provide high-level strategic oversight. This means the highest time and effort commitment activities by the human security team is focused on proactive activities while AI handles routine cybersecurity tasks

    Specialized AI Agent Systems operate with deep business context including impact context to drive fast, effective decisions.

    Join the webinar

    Get a look at the minds shaping this model by joining our upcoming webinar using this link. We’ll walk through real use cases, share lessons learned from the field, and show how security teams are navigating the path to operational AI safely, strategically, and successfully.

    Continue reading
    About the author
    Ashanka Iddya
    Senior Director, Product Marketing
    Your data. Our AI.
    Elevate your network security with Darktrace AI