Blog
/
Compliance
/
February 11, 2025

NIS2 Compliance: Interpreting 'State-of-the-Art' for Organisations

This blog explores key technical factors that define state-of-the-art cybersecurity. Drawing on expertise from our business, academia, and national security standards, outlining five essential criteria.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Livia Fries
Public Policy Manager, EMEA
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
11
Feb 2025

NIS2 Background

17 October 2024 marked the deadline for European Union (EU) Member States to implement the NIS2 Directive into national law. The Directive aims to enhance the EU’s cybersecurity posture by establishing a high common level of cybersecurity for critical infrastructure and services. It builds on its predecessor, the 2018 NIS Directive, by expanding the number of sectors in scope, enforcing greater reporting requirements and encouraging Member States to ensure regulated organisations adopt ‘state-of-the-art' security measures to protect their networks, OT and IT systems.  

Timeline of NIS2
Figure 1: Timeline of NIS2

The challenge of NIS2 & 'state-of-the-art'

Preamble (51) - "Member States should encourage the use of any innovative technology, including artificial intelligence, the use of which could improve the detection and prevention of cyberattacks, enabling resources to be diverted towards cyberattacks more effectively."
Article 21 - calls on Member States to ensure that essential and important entities “take appropriate and proportionate” cyber security measures, and that they do so by “taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation.”

Regulartory expectations and ambiguity of NIS2

While organisations in scope can rely on technical guidance provided by ENISA1 , the EU’s agency for cybersecurity, or individual guidelines provided by Member States or Public-Private Partnerships where they have been published,2 the mention of ‘state-of-the-art' remains up to interpretation in most Member States. The use of the phrase implies that cybersecurity measures must evolve continuously to keep pace with emerging threats and technological advancements without specifying what ‘state-of-the-art’ actually means for a given context and risk.3  

This ambiguity makes it difficult for organisations to determine what constitutes compliance at any given time and could lead to potential inconsistencies in implementation and enforcement. Moreover, the rapid pace of technological change means that what is considered "state-of-the-art" today will become outdated, further complicating compliance efforts.

However, this is not unique to NIS regulation. As EU scholars have noted, while “state-of-the-art" is widely referred to in legal text relating to technology, there is no standardised legal definition of what it actually constitutes.4

Defining state-of-the-art cybersecurity

In this blog, we outline technical considerations for state-of-the-art cybersecurity. We draw from expertise within our own business and in academia as well as guidelines and security standards set by national agencies, such as Germany’s Federal Office for Information Security (BSI) or Spain’s National Security Framework (ENS), to put forward five criteria to define state-of-the-art cybersecurity.

The five core criteria include:

  • Continuous monitoring
  • Incident correlation
  • Detection of anomalous activity
  • Autonomous response
  • Proactive cyber resilience

These principles build on long-standing security considerations, such as business continuity, vulnerability management and basic security hygiene practices.  

Although these considerations are written in the context of the NIS2 Directive, they are likely to also be relevant for other jurisdictions. We hope these criteria help organisations understand how to best meet their responsibilities under the NIS2 Directive and assist Competent Authorities in defining compliance expectations for the organisations they regulate.  

Ultimately, adopting state-of-the-art cyber defences is crucial for ensuring that organisations are equipped with the best tools to combat new and fast-growing threats. Leading technical authorities, such as the UK National Cyber Security Centre (NCSC), recognise that adoption of AI-powered cyber defences will offset the increased volume and impact of AI on cyber threats.5

State of the art cybersecurity in the context of NIS2

1. Continuous monitoring

Continuous monitoring is required to protect an increasingly complex attack surface from attackers.

First, organisations' attack surfaces have expanded following the widespread adoption of hybrid or cloud infrastructures and the increased adoption of connected Internet of Things (IoT) devices.6 This exponential growth creates a complex digital environment for organisations, making it difficult for security teams to track all internet-facing assets and identify potential vulnerabilities.

Second, with the significant increase in the speed and sophistication of cyber-attacks, organisations face a greater need to detect security threats and non-compliance issues in real-time.  

Continuous monitoring, defined by the U.S. National Institute of Standards and Technology (NIST) as the ability to maintain “ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions,”7 has therefore become a cornerstone of an effective cybersecurity strategy. By implementing continuous monitoring, organisations can ensure a real-time understanding of their attack surface and that new external assets are promptly accounted for. For instance, Spain’s technical guidelines for regulation, as set forth by the National Security Framework (Royal Decree 311/2022), highlight the importance of adopting continuous monitoring to detect anomalous activities or behaviours and to ensure timely responses to potential threats (article 10).8  

This can be achieved through the following means:  

All assets that form part of an organisation's estate, both known and unknown, must be identified and continuously monitored for current and emerging risks. Germany’s BSI mandates the continuous monitoring of all protocol and logging data in real-time (requirement #110).9 This should be conducted alongside any regular scans to detect unknown devices or cases of shadow IT, or the use of unauthorised or unmanaged applications and devices within an organisation, which can expose internet-facing assets to unmonitored risks. Continuous monitoring can therefore help identify potential risks and high-impact vulnerabilities within an organisation's digital estate and eliminate potential gaps and blind spots.

Organisations looking to implement more efficient continuous monitoring strategies may turn to automation, but, as the BSI notes, it is important for responsible parties to be immediately warned if an alert is raised (reference 110).10 Following the BSI’s recommendations, the alert must be examined and, if necessary, contained within a short period of time corresponding with the analysis of the risk at hand.

Finally, risk scoring and vulnerability mapping are also essential parts of this process. Continuous monitoring helps identify potential risks and significant vulnerabilities within an organisation's digital assets, fostering a dynamic understanding of risk. By doing so, risk scoring and vulnerability mapping allows organisations to prioritise the risks associated with their most critically exposed assets.

2. Correlation of incidents across your entire environment

Viewing and correlating incident alerts when working with different platforms and tools poses significant challenges to SecOps teams. Security professionals often struggle to cross-reference alerts efficiently, which can lead to potential delays in identifying and responding to threats. The complexity of managing multiple sources of information can overwhelm teams, making it difficult to maintain a cohesive understanding of the security landscape.

This fragmentation underscores the need for a centralised approach that provides a "single pane of glass" view of all cybersecurity alerts. These systems streamline the process of monitoring and responding to incidents, enabling security teams to act more swiftly and effectively. By consolidating alerts into a unified interface, organisations can enhance their ability to detect and mitigate threats, ultimately improving their overall security posture.  

To achieve consolidation, organisations should consider the role automation can play when reviewing and correlating incidents. This is reflected in Spain’s technical guidelines for national security regulations regarding the requirements for the “recording of activity” (reinforcement R5).12 Specifically, the guidelines state that:  

"The system shall implement tools to analyses and review system activity and audit information, in search of possible or actual security compromises. An automatic system for collection of records, correlation of events and automatic response to them shall be available”.13  

Similarly, the German guidelines stress that automated central analysis is essential not only for recording all protocol and logging data generated within the system environment but also to ensure that the data is correlated to ensure that security-relevant processes are visible (article 115).14

Correlating disparate incidents and alerts is especially important when considering the increased connectivity between IT and OT environments driven by business and functional requirements. Indeed, organisations that believe they have air-gapped systems are now becoming aware of points of IT/OT convergence within their systems. It is therefore crucial for organisations managing both IT and OT environments to be able to visualise and secure devices across all IT and OT protocols in real-time to identify potential spillovers.  

By consolidating data into a centralised system, organisations can achieve a more resilient posture. This approach exposes and eliminates gaps between people, processes, and technology before they can be exploited by malicious actors. As seen in the German and Spanish guidelines, a unified view of security alerts not only enhances the efficacy of threat detection and response but also ensures comprehensive visibility and control over the organisation's cybersecurity posture.

3. Detection of anomalous activity  

Recent research highlights the emergence of a "new normal" in cybersecurity, marked by an increase in zero-day vulnerabilities. Indeed, for the first time since sharing their annual list, the Five Eyes intelligence alliance reported that in 2023, the majority of the most routinely exploited vulnerabilities were initially exploited as zero-days.15  

To effectively combat these advanced threats, policymakers, industry and academic stakeholders alike recognise the importance of anomaly-based techniques to detect both known and unknown attacks.

As AI-enabled threats become more prevalent,16 traditional cybersecurity methods that depend on lists of "known bads" are proving inadequate against rapidly evolving and sophisticated attacks. These legacy approaches are limited because they can only identify threats that have been previously encountered and cataloged. However, cybercriminals are constantly developing new, never-before-seen threats, such as signatureless ransomware or living off the land techniques, which can easily bypass these outdated defences.

The importance of anomaly detection in cybersecurity can be found in Spain’s technical guidelines, which states that “tools shall be available to automate the prevention and response process by detecting and identifying anomalies17” (reinforcement R4 prevention and automatic response to "incident management”).  

Similarly, the UK NCSC’s Cyber Assessment Framework (CAF) highlights how anomaly-based detection systems are capable of detecting threats that “evade standard signature-based security solutions” (Principle C2 - Proactive Security Event Discovery18). The CAF’s C2 principle further outlines:  

“The science of anomaly detection, which goes beyond using pre-defined or prescriptive pattern matching, is a challenging area. Capabilities like machine learning are increasingly being shown to have applicability and potential in the field of intrusion detection.”19

By leveraging machine learning and multi-layered AI techniques, organisations can move away from static rules and signatures, adopting a more behavioural approach to identifying and containing risks. This shift not only enhances the detection of emerging threats but also provides a more robust defence mechanism.

A key component of this strategy is behavioral zero trust, which focuses on identifying unauthorized and out-of-character attempts by users, devices, or systems. Implementing a robust procedure to verify each user and issuing the minimum required access rights based on their role and established patterns of activity is essential. Organisations should therefore be encouraged to follow a robust procedure to verify each user and issue the minimum required access rights based on their role and expected or established patterns of activity. By doing so, organisations can stay ahead of emerging threats and embrace a more dynamic and resilient cybersecurity strategy.  

4. Autonomous response

The speed at which cyber-attacks occur means that defenders must be equipped with tools that match the sophistication and agility of those used by attackers. Autonomous response tools are thus essential for modern cyber defence, as they enable organisations to respond to both known and novel threats in real time.  

These tools leverage a deep contextual and behavioral understanding of the organisation to take precise actions, effectively containing threats without disrupting business operations.

To avoid unnecessary business disruptions and maintain robust security, especially in more sensitive networks such as OT environments, it is crucial for organisations to determine the appropriate response depending on their environment. This can range from taking autonomous and native actions, such as isolating or blocking devices, or integrating their autonomous response tool with firewalls or other security tools to taking customized actions.  

Autonomous response solutions should also use a contextual understanding of the business environment to make informed decisions, allowing them to contain threats swiftly and accurately. This means that even as cyber-attacks evolve and become more sophisticated, organisations can maintain continuous protection without compromising operational efficiency.  

Indeed, research into the adoption of autonomous cyber defences points to the importance of implementing “organisation-specific" and “context-informed” approaches.20  To decide the appropriate level of autonomy for each network action, it is argued, it is essential to use evidence-based risk prioritisation that is customised to the specific operations, assets, and data of individual enterprises.21

By adopting autonomous response solutions, organisations can ensure their defences are as dynamic and effective as the threats they face, significantly enhancing their overall security posture.

5. Proactive cyber resilience  

Adopting a proactive approach to cybersecurity is crucial for organisations aiming to safeguard their operations and reputation. By hardening their defences enough so attackers are unable to target them effectively, organisations can save significant time and money. This proactive stance helps reduce business disruption, reputational damage, and the need for lengthy, resource-intensive incident responses.

Proactive cybersecurity incorporates many of the strategies outlined above. This can be seen in a recent survey of information technology practitioners, which outlines four components of a proactive cybersecurity culture: (1) visibility of corporate assets, (2) leveraging intelligent and modern technology, (3) adopting consistent and comprehensive training methods and (4) implementing risk response procedures.22 To this, we may also add continuous monitoring which allows organisations to understand the most vulnerable and high-value paths across their architectures, allowing them to secure their critical assets more effectively.  

Alongside these components, a proactive cyber strategy should be based on a combined business context and knowledge, ensuring that security measures are aligned with the organisation's specific needs and priorities.  

This proactive approach to cyber resilience is reflected in Spain’s technical guidance (article 8.2): “Prevention measures, which may incorporate components geared towards deterrence or reduction of the exposure surface, should eliminate or reduce the likelihood of threats materializing.”23 It can also be found in the NCSC’s CAF, which outlines how organisations can achieve “proactive attack discovery” (see Principle C2).24 Likewise, Belgium’s NIS2 transposition guidelines mandate the use of preventive measures to ensure the continued availability of services in the event of exceptional network failures (article 30).25  

Ultimately, a proactive approach to cybersecurity not only enhances protection but also lowers regulatory risk and supports the overall resilience and stability of the organisation.

Looking forward

The NIS2 Directive marked a significant regulatory milestone in strengthening cybersecurity across the EU.26 Given the impact of emerging technologies, such as AI, on cybersecurity, it is to see that Member States are encouraged to promote the adoption of ‘state-of-the-art' cybersecurity across regulated entities.  

In this blog, we have sought to translate what state-of-the-art cybersecurity may look like for organisations looking to enhance their cybersecurity posture. To do so, we have built on existing cybersecurity guidance, research and our own experience as an AI-cybersecurity company to outline five criteria: continuous monitoring, incident correlation, detection of anomalous activity, autonomous response, and proactive cyber resilience.

By embracing these principles and evolving cybersecurity practices in line with the state-of-the-art, organisations can comply with the NIS2 Directive while building a resilient cybersecurity posture capable of withstanding evolutions in the cyber threat landscape. Looking forward, it will be interesting to see how other jurisdictions embrace new technologies, such as AI, in solving the cybersecurity problem.

NIS2 white paper

Get ahead with the NIS2 White Paper

Get a clear roadmap for meeting NIS2 requirements and strengthening your cybersecurity posture. Learn how to ensure compliance, mitigate risks, and protect your organization from evolving threats.

Download Here!

References

[1] https://www.enisa.europa.eu/publications/implementation-guidance-on-nis-2-security-measures

[2] https://www.teletrust.de/fileadmin/user_upload/2023-05_TeleTrusT_Guideline_State_of_the_art_in_IT_security_EN.pdf

[3] https://kpmg.com/uk/en/home/insights/2024/04/what-does-nis2-mean-for-energy-businesses.html

[4] https://orbilu.uni.lu/bitstream/10993/50878/1/SCHMITZ_IFIP_workshop_sota_author-pre-print.pdf

[5]https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat

[6] https://www.sciencedirect.com/science/article/pii/S2949715923000793

[7] https://csrc.nist.gov/glossary/term/information_security_continuous_monitoring

[8] https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file

[9] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KRITIS/Konkretisierung_Anforderungen_Massnahmen_KRITIS.html

[10] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KRITIS/Konkretisierung_Anforderungen_Massnahmen_KRITIS.html

[12] https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file

[13] https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file

[14] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KRITIS/Konkretisierung_Anforderungen_Massnahmen_KRITIS.html

[15] https://therecord.media/surge-zero-day-exploits-five-eyes-report

[16] https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat

[17] https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file

[18] https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-c-detecting-cyber-security-events/principle-c2-proactive-security-event-discovery

[19] https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-c-detecting-cyber-security-events/principle-c2-proactive-security-event-discovery

[20] https://cetas.turing.ac.uk/publications/autonomous-cyber-defence-autonomous-agents

[21] https://cetas.turing.ac.uk/publications/autonomous-cyber-defence-autonomous-agents

[22] https://www.researchgate.net/publication/376170443_Cultivating_Proactive_Cybersecurity_Culture_among_IT_Professional_to_Combat_Evolving_Threats

[23] https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file

[24] https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-c-detecting-cyber-security-events/principle-c2-proactive-security-event-discovery

[25] https://www.ejustice.just.fgov.be/mopdf/2024/05/17_1.pdf#page=49

[26] ENISA, NIS Directive 2

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Livia Fries
Public Policy Manager, EMEA

More in this series

No items found.

Blog

/

/

April 16, 2025

Introducing Version 2 of Darktrace’s Embedding Model for Investigation of Security Threats (DEMIST-2)

woman looking at laptop at deskDefault blog imageDefault blog image

DEMIST-2 is Darktrace’s latest embedding model, built to interpret and classify security data with precision. It performs highly specialized tasks and can be deployed in any environment. Unlike generative language models, DEMIST-2 focuses on providing reliable, high-accuracy detections for critical security use cases.

DEMIST-2 Core Capabilities:  

  • Enhances Cyber AI Analyst’s ability to triage and reason about security incidents by providing expert representation and classification of security data, and as a part of our broader multi-layered AI system
  • Classifies and interprets security data, in contrast to language models that generate unpredictable open-ended text responses  
  • Incorporates new innovations in language model development and architecture, optimized specifically for cybersecurity applications
  • Deployable across cloud, on-prem, and edge environments, DEMIST-2 delivers low-latency, high-accuracy results wherever it runs. It enables inference anywhere.

Cybersecurity is constantly evolving, but the need to build precise and reliable detections remains constant in the face of new and emerging threats. Darktrace’s Embedding Model for Investigation of Security Threats (DEMIST-2) addresses these critical needs and is designed to create stable, high-fidelity representations of security data while also serving as a powerful classifier. For security teams, this means faster, more accurate threat detection with reduced manual investigation. DEMIST-2's efficiency also reduces the need to invest in massive computational resources, enabling effective protection at scale without added complexity.  

As an embedding language model, DEMIST-2 classifies and creates meaning out of complex security data. This equips our Self-Learning AI with the insights to compare, correlate, and reason with consistency and precision. Classifications and embeddings power core capabilities across our products where accuracy is not optional, as a part of our multi-layered approach to AI architecture.

Perhaps most importantly, DEMIST-2 features a compact architecture that delivers analyst-level insights while meeting diverse deployment needs across cloud, on-prem, and edge environments. Trained on a mixture of general and domain-specific data and designed to support task specialization, DEMIST-2 provides privacy-preserving inference anywhere, while outperforming larger general-purpose models in key cybersecurity tasks.

This proprietary language model reflects Darktrace's ongoing commitment to continually innovate our AI solutions to meet the unique challenges of the security industry. We approach AI differently, integrating diverse insights to solve complex cybersecurity problems. DEMIST-2 shows that a refined, optimized, domain-specific language model can deliver outsized results in an efficient package. We are redefining possibilities for cybersecurity, but our methods transfer readily to other domains. We are eager to share our findings to accelerate innovation in the field.  

The evolution of DEMIST-2

Key concepts:  

  • Tokens: The smallest units processed by language models. Text is split into fragments based on frequency patterns allowing models to handle unfamiliar words efficiently
  • Low-Rank Adaptors (LoRA): Small, trainable components added to a model that allow it to specialize in new tasks without retraining the full system. These components learn task-specific behavior while the original foundation model remains unchanged. This approach enables multiple specializations to coexist, and work simultaneously, without drastically increasing processing and memory requirements.

Darktrace began using large language models in our products in 2022. DEMIST-2 reflects significant advancements in our continuous experimentation and adoption of innovations in the field to address the unique needs of the security industry.  

It is important to note that Darktrace uses a range of language models throughout its products, but each one is chosen for the task at hand. Many others in the artificial intelligence (AI) industry are focused on broad application of large language models (LLMs) for open-ended text generation tasks. Our research shows that using LLMs for classification and embedding offers better, more reliable, results for core security use cases. We’ve found that using LLMs for open-ended outputs can introduce uncertainty through inaccurate and unreliable responses, which is detrimental for environments where precision matters. Generative AI should not be applied to use cases, such as investigation and threat detection, where the results can deeply matter. Thoughtful application of generative AI capabilities, such as drafting decoy phishing emails or crafting non-consequential summaries are helpful but still require careful oversight.

Data is perhaps the most important factor for building language models. The data used to train DEMIST-2 balanced the need for general language understanding with security expertise. We used both publicly available and proprietary datasets.  Our proprietary dataset included privacy-preserving data such as URIs observed in customer alerts, anonymized at source to remove PII and gathered via the Call Home and aianalyst.darktrace.com services. For additional details, read our Technical Paper.  

DEMIST-2 is our way of addressing the unique challenges posed by security data. It recognizes that security data follows its own patterns that are distinct from natural language. For example, hostnames, HTTP headers, and certificate fields often appear in predictable ways, but not necessarily in a way that mirrors natural language. General-purpose LLMs tend to break down when used in these types of highly specialized domains. They struggle to interpret structure and context, fragmenting important patterns during tokenization in ways that can have a negative impact on performance.  

DEMIST-2 was built to understand the language and structure of security data using a custom tokenizer built around a security-specific vocabulary of over 16,000 words. This tokenizer allows the model to process inputs more accurately like encoded payloads, file paths, subdomain chains, and command-line arguments. These types of data are often misinterpreted by general-purpose models.  

When the tokenizer encounters unfamiliar or irregular input, it breaks the data into smaller pieces so it can still be processed. The ability to fall back to individual bytes is critical in cybersecurity contexts where novel or obfuscated content is common. This approach combines precision with flexibility, supporting specialized understanding with resilience in the face of unpredictable data.  

Along with our custom tokenizer, we made changes to support task specialization without increasing model size. To do this, DEMIST-2 uses LoRA . LoRA is a technique that integrates lightweight components with the base model to allow it to perform specific tasks while keeping memory requirements low. By using LoRA, our proprietary representation of security knowledge can be shared and reused as a starting point for more highly specialized models, for example, it takes a different type of specialization to understand hostnames versus to understand sensitive filenames. DEMIST-2 dynamically adapts to these needs and performs them with purpose.  

The result is that DEMIST-2 is like having a room of specialists working on difficult problems together, while sharing a basic core set of knowledge that does not need to be repeated or reintroduced to every situation. Sharing a consistent base model also improves its maintainability and allows efficient deployment across diverse environments without compromising speed or accuracy.  

Tokenization and task specialization represent only a portion of the updates we have made to our embedding model. In conjunction with the changes described above, DEMIST-2 integrates several updated modeling techniques that reduce latency and improve detections. To learn more about these details, our training data and methods, and a full write-up of our results, please read our scientific whitepaper.

DEMIST-2 in action

In this section, we highlight DEMIST-2's embeddings and performance. First, we show a visualization of how DEMIST-2 classifies and interprets hostnames, and second, we present its performance in a hostname classification task in comparison to other language models.  

Embeddings can often feel abstract, so let’s make them real. Figure 1 below is a 2D visualization of how DEMIST-2 classifies and understands hostnames. In reality, these hostnames exist across many more dimensions, capturing details like their relationships with other hostnames, usage patterns, and contextual data. The colors and positions in the diagram represent a simplified view of how DEMIST-2 organizes and interprets these hostnames, providing insights into their meaning and connections. Just like an experienced human analyst can quickly identify and group hostnames based on patterns and context, DEMIST-2 does the same at scale.  

DEMIST-2 visualization of hostname relationships from a large web dataset.
Figure 1: DEMIST-2 visualization of hostname relationships from a large web dataset.

Next, let’s zoom in on two distinct clusters that DEMIST-2 recognizes. One cluster represents small businesses (Figure 2) and the other, Russian and Polish sites with similar numerical formats (Figure 3). These clusters demonstrate how DEMIST-2 can identify specific groupings based on real-world attributes such as regional patterns in website structures, common formats used by small businesses, and other properties such as its understanding of how websites relate to each other on the internet.

Cluster of small businesses
Figure 2: Cluster of small businesses
Figure 3: Cluster of Russian and Polish sites with a similar numerical format

The previous figures provided a view of how DEMIST-2 works. Figure 4 highlights DEMIST-2’s performance in a security-related classification task. The chart shows how DEMIST-2, with just 95 million parameters, achieves nearly 94% accuracy—making it the highest-performing model in the chart, despite being the smallest. In comparison, the larger model with 2.78 billion parameters achieves only about 89% accuracy, showing that size doesn’t always mean better performance. Small models don’t mean poor performance. For many security-related tasks, DEMIST-2 outperforms much larger models.

Hostname classification task performance comparison against comparable open source foundation models
Figure 4: Hostname classification task performance comparison against comparable open source foundation models

With these examples of DEMIST-2 in action, we’ve shown how it excels in embedding and classifying security data while delivering high performance on specialized security tasks.  

The DEMIST-2 advantage

DEMIST-2 was built for precision and reliability. Our primary goal was to create a high-performance model capable of tackling complex cybersecurity tasks. Optimizing for efficiency and scalability came second, but it is a natural outcome of our commitment to building a strong, effective solution that is available to security teams working across diverse environments. It is an enormous benefit that DEMIST-2 is orders of magnitude smaller than many general-purpose models. However, and much more importantly, it significantly outperforms models in its capabilities and accuracy on security tasks.  

Finding a product that fits into an environment’s unique constraints used to mean that some teams had to settle for less powerful or less performant products. With DEMIST-2, data can remain local to the environment, is entirely separate from the data of other customers, and can even operate in environments without network connectivity. The size of our model allows for flexible deployment options while at the same time providing measurable performance advantages for security-related tasks.  

As security threats continue to evolve, we believe that purpose-built AI systems like DEMIST-2 will be essential tools for defenders, combining the power of modern language modeling with the specificity and reliability that builds trust and partnership between security practitioners and AI systems.

Conclusion

DEMIST-2 has additional architectural and deployment updates that improve performance and stability. These innovations contribute to our ability to minimize model size and memory constraints and reflect our dedication to meeting the data handling and privacy needs of security environments. In addition, these choices reflect our dedication to responsible AI practices.

DEMIST-2 is available in Darktrace 6.3, along with a new DIGEST model that uses GNNs and RNNs to score and prioritize threats with expert-level precision.

[related-resource]

Continue reading
About the author
Margaret Cunningham, PhD
Director, Security & AI Strategy, Field CISO

Blog

/

/

April 16, 2025

AI Uncovered: Introducing Darktrace Incident Graph Evaluation for Security Threats (DIGEST)

man looking at computer screenDefault blog imageDefault blog image

DIGEST advances how Cyber AI Analyst scores and prioritizes incidents. Trained on over a million anonymized incident graphs, our model brings deeper context to severity scoring by analyzing how threats are structured and how they evolve. DIGEST assesses threats as an expert, before damage is done. For more details beyond this overview, please read our Technical Research Paper.

Darktrace combines machine learning (ML) and artificial intelligence (AI) approaches using a multi-layered, multi-method approach. The result is an AI system that continuously ingests data from across an organization’s environment, learns from it, and adapts in real time. DIGEST adds a new layer to this system, specifically to our Cyber AI Analyst, the first and most experienced AI Analyst in cybersecurity, dedicated to refining how incidents are scored and prioritized. DIGEST improves what your team uses to focus on what matters the most first.

To build DIGEST, we combined Graph Neural Networks (GNNs) to interpret incident structure with Recurrent Neural Networks (RNNs) to analyze how incidents evolve over time. This pairing allows DIGEST to reliably determine the potential severity of an incident even at an early stage to give the Cyber AI Analyst a critical edge in identifying high-risk threats early and recognizing when activity is unlikely to escalate.

DIGEST works locally in real-time regardless of whether your Darktrace deployment is on prem or in the cloud, without requiring data to be sent externally for decisions to be made. It was built to support teams in all environments, including those with strict data controls and limited connectivity.

Our approach to AI is unique, drawing inspiration from multiple disciplines to tackle the toughest cybersecurity challenges. DIGEST demonstrates how a novel application of GNNs and RNNs improves the prioritization and triage of security incidents. By blending interdisciplinary expertise with innovative AI techniques, we are able to push the boundaries of what’s possible and deliver it where it is needed most. We are eager to share our findings to accelerate progress throughout the broader field of AI development.

DIGEST: Pattern, progression, and prioritization

Most security incidents start quietly. A device contacting an unusual domain. Credentials are used at unexpected hours. File access patterns shift. The fundamental challenge is not always detecting these anomalies but knowing what to address first. DIGEST gives us this capability.

To understand DIGEST, it helps to start with Cyber AI Analyst, a critical component of our Self-Learning AI system and a front-line triage partner in security investigations. It combines supervised and unsupervised machine learning (ML) techniques, natural language processing (NLP), and graph-based reasoning to investigate and summarize security incidents.

DIGEST was built as an additional layer of analysis within Cyber AI Analyst. It enhances its capabilities by refining how incidents are scored and prioritized, helping teams focus on what matters most more quickly. For a general view of the ML and AI methods that power Darktrace products, read our AI Arsenal whitepaper. This paper provides insights regarding the various approaches we use to detect, investigate, and prioritize threats.

Cyber AI Analyst is constantly investigating alerts and produces millions of critical incidents every year. The dynamic graphs produced by Cyber AI Analyst investigations represent an abstract understanding of security incidents that is fully anonymized and privacy preserving. This allowed us to use the Call Home and aianalyst.darktrace.com services to produce a dataset comprising the broad structure of millions of incidents that Cyber AI analyst detected on customer deployments, without containing any sensitive data. (Read our technical research paper for more details about our dataset).

The dynamic graphs from Cyber AI Analyst capture the structure of security incidents where nodes represent entities like users, devices or resources, and edges represent the multitude of relationships between them. As new activity is observed, the graph expands, capturing the progression of incidents over time. Our dataset contained everything from benign administrative behavior to full-scale ransomware attacks.

Unique data, unmatched insights

Key terms

Graph Neural Networks (GNNs): A type of neural network designed to analyze and interpret data structured as graphs, capturing relationships between nodes.

Recurrent Neural Networks (RNNs): A type of neural network designed to model sequences where the order of events matters, like how activity unfolds in a security incident.

The Cyber AI Analyst dataset used to train DIGEST reflects over a decade of work in AI paired with unmatched expertise in cybersecurity. Prior to training DIGEST on our incident graph data set, we performed rigorous data preprocessing to ensure to remove issues such as duplicate or ill-formed incidents. Additionally, to validate DIGEST’s outputs, expert security analysts assessed and verified the model’s scoring.

Transforming data into insights requires using the right strategies and techniques. Given the graphical nature of Cyber AI Analyst incident data, we used GNNs and RNNs to train DIGEST to understand incidents and how they are likely to change over time. Change does not always mean escalation. DIGEST’s enhanced scoring also keeps potentially legitimate or low-severity activity from being prioritized over threats that are more likely to get worse. At the beginning, all incidents might look the same to a person. To DIGEST, it looks like the beginning of a pattern.

As a result, DIGEST enhances our understanding of security incidents by evaluating the structure of the incident, probable next steps in an incident’s trajectory, and how likely it is to grow into a larger event.

To illustrate these capabilities in action, we are sharing two examples of DIGEST’s scoring adjustments from use cases within our customers’ environments.

First, Figure 1 shows the graphical representation of a ransomware attack, and Figure 2 shows how DIGEST scored incident progression of that ransomware attack. At hour two, DIGEST’s score escalated to 95% well before observation of data encryption. This means that prior to seeing malicious encryption behaviors, DIGEST understood the structure of the incident and flagged these early activities as high-likelihood precursors to a severe event. Early detection, especially when flagged prior to malicious encryption behaviors, gives security teams a valuable head start and can minimize the overall impact of the threat, Darktrace Autonomous Response can also be enabled by Cyber AI Analyst to initiate an immediate action to stop the progression, allowing the human security team time to investigate and implement next steps.

Graph representation of a ransomware attack
Figure 1: Graph representation of a ransomware attack
Timeline of DIGEST incident score escalation. Note that timestep does not equate to hours, the spike in score to 95% occurred approximately 2 hours into the attack, prior to data encryption.
Figure 2:  Timeline of DIGEST incident score escalation. Note that timestep does not equate to hours, the spike in score to 95% occurred approximately 2 hours into the attack, prior to data encryption.

In contrast, our second example shown in Figure 3 and Figure 4 illustrates how DIGEST’s analysis of an incident can help teams avoid wasting time on lower risk scenarios. In this instance, Figure 3 illustrates a graph of unusual administrative activity, where we observed connection to a large group of devices. However, the incident score remained low because DIGEST determined that high risk malicious activity was unlikely. This determination was based on what DIGEST observed in the incident's structure, what it assessed as the probable next steps in the incident lifecycle and how likely it was to grow into a larger adverse event.

Graph representation of unusual admin activity connecting to a large group of devices.
Figure 3: Graph representation of unusual admin activity connecting to a large group of devices.
Timeline of DIGEST incident scoring, where the score remained low as the unusual event was determined to be low risk.
Figure 4: Timeline of DIGEST incident scoring, where the score remained low as the unusual event was determined to be low risk.

These examples show the value of enhanced scoring. DIGEST helps teams act sooner on the threats that count and spend less time chasing the ones that do not.

The next phase of advanced detection is here

Darktrace understands what incidents look like. We have seen, investigated, and learned from them at scale, including over 90 million investigations in 2024. With DIGEST, we can share our deep understanding of incidents and their behaviors with you and triage these incidents using Cyber AI Analyst.

Our ability to innovate in this space is grounded in the maturity of our team and the experiences we have built upon in over a decade of building AI solutions for cybersecurity. This experience, along with our depth of understanding of our data, techniques, and strategic layering of AI/ML components has shaped every one of our steps forward.

With DIGEST, we are entering a new phase, with another line of defense that helps teams prioritize and reason over incidents and threats far earlier in an incident’s lifecycle. DIGEST understands your incidents when they start, making it easier for your team to act quickly and confidently.

DIGEST is available in Darktrace 6.3, along with a new embedding model – DEMIST-2 – designed to provide reliable, high-accuracy detections for critical security use cases.

[related-resource]

Continue reading
About the author
Margaret Cunningham, PhD
Director, Security & AI Strategy, Field CISO
Your data. Our AI.
Elevate your network security with Darktrace AI