July 30, 2025

Darktrace's Cyber AI Analyst in Action: 4 Real-World Investigations into Advanced Threat Actors

As AI reshapes the cybersecurity landscape, Darktrace’s Cyber AI Analyst automates early-stage investigations, mimicking human reasoning to detect and respond to threats at machine speed. This blog explores four real-world cases where it identified sophisticated threat actors, including nation-state adversaries.

Written by

Nathaniel Jones

SVP, Global Threat Intelligence

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Nathaniel Jones

SVP, Global Threat Intelligence

Man looking at computer doing work, cybersecurity, AI, AI analyst

Jul 2025

From automation to intelligence

There’s a lot of attention around AI in cybersecurity right now, similar to how important automation felt about 15 years ago. But this time, the scale and speed of change feel different.

In the context of cybersecurity investigations, the application of AI can significantly enhance an organization's ability to detect, respond to, and recover from incidents. It enables a more proactive approach to cybersecurity, ensuring a swift and effective response to potential threats.

At Darktrace, we’ve learned that no single AI technique can solve cybersecurity on its own. We employ a multi-layered AI approach, strategically integrating a diverse set of techniques both sequentially and hierarchically. This layered architecture allows us to deliver proactive, adaptive defense tailored to each organization’s unique environment.

Darktrace uses a range of AI techniques to perform in-depth analysis and investigation of anomalies identified by lower-level alerts, in particular automating Levels 1 and 2 of the Security Operations Centre (SOC) team’s workflow. This saves teams time and resources by automating repetitive and time-consuming tasks carried out during investigation workflows. We call this core capability Cyber AI Analyst.

How Darktrace’s Cyber AI^TMAnalyst works

Cyber AI Analyst mimics the way a human carries out a threat investigation: evaluating multiple hypotheses, analyzing logs for involved assets, and correlating findings across multiple domains. It will then generate an alert with full technical details, pulling relevant findings into a single pane of glass to track the entire attack chain.

Learn more about how Cyber AI Analyst accomplishes this here:

This blog will highlight four examples where Darktrace’s agentic AI, Cyber AI Analyst, successfully identified the activity of sophisticated threat actors, including nation state adversaries. The final example will include step-by-step details of the investigations conducted by Cyber AI Analyst.

[related-resource]

Case 1: Cyber AI Analyst vs. ShadowPad Malware: East Asian Advanced Persistent Threat (APT)

In March 2025, Darktrace detailed a lengthy investigation into two separate threads of likely state-linked intrusion activity in a customer network, showcasing Cyber AI Analyst’s ability to identify different activity threads and piece them together.

The first of these threads...

‍occurred in July 2024 and involved a malicious actor establishing a foothold in the customer’s virtual private network (VPN) environment, likely via the exploitation of an information disclosure vulnerability (CVE-2024-24919) affecting Check Point Security Gateway devices.

Using compromised service account credentials, the actor then moved laterally across the network via RDP and SMB, with files related to the modular backdoor ShadowPad being delivered to targeted internal systems. Targeted systems went on to communicate with a C2 server via both HTTPS connections and DNS tunnelling.

The second thread of activity...

Which occurred several months earlier in October 2024, involved a malicious actor infiltrating the customer's desktop environment via SMB and WMI.

The actor used these compromised desktops to discriminately collect sensitive data from a network share before exfiltrating such data to a web of likely compromised websites.

For each of these threads of activity, Cyber AI Analyst was able to identify and piece together the relevant intrusion steps by hypothesizing, analyzing, and then generating a singular view of the full attack chain.

Figure 1: Cyber AI Analyst identifying and piecing together the various steps of the ShadowPad intrusion activity.

Figure 2: Cyber AI Analyst Incident identifying and piecing together the various steps of the data theft activity.

These Cyber AI Analyst investigations enabled a quicker understanding of the threat actor’s sequence of events and, in some cases, led to faster containment.

Read the full detailed blog on Darktrace’s ShadowPad investigation here!

Case 2: Cyber AI Analyst vs. Blind Eagle: South American APT

Since 2018, APT-C-36, also known as Blind Eagle, has been observed performing cyber-attacks targeting various sectors across multiple countries in Latin America, with a particular focus on Colombia.

In February 2025, Cyber AI Analyst provided strong coverage of a Blind Eagle intrusion targeting a South America-based public transport provider, identifying and correlating various stages of the attack, including tooling.

Figure 3: Cyber AI Analyst investigation linking likely Remcos C2 traffic, a suspicious file download, and eventual data exfiltration.Type image caption here (optional)

Figure 4: Cyber AI Analyst identifying unusual data uploads to another likely Remcos C2 endpoint and correlated each of the individual detections involved in this compromise, identifying them as part of a broader incident that encompassed C2 connectivity, suspicious downloads, and external data transfers.

In this campaign, threat actors have been observed using phishing emails to deliver malicious URL links to targeted recipients, similar to the way threat actors have previously been observed exploiting CVE-2024-43451, a vulnerability in Microsoft Windows that allows the disclosure of a user’s NTLMv2 password hash upon minimal interaction with a malicious file [4].

In late February 2025, Darktrace observed activity assessed with medium confidence to be associated with Blind Eagle on the network of a customer in Colombia. Darktrace observed a device on the customer’s network being directed over HTTP to a rare external IP, namely 62[.]60[.]226[.]112, which had never previously been seen in this customer’s environment and was geolocated in Germany.

Read the full Blind Eagle threat story here!

Case 3: Cyber AI Analyst vs. Ransomware Gang

In mid-March 2025, a malicious actor gained access to a customer’s network through their VPN. Using the credential 'tfsservice', the actor conducted network reconnaissance, before leveraging the Zerologon vulnerability and the Directory Replication Service to obtain credentials for the high-privilege accounts, ