Blog
/
/
November 16, 2021

The Tech Driving Arrow McLaren SP to the Top

As Arrow McLaren SP looks back on a positive season, the team reflects on key challenges, success, and how AI and automation is leveraged in their work!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
16
Nov 2021

As Arrow McLaren SP looks back on a positive season and prepares to build momentum into next year, Taylor Kiel (Team President) and Craig Hampson (Director of Trackside Engineering) reflect on key challenges and successes. With Pato O’Ward’s No. 5 car in the running to win the championship until the final race of the season, they reveal the formula for success – and how the team leverages AI and automation in every aspect of their work – from driver simulation to cyber security.

Data as the lifeblood for performance

In INDYCAR qualifiying, the difference between P1 and P10 can be as little as half a second, and when margins are that tight, the finer details in preparation make the difference. For us, that preparation is driven by data. Every race weekend and every practice session, over 100 lightweight sensors and several computers on the cars produce masses of data that is stored and analyzed for performance optimization.

This ecosystem includes an engine controller, a gear shift controller computer, and a computer unit that controls the clutch, and these systems all talk to each other across what is called a Controller Area Network (CAN). So the key question for us becomes: how do we get useful insights from that data, securely, and in a short period of time?

If you can think of something that’s happening on the car, the likelihood is our team is doing everything we can to try and measure it. Air speed, acceleration, tyre temperature, and so much more – we currently record over 1,500 data channels on the car itself, and we then process another 838 ‘math channels’ from combinations of this data – giving us, for example, the ride height of and downforce on the car.

This is more data than we can ever process with human beings alone, and a lot of our work now is figuring out how to automate these processes, using AI to look for patterns that humans simply cannot identify.

Pitting: More than just a tyre change

Each of our cars have two cellular-based telemetry systems built into them, but we are still limited on the amount of throughput we can observe real time, which is why we need to offload this data each time we pit during practice. This involves plugging in what we call an ‘umbilical cord’ that has a communication line and also powers the car.

Figure 1: A typical INDYCAR would last only minutes on its own battery without the engine running

Any typical race produces between 2.5GB and 3.3GB of data, in addition to in-car video, and a GPS system recording the car’s position on the track, which not only goes back to us but also to the relevant television broadcasters. So, we need to have a lot of storage available both in the cloud and on hard drives using a server. That data needs to be available not just to us at trackside but virtually to engineers not present at the race. And most importantly, that data needs to be secure, and protected from outside interference.

The cyber side: Turning to AI

All that precious data coming from the car, residing in the cloud or elsewhere in our organization, is susceptible to tampering from insiders and outsiders who may – deliberately or indirectly – compromise our ability to access or use that data reliably. As the cyber-threat landscape evolves – with ransomware bringing organizations of all shapes and sizes to a halt – we need to make sure we’re prepared for whatever attack is around the corner.

Firewalls, email gateways, and other perimeter protections are one part of the puzzle. But while these tools are focussed on keeping an attacker out – we needed another layer of defense that ensures that if these defenses are bypassed, we have an autonomous system that knows our organization inside out and can fight back on our behalf to disrupt emerging threats.

That’s where Darktrace has provided a revolutionary solution – using Self-Learning AI that understands every person and device from the ground up and identifies subtle deviations that point to a cyber-threat. And if ransomware strikes, 24/7 Autonomous Response is there in the form of Darktrace Antigena, taking precise action to contain ransomware and other threats at machine speed.

Double wins at doubleheaders

Using automation and AI throughout our technology stack enables us to extract meaningful insights from large pools of data and take quick, decisive action in the form of changes to the car or on-the-fly changes in race strategy.

The ability to react and react quickly is really put to the test on doubleheader race weekends, where any room for improvement you identify from Saturday’s race can be rectified in the form of overnight changes and implemented on Sunday. We believe it’s no coincidence that both of Pato’s No. 5 car’s wins came on the back end of doubleheader events, at Texas and Detroit Belle Isle. With people working in harmony with technology, our engineering team were able to make significant improvements to the car, react on the fly, and ultimately ensure we ended up ahead of the competition.

Digital fakes: Breaking new ground at Nashville

This year’s INDYCAR season featured a brand new track in Nashville, an exciting but daunting prospect for both the drivers and the team as a whole. Having access to a driver simulator, thanks to our partners at Chevrolet, we were able to run a virtual version of our car to try different setups, different techniques, and in this case have the driver learn his way round a whole new circuit.

Figure 2: The Chevrolet simulator projects a digital twin of the Nashville circuit

The track is recreated down to the nearest millimetre using a laser scanner, and then there is a lot of digital rendering involved, making it as realistic as possible with stands, fencing, and sponsor banners. Using this ‘digital fake’ representation was super helpful to the drivers in determining the correct approaches to corners, and for our engineers, enabling them to use the outputs to characterize the track.

The setup of the car in the simulator is effectively the same as the setup of the car in the real world: you set the spring rate and the ride height, it has the aerodynamic map, it knows the inertias and the masses of the car. It’s an incredibly complicated and powerful physics engine, but it gives us the ability to test things out in a controlled environment, and contributed toward one of Felix Rosenqvist’s strongest races of the season in the No. 7 car.

Simulations like these are the way of the future – not just for new circuits but in general. Rather than going through tyres and engines, we can replicate practice sessions in digital form, and the software gets closer to reality every day.

Looking ahead

What is next for Arrow McLaren SP? As we are now a part of the McLaren Racing family, new efficiencies and synergies are realized every month. We’ll certainly continue to leverage that valuable partnership, as well as our technology partnership with Darktrace, continuing to roll out their technology across our digital estate, including our email and cloud services.

In the INDYCAR Series, if you stay still, you go backwards, and the competition hots up every year. We know that now more than ever, the answer lies in using cutting-edge technologies across every aspect of the business to make our lives easier and ultimately propel us to the very top.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP

More in this series

No items found.

Blog

/

AI

/

February 26, 2026

What the Darktrace Annual Threat Report 2026 Means for Security Leaders

Image of the Earth from spaceDefault blog imageDefault blog image

The challenge for today’s CISOs

At the broadest level, the defining characteristic of cybersecurity in 2026 is the sheer pace of change shaping the environments we protect. Organizations are operating in ecosystems that are larger, more interconnected, and more automated than ever before – spanning cloud platforms, distributed identities, AI-driven systems, and continuous digital workflows.  

The velocity of this expansion has outstripped the slower, predictable patterns security teams once relied on. What used to be a stable backdrop is now a living, shifting landscape where technology, risk, and business operations evolve simultaneously. From this vantage point, the central challenge for security leaders isn’t reacting to individual threats, but maintaining strategic control and clarity as the entire environment accelerates around them.

Strategic takeaways from the Annual Threat Report

The Darktrace Annual Threat Report 2026 reinforces a reality every CISO feels: the center of gravity isn’t the perimeter, vulnerability management, or malware, but trust abused via identity. For example, our analysis found that nearly 70% of incidents in the Americas region begin with stolen or misused accounts, reflecting the global shift toward identity‑led intrusions.

Mass adoption of AI agents, cloud-native applications, and machine decision-making means CISOs now oversee systems that act on their own. This creates an entirely new responsibility: ensuring those systems remain safe, predictable, and aligned to business intent, even under adversarial pressure.

Attackers increasingly exploit trust boundaries, not firewalls – leveraging cloud entitlements, SaaS identity transitions, supply-chain connectivity, and automation frameworks. The rise of non-human identities intensifies this: credentials, tokens, and agent permissions now form the backbone of operational risk.

Boards are now evaluating CISOs on business continuity, operational recovery, and whether AI systems and cloud workloads can fail safely without cascading or causing catastrophic impact.

In this environment, detection accuracy, autonomous response, and blast radius minimization matter far more than traditional control coverage or policy checklists.

Every organization will face setbacks; resilience is measured by how quickly security teams can rise, respond, and resume momentum. In 2026, success will belong to those that adapt fastest.

Managing business security in the age of AI

CISO accountability in 2026 has expanded far beyond controls and tooling. Whether we asked for it or not, we now own outcomes tied to business resilience, AI trust, cloud assurance, and continuous availability. The role is less about certainty and more about recovering control in an environment that keeps accelerating.

Every major 2026 initiative – AI agents, third-party risk, cloud, or comms protection – connects to a single board-level question: Are we still in control as complexity and automation scale faster than humans?

Attackers are not just getting more sophisticated; they are becoming more automated. AI changes the economics of attack, lowering cost and increasing speed. That asymmetry is what CISOs are being measured against.

CISOs are no longer evaluated on tool coverage, but on the ability to assure outcomes – trust in AI adoption, resilience across cloud and identity, and being able to respond to unknown and unforeseen threats.

Boards are now explicitly asking whether we can defend against AI-driven threats. No one can predict every new behavior – survival depends on detecting malicious deviations from normal fast and responding autonomously.  

Agents introduce decision-making at machine speed. Governance, CI/CD scanning, posture management, red teaming, and runtime detection are no longer differentiators but the baseline.

Cloud security is no longer architectural, it is operational. Identity, control planes, and SaaS exposure now sit firmly with the CISO.

AI-speed threats already reshaping security in 2026

We’re already seeing clear examples of how quickly the threat landscape has shifted in 2026. Darktrace’s work on React2Shell exposed just how unforgiving the new tempo is: a honeypot stood up with an exposed React was hit in under two minutes. There was no recon phase, no gradual probing – just immediate, automated exploitation the moment the code appeared publicly. Exposure now equals compromise unless defenses can detect, interpret, and act at machine speed. Traditional operational rhythms simply don’t map to this reality.

We’re also facing the first wave of AI-authored malware, where LLMs generate code that mutates on demand. This removes the historic friction from the attacker side: no skill barrier, no time cost, no limit on iteration. Malware families can regenerate themselves, shift structure, and evade static controls without a human operator behind the keyboard. This forces CISOs to treat adversarial automation as a core operational risk and ensure that autonomous systems inside the business remain predictable under pressure.

The CVE-2026-1731 BeyondTrust exploitation wave reinforced the same pattern. The gap between disclosure and active, global exploitation compressed into hours. Automated scanning, automated payload deployment, coordinated exploitation campaigns, all spinning up faster than most organizations can push an emergency patch through change control. The vulnerability-to-exploit window has effectively collapsed, making runtime visibility, anomaly detection, and autonomous containment far more consequential than patching speed alone.

These cases aren’t edge scenarios; they represent the emerging norm. Complexity and automation have outpaced human-scale processes, and attackers are weaponizing that asymmetry.  

The real differentiator for CISOs in 2026 is less about knowing everything and more about knowing immediately when something shifts – and having systems that can respond at the same speed.

[related-resource]

Continue reading
About the author
Mike Beck
Global CISO

Blog

/

Network

/

February 19, 2026

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

Default blog imageDefault blog image

Note: Darktrace's Threat Research team is publishing now to help defenders. We will continue updating this blog as our investigations unfold.

Background

On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests.  This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].

A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].

Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from  the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].

Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain  avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.

Darktrace Detections

Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:

Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation.  Associated Darktrace models include:

  • Compromise / Possible Tunnelling to Bin Services

Suspicious executable file downloads. Associated Darktrace models include:

  • Anomalous File / EXE from Rare External Location

Outbound beaconing to rare domains. Associated Darktrace models include:

  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Compromise / Sustained TCP Beaconing Activity To Rare Endpoint
  • Compromise / Beacon to Young Endpoint
  • Anomalous Server Activity / Rare External from Server
  • Compromise / SSL Beaconing to Rare Destination

Unusual cryptocurrency mining activity. Associated Darktrace models include:

  • Compromise / Monero Mining
  • Compromise / High Priority Crypto Currency Mining

And model alerts for:

  • Compromise / Rare Domain Pointing to Internal IP

IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.  

Appendices

Potential indicators of post-exploitation behavior:

·      217.76.57[.]78 – IP address - Likely C2 server

·      hXXp://217.76.57[.]78:8009/index.js - URL -  Likely payload

·      b6a15e1f2f3e1f651a5ad4a18ce39d411d385ac7  - SHA1 - Likely payload

·      195.154.119[.]194 – IP address – Likely C2 server

·      hXXp://195.154.119[.]194/index.js - URL – Likely payload

·      avg.domaininfo[.]top – Hostname – Likely C2 server

·      104.234.174[.]5 – IP address - Possible C2 server

·      35da45aeca4701764eb49185b11ef23432f7162a – SHA1 – Possible payload

·      hXXp://134.122.13[.]34:8979/c - URL – Possible payload

·      134.122.13[.]34 – IP address – Possible C2 server

·      28df16894a6732919c650cc5a3de94e434a81d80 - SHA1 - Possible payload

References:

1.        https://nvd.nist.gov/vuln/detail/CVE-2026-1731

2.        https://www.securityweek.com/beyondtrust-vulnerability-targeted-by-hackers-within-24-hours-of-poc-release/

3.        https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/

Continue reading
About the author
Emma Foulger
Global Threat Research Operations Lead
Your data. Our AI.
Elevate your network security with Darktrace AI