Blog
/
AI
/
April 9, 2024

The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners

Part 1: This blog outlines Darktrace’s State of AI Cybersecurity research report, showing key findings from our global survey, covering the impacts AI has on the cyber threat landscape, cyber security solutions, and perceptions and priorities for security practitioners.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mitchell Bezzina
VP, Product and Solutions Marketing
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Apr 2024

What is the State of AI Cybersecurity Report?

We surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.

Here are some of the key findings from the report:

What is the impact of AI on the cyber threat landscape?

Today’s security stakeholders are already seeing AI’s impact on the threat landscape.

"74% of survey respondents agree that AI-powered cyber threats are having a significant impact on their organizations. However, 60% of respondents fear that their organizations are not adequately prepared to defend against AI-powered threats and attacks."

How is AI being applied in cyber-attacks?

Generative AI can be used to create large volumes of highly personalized phishing attacks and to change the signatures and hashes associated with malware files. Other AI tools can also scan environments for exploitable vulnerabilities.

However, operationalizing AI in a cyber-attack requires sophistication. In most cases, attackers tend to begin using AI by addressing the simplest use cases or “lowest-hanging fruit.”

Identifying exactly when and where AI is being applied is not always possible since there are few methods for doing so. Thus, defenders will need to focus their effort on preparing for threats that are coming at them faster than ever before.

How does AI affect cyber risk?

"71% of organizations have already taken strides to reduce the risks that come with AI’s adoption."

In terms of cyber risk, adopting AI technologies into the business also generates concern for industry professionals given the increased risk of exposing sensitive or proprietary information through employee use of third-party generative AI tools. The access to publicly-available, text-based generative AI systems to increase productivity opens the door to “shadow AI” in which individuals use these popular AI tools without organizational approval or oversight.

What is the impact of AI on cybersecurity solutions?

AI is poised to transform not just the threat landscape but the solution landscape as well, a fact defenders understand.

"95% of cybersecurity professionals agree that AI-powered solutions will level up their organizations’ defenses."

Survey participants believe that AI-powered security solutions are a must-have for countering the risks posed by AI-powered threats. However, cybersecurity vendors are racing to capitalize on buyer interest in AI by supplying solutions that promise to meet the increasing demands. But not all AI is created equal, and not all these solutions live up to the widespread hype.

"Improving threat detection (57%) and identifying exploitable vulnerabilities (50%) are the top ranked areas where respondents believe AI will make an impact."

However, survey participants may not fully understand how AI is applied to these aspects of cybersecurity. For example, generativeAI actually has little to no role to play in threat detection and proactive attack surface management. Generative AI does accelerate the data retrieval process within threat detection, can create quick incident summaries, automate low level tasks, and simulate phishing emails, but it does not improve the ability to detect novel attacks.

Understanding AI technologies in cybersecurity

A worldwide preoccupation with generativeAI may have colored perceptions of what AI is and where it’s most effectively applied.

"Only 26% of security professionals report a full understanding of the different types of AI in use within security products."

As the AI revolution unfolds, the speed at which vendors are introducing new AI-powered solutions far outpaces the rate at which practitioners are being trained how to use them.

There’s a strong need for greater vendor transparency, as well as efforts to educate end users so that they can better understand the technologies they are deploying.

Types of AI in cybersecurity

Supervised machine learning: Applied more often than any other type of AI in cybersecurity.Trained on human attack patterns and historical threat intelligence.

Natural language processing (NLP): Applies computational techniques to process and understand human language.

Large language models (LLMs): Applies deep learning models trained on massively large data sets to understand, summarize, and generate new content. Used in generative AI tools. The integrity of their output depends upon the quality of the data on which they were trained.

Unsupervised machine learning: Continuously learns from raw, unstructured data to identify deviations that represent true anomalies.

The more attention AI technology gets in cybersecurity, the higher expectations tend to be. As leaders and practitioners discover more about AI, they will need to learn when and where to use it – and how to offset the potential risks that various models and approaches can bring.

Cybersecurity practitioners’ priorities and objectives

Although security stakeholders are aware that the rise of AI will require them to implement new tools and deploy more advanced capabilities in certain areas, they still entertain multiple different – and sometimes conflicting – opinions about planning for the future.

"88% of cybersecurity professionals prefer a platform approach over individual point products."

Respondents expressed a strong preference for a platform- centric approach in their cybersecurity solution stacks. This is undoubtedly due to a far-reaching desire to reduce cost and complexity.

Even more widespread was agreement that organizations prefer to purchase new security capabilities within a broader platform rather than as individual point products.

"Top priorities for improving their ability to defend against AI-driven threats include adding AI-powered tools to their solution stacks and improving toolset integration."

Many security teams are looking to their existing vendors first when thinking about adding AI-powered tools to their solution stack. This may be because:

  1. It takes more time and effort to replace existing tooling than it does to add onto the exiting stack.
  2. Trust has already been established within existing relationships. As long as this is valued, there will always be a need to integrate AI and non-AI solutions.

Download the report for more statistics and insight on the state of AI in cybersecurity.

Learn more about AI can help you secure your enterprise

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mitchell Bezzina
VP, Product and Solutions Marketing

Blog

/

Email

/

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Default blog imageDefault blog image

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

  • Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
  • Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

  • Faster investigations with consolidated visibility
  • Clear attribution of actions and outcomes across both platforms
  • Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

Continue reading
About the author
Carlos Gray
Senior Product Marketing Manager, Email

Blog

/

Network

/

June 19, 2025

Customer Case Study: Leading Petrochemical Manufacturer

Default blog imageDefault blog image

Headquartered in Saudi Arabia, this industry leading petrochemical manufacturer serves customers in more than 80 countries across diverse markets throughout Europe, Africa, Latin America, the Middle East, China, and Southeast Asia.

Cyber resiliency critical to growth strategy

This leading petrochemical manufacturer’s vision is to be one of the major global players in the production and marketing of designated petrochemicals and downstream products. The company aims to significantly increase its capacity to up to a million metric tons within the next few years.

With cyber-attacks on critical infrastructure increasing 30% globally last year, cyber resiliency is essential to supporting the company’s strategic business goals of:

  • Maximizing production through efficient asset utilization
  • Maximizing sales by conducting 90% of its business outside Saudi Arabia
  • Optimizing resources and processes by integrating with UN Global Compact principles for sustainability and efficiency
  • Growing its business portfolio by engaging in joint ventures to diversify production and add value to the economy

However, the industry leader faced several challenges in its drive to fortify its cybersecurity defenses.

Visibility gaps delay response time

The company’s existing security setup provided limited visibility to the in-house security team, hindering its ability to detect anomalous network and user activity in real time. This resulted in delayed responses to potential incidents, making proactive issue resolution difficult and any remediation in the event of a successful attack costly and time-consuming.

Manual detection drains resources

Without automated detection and response capabilities, the organization’s security team had to manually monitor for suspicious activity – a time-consuming and inefficient approach that strained resources and left the organization vulnerable. This made it difficult for the team to stay current with training or acquire new skills and certifications, which are core to the ethos of both the company’s owners and the team itself.

Cyber-attacks on critical infrastructure increasing

The petrochemical manufacturer is part of a broader ecosystem of companies, making the protection of its supply chain – both upstream and downstream – critical. With several manufacturing entities and multiple locations, the customer’s internal structure is complex and challenging to secure. As cyber-attacks on critical infrastructure escalate, it needed a more comprehensive approach to safeguard its business and the wider ecosystem.

Keeping and growing skills and focus in-house

To strengthen its cybersecurity strategy, the company considered two options:

  1. Make a significant initial and ongoing investment in a Security Operations Center (SOC), which would involve skills development outside the company and substantial management overhead.
  2. Use a combination of new, automated tools and an outsourced Managed Detection and Response (MDR) service to reduce the burden on internal security specialists and allow the company to invest in upskilling its staff so they can focus on more strategic tasks.

Faced with this choice between entirely outsourcing security and augmenting the security team with new capabilities, the customer chose the second option, selecting Darktrace to automate the company’s monitoring, detection, and response. Today, the petrochemical manufacturer is using:

Extending the SOC with 24/7 expert support

To alleviate the burden on its lean security team, the company augmented its in-house capabilities with Darktrace’s Managed Detection & Response service. This support acts as an extension of its SOC, providing 24/7 monitoring, investigation, and escalation of high-priority threats. With Darktrace’s global SOC managing alert triage and autonomously containing threats, the organization’s internal team can focus on strategic initiatives. The result is a stronger security posture and increased capacity to proactively address evolving cyber risks – without expanding headcount or sacrificing visibility.

A unique approach to AI

In its search for a new security platform, the company’s Director of Information Technology said Darktrace’s autonomous response capability, coupled with Self-Learning AI-driven threat reduction, were two big reasons for selecting Darktrace over competing products and services.

AI was a huge factor – no one else was doing what Darktrace was doing with [AI].”

Demonstrated visibility

Before Darktrace, the customer had no visibility into the network activity to and from remote worker devices. Some employees need the ability to connect to its networks at any time and from any location, including the Director of Information Technology. The trial deployment of Darktrace / ENDPOINT was a success and gave the team peace of mind that, no matter the location or device, high-value remote workers were protected by Darktrace.

Modular architecture  

Darktrace's modular architecture allowed the company to deploy security controls across its complex, multi-entity environment. The company’s different locations run on segregated networks but are still interconnected and need to be protected. Darktrace / NETWORK provides a unified view and coordinated security response across the organization’s entire network infrastructure, including endpoint devices.

Results

The petrochemical manufacturer is using Darktrace across all of its locations and has achieved total visibility across network and user activity. “Darktrace is increasing in value every day,” said the Director of Information Technology.

I don’t have a big team, and Darktrace makes our lives very, very easy, not least the automation of some of the tasks that require constant manual review.”

Time savings frees analysts to focus on proactive security

Darktrace / NETWORK provides continuous, AI-driven monitoring and analysis of the company’s network activity, user behavior, and threat patterns, establishing a baseline of what normal activity looks like, and then alerting analysts to any deviations from normal traffic, activity, and behaviors. Darktrace’s autonomous response capabilities speed up response to detected threats, meaning intervention from the security team is required for fewer incidents and alerts.

In October 2024 alone, Darktrace Cyber AI Analyst saved the team 810 investigation hours, and autonomously responded to 180 anomalous behaviors that were uncovered during the investigations. With Darktrace managing the majority of threat detection and response efforts, the security team has been able to change its day-to-day activity from manual review of traffic and alerts and belated response to activity, to proactively fortifying its detection and response posture and upskilling to meet evolving requirements.  

Layered email protection reduces phishing threats

The company’s email infrastructure posed a challenge due to petrochemical industry regulations requiring on-premises email servers, with some security delivered via Microsoft Azure. By integrating Darktrace / EMAIL into the Azure stack, the organization has reduced the volume of phishing emails its users receive by 5%.

“Now we have one more layer of security related to email – every email goes through two filters. If something is not being caught or traced by Azure, it is being detected by Darktrace,” said the Director of Information Technology. “As a result, we’re now seeing only about 15% to 20% of the phishing emails we used to receive before implementing Darktrace.”

Preparing for a secure future

The time saved using Darktrace has helped the security team take proactive steps, including preparing for new cyber resilience regulations for Saudi Arabia’s Critical National Infrastructure, as mandated by the National Cybersecurity Authority (NCA).

“The team now has ample time to prepare policies and procedures that meet the new NCA regulations and, in some cases, enhance the requirements of the new law,” said the Director of Information Technology. “All of this is possible because they don’t need to keep watch; Darktrace takes on so much of that task for them.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI