Blog
/
OT
/
January 9, 2024

Three Ways AI Secures OT & ICS from Cyber Attacks

Explore the three challenges facing industries that manage OT and ICS Systems, the benefits of adopting AI technology, and Darktrace / OT’s unique role!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Oakley Cox
Director of Product
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Jan 2024

What is OT and ICS?

Operational technologies and industrial control systems are the networked technologies used for the automation of physical processes. These are the technologies that allow operators to control processes and retrieve real time process data from a factory, rail system, pipeline, and other industrial processes.  

The role of AI in defending OT/ICS networks  

While largely adopted by industrial organizations, OT is utilized by Critical Infrastructures, these being the industries that directly affect the health, safety, and welfare of the public. As these organizations expand and adopt new networked industrial technologies, they are simultaneously expanding their attack surface.  

With a larger attack surface, more attacks targeting OT/ICS, and focused coordination around cyber security from regulatory authorities, security personnel have increasing workloads that make it difficult to keep pace with threats and vulnerabilities. Defenders are managing growing attack surfaces due to IT and OT convergence. Thus, the adoption of AI technology to protect, detect, respond, and recover from cyber incidents in industrial systems is paramount for keeping critical infrastructure safe.

This blog will explore three challenges facing industries managing OT/ICS, the perceived benefits of adopting AI technology to address these challenges, and Darktrace/OT’s unique role in this process.  

Darktrace also delivers complete AI-powered solutions to defend US federal government customers from cyber disruptions and ensure mission resilience. Learn more about high fidelity detection in Darktrace Federal’s TAC report.

Figure 1: AI statistics from Gartner and Deloitte

Three ways AI helps improves OT/ICS security  

1. Anomaly detection and response

In this heightened security landscape, OT/ICS environments face a spectrum of external cyber threats that demand vigilant defense. From the looming risk of industrial ransomware to the threat of insiders, yet another dimension is added to security challenge, meaning security professionals must be equipped to detect and respond to internal and external threats.  

While threats are eminent from both inside and outside the organization, many organizations rely on Indicator of Compromises (IOCs) for threat detection. By definition, these solutions can only detect network activity they recognize as an indicator of compromise; therefore, often miss insider threats and novel (zero-day) attacks because the tactics, techniques, and procedures (TTPs) and attack toolkits have never been seen in practice.  

Anomaly-based detection is best suited to combat never-before-seen threats and signatureless threats from the inside. However, not all detection methods are equal. Most anomaly-based detection solutions that leverage AI rely on a combination of supervised machine learning, deep learning, and transformers to train and inform their systems. This entails shipping your company’s data out to a large data lake housed somewhere in the cloud where it gets blended with attack data from thousands of other organizations. This data set gets used to train AI systems — yours and everyone else’s — to recognize patterns of attack based on previously encountered threats.  

While this method reduces the workload for security teams who would have to input attack data otherwise manually, it runs the same risk of only detecting known threats and has potential privacy concerns when shipping this data externally.  

To improve the quality and speed of anomaly detection, Darktrace/OT uses Self-Learning AI that leverages Bayesian Probabilistic Methodologies, Graph Theory, and Deep Neural Networks to learn your organization from the ground up in real time. By learning your unique organization, Darktrace/OT develops a sophisticated baseline knowledge of your network and assets, identifying abnormal activity that indicates a threat based on your unique network data at machine speed. Because the AI engine is local to the organization and/or assets, concerns of data residency and privacy are reduced, and the result is faster time to detect and triage incidents.  

Leveraging Self-Learning AI, Darktrace/OT uses autonomous response that severs only the anomalous or risky behaviors allowing the assets to continue to operate as normal. Organizations work with Darktrace to customize how they want Darktrace’s autonomous response to be applied. These options vary from on a device- by-device basis, device type by device type, or subnet by subnet basis and can be done completely autonomously or in human confirmation mode. This gives security teams more time to respond to an incident and reduces operational downtime when facing a threat.  

Darktrace leverages a combination of AI methods:

  • Self-Learning AI
  • Bayesian classification probabilistic models  
  • Deep neural networks
  • Transformers
  • Graph theory models
  • Clustering models  
  • Anomaly detection models
  • Generative and applied AI  
  • Natural language processing  
  • Supervised machine learning for investigation process of alerts

2. Vulnerability & Asset Management

At present, managing OT cyber risk is labor and resource intensive. Many organizations use third-party auditors to identify assets and vulnerabilities, grade compliance, and recommend improvements.  

At best, these exercises become tick-box exercises for companies to stay in compliance with little measurable reduction in cyber risk. At worst, asset owners can be left with a mountain of vulnerability information to work through, much of it irrelevant to the security risks Engineering and Operations teams deal with day to day, and increasingly out of date each passing day after the annual or biannual audit has been completed.  

In both cases, organizations are left using a patchwork of point products to address different aspects of preventative OT cyber security, most of which lack wider business context and lead to costly inefficiencies with no real impact to vulnerability or risk exposure.  

Darktrace’s technology helps in three unique ways:

  1. AI populates asset inventories: Self-Learning AI technology listens and learns from network traffic to populate or update asset inventories. It does this not just by identifying simple IPs, mac addresses, and hostnames, it learns from what it sees and automatically classifies or tags specific types of assets with the function that they perform. For example, if a specific device is performing functions like a PLC, sending commands to and from an HMI, it can appropriately tag and label these systems.
  2. AI prioritizes risk: Leveraging Bayesian Probabilistic Methodologies, Graph Theory, and Deep Neural Networks, Darktrace/OT assesses the strategic risks facing your organization in real time. Using knowledge of data points on all your networked assets, data flow topology, your assets vulnerabilities and OSINT, Darktrace identifies and prioritizes high-value assets, potential attack pathways based on an existing vulnerabilities targetability and impact.
  3. AI explains remediation tactics: Many OT devices run 24/7 operations and cannot be taken offline to apply a patch, assuming a patch is even available. Darktrace/OT uses natural language processing to provide and explain prioritized remediation and mitigation associated with a given cyber risk across all MITRE ATT&CK techniques. Thus, where a CVE exists but a patch cannot be applied, a different technical mitigation can be recommended to remove a potential attack path before it can be exploited, preemptively securing vital internal systems and assets.
Figure 2: A critical attack path which starts with the compromise of a PC in the internal IT network, and ends with a PLC in the OT network. Each step is mapped out to the real world TTPs including abuse of SSH sessions and the modifications of ICS programs

3. Simplify compliance and reporting

Organizations, regardless of size or resources, have compliance regulations they need to adhere to. What this creates is an increased workload for security professionals. For smaller organizations, security teams might lack the manpower or resources to report in the short time frame that is required. For large organizations, keeping track of a massive amount of assets proves to be a challenge. Both cases emanate the risk of reporting fatigue where organizations might be hesitant to report incidents due to the complexity and time requirements they demand.  

An AI engine within the Darktrace/OT platform, Cyber AI analyst autonomously investigates incidents, summarize findings in natural language, and provides comprehensive insights into the nature and scope of cyber threats to improve the time it takes to triage and report on incidents. The ability to stitch together and present related security events provides a holistic understanding of the incident, enabling security analysts to identify patterns, assess the scope of potential threats, and prioritize responses effectively.  

Darktrace's detection capabilities identify every stage of an intrusion, from a compromised domain controller to network reconnaissance and privilege escalation. The AI technology is capable of detecting infections across several devices and generating incident reports that piece together disparate events to give a clear security narrative containing details of the attack, bridging the communication gap between IT and OT specialists.  

Post-incident, the technology assists in outlining timelines, discerning compromised data, pinpointing unusual activities, and aiding security teams in proactive threat mitigation.  

With its capabilities, organizations can swiftly understand the attack timeline, affected assets, unauthorized accesses, compromised data points, and malicious interactions, facilitating appropriate communication and action. For example, when Cyber AI Analyst shows an attack path, the security team gains insight on the segmentation or lack thereof between two subnets allowing the security team to appropriately segment the subnets.  

Cyber AI improves critical infrastructure operators’ ability to report major cyber-attacks to regulatory authorities. Considering that 72 hours is the reporting period for most significant incidents — and 24 hours for ransomware payments — Cyber AI Analyst is no longer a nice-to-have but a must-have for critical infrastructure.

Figure 3: The tabs labeled 1-4 denote model breaches, each with a specific action and severity indicated by color dots. Darktrace integrates these breaches, offering the security team a unified view of interconnected security events.  

The right AI for the right challenge

Incident Phase:

Protect

Role of AI:

Cyber risk prioritization

Attack path modelling

Compliance reporting

Darktrace Product:

PREVENT/OT

Incident Phase:

Detect

Role of AI:

Anomaly detection

Triaging and investigating

Darktrace Product:

Cyber AI analyst

DETECT/OT

Incident Phase:

Respond

Role of AI: 

Autonomous response  

Incident reporting

Darktrace Product:

RESPOND/OT

Incident Phase:

Recover

Role of AI:

Incident preparedness

Incident simulations

Darktrace Product:

HEAL

Credit to: Nicole Carignan, VP of Strategic Cyber AI - Kendra Gonzalez Duran, Director of Technology Innovation - & Daniel Simonds, Director of Operational Technology for their contribution to this blog.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Oakley Cox
Director of Product

More in this series

No items found.

Blog

/

Email

/

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Default blog imageDefault blog image

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

  • Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
  • Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

  • Faster investigations with consolidated visibility
  • Clear attribution of actions and outcomes across both platforms
  • Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

Continue reading
About the author
Carlos Gray
Senior Product Marketing Manager, Email

Blog

/

Network

/

June 18, 2025

Customer Case Study: Leading Petrochemical Manufacturer

Default blog imageDefault blog image

Headquartered in Saudi Arabia, this industry leading petrochemical manufacturer serves customers in more than 80 countries across diverse markets throughout Europe, Africa, Latin America, the Middle East, China, and Southeast Asia.

Cyber resiliency critical to growth strategy

This leading petrochemical manufacturer’s vision is to be one of the major global players in the production and marketing of designated petrochemicals and downstream products. The company aims to significantly increase its capacity to up to a million metric tons within the next few years.

With cyber-attacks on critical infrastructure increasing 30% globally last year, cyber resiliency is essential to supporting the company’s strategic business goals of:

  • Maximizing production through efficient asset utilization
  • Maximizing sales by conducting 90% of its business outside Saudi Arabia
  • Optimizing resources and processes by integrating with UN Global Compact principles for sustainability and efficiency
  • Growing its business portfolio by engaging in joint ventures to diversify production and add value to the economy

However, the industry leader faced several challenges in its drive to fortify its cybersecurity defenses.

Visibility gaps delay response time

The company’s existing security setup provided limited visibility to the in-house security team, hindering its ability to detect anomalous network and user activity in real time. This resulted in delayed responses to potential incidents, making proactive issue resolution difficult and any remediation in the event of a successful attack costly and time-consuming.

Manual detection drains resources

Without automated detection and response capabilities, the organization’s security team had to manually monitor for suspicious activity – a time-consuming and inefficient approach that strained resources and left the organization vulnerable. This made it difficult for the team to stay current with training or acquire new skills and certifications, which are core to the ethos of both the company’s owners and the team itself.

Cyber-attacks on critical infrastructure increasing

The petrochemical manufacturer is part of a broader ecosystem of companies, making the protection of its supply chain – both upstream and downstream – critical. With several manufacturing entities and multiple locations, the customer’s internal structure is complex and challenging to secure. As cyber-attacks on critical infrastructure escalate, it needed a more comprehensive approach to safeguard its business and the wider ecosystem.

Keeping and growing skills and focus in-house

To strengthen its cybersecurity strategy, the company considered two options:

  1. Make a significant initial and ongoing investment in a Security Operations Center (SOC), which would involve skills development outside the company and substantial management overhead.
  2. Use a combination of new, automated tools and an outsourced Managed Detection and Response (MDR) service to reduce the burden on internal security specialists and allow the company to invest in upskilling its staff so they can focus on more strategic tasks.

Faced with this choice between entirely outsourcing security and augmenting the security team with new capabilities, the customer chose the second option, selecting Darktrace to automate the company’s monitoring, detection, and response. Today, the petrochemical manufacturer is using:

Extending the SOC with 24/7 expert support

To alleviate the burden on its lean security team, the company augmented its in-house capabilities with Darktrace’s Managed Detection & Response service. This support acts as an extension of its SOC, providing 24/7 monitoring, investigation, and escalation of high-priority threats. With Darktrace’s global SOC managing alert triage and autonomously containing threats, the organization’s internal team can focus on strategic initiatives. The result is a stronger security posture and increased capacity to proactively address evolving cyber risks – without expanding headcount or sacrificing visibility.

A unique approach to AI

In its search for a new security platform, the company’s Director of Information Technology said Darktrace’s autonomous response capability, coupled with Self-Learning AI-driven threat reduction, were two big reasons for selecting Darktrace over competing products and services.

AI was a huge factor – no one else was doing what Darktrace was doing with [AI].”

Demonstrated visibility

Before Darktrace, the customer had no visibility into the network activity to and from remote worker devices. Some employees need the ability to connect to its networks at any time and from any location, including the Director of Information Technology. The trial deployment of Darktrace / ENDPOINT was a success and gave the team peace of mind that, no matter the location or device, high-value remote workers were protected by Darktrace.

Modular architecture  

Darktrace's modular architecture allowed the company to deploy security controls across its complex, multi-entity environment. The company’s different locations run on segregated networks but are still interconnected and need to be protected. Darktrace / NETWORK provides a unified view and coordinated security response across the organization’s entire network infrastructure, including endpoint devices.

Results

The petrochemical manufacturer is using Darktrace across all of its locations and has achieved total visibility across network and user activity. “Darktrace is increasing in value every day,” said the Director of Information Technology.

I don’t have a big team, and Darktrace makes our lives very, very easy, not least the automation of some of the tasks that require constant manual review.”

Time savings frees analysts to focus on proactive security

Darktrace / NETWORK provides continuous, AI-driven monitoring and analysis of the company’s network activity, user behavior, and threat patterns, establishing a baseline of what normal activity looks like, and then alerting analysts to any deviations from normal traffic, activity, and behaviors. Darktrace’s autonomous response capabilities speed up response to detected threats, meaning intervention from the security team is required for fewer incidents and alerts.

In October 2024 alone, Darktrace Cyber AI Analyst saved the team 810 investigation hours, and autonomously responded to 180 anomalous behaviors that were uncovered during the investigations. With Darktrace managing the majority of threat detection and response efforts, the security team has been able to change its day-to-day activity from manual review of traffic and alerts and belated response to activity, to proactively fortifying its detection and response posture and upskilling to meet evolving requirements.  

Layered email protection reduces phishing threats

The company’s email infrastructure posed a challenge due to petrochemical industry regulations requiring on-premises email servers, with some security delivered via Microsoft Azure. By integrating Darktrace / EMAIL into the Azure stack, the organization has reduced the volume of phishing emails its users receive by 5%.

“Now we have one more layer of security related to email – every email goes through two filters. If something is not being caught or traced by Azure, it is being detected by Darktrace,” said the Director of Information Technology. “As a result, we’re now seeing only about 15% to 20% of the phishing emails we used to receive before implementing Darktrace.”

Preparing for a secure future

The time saved using Darktrace has helped the security team take proactive steps, including preparing for new cyber resilience regulations for Saudi Arabia’s Critical National Infrastructure, as mandated by the National Cybersecurity Authority (NCA).

“The team now has ample time to prepare policies and procedures that meet the new NCA regulations and, in some cases, enhance the requirements of the new law,” said the Director of Information Technology. “All of this is possible because they don’t need to keep watch; Darktrace takes on so much of that task for them.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI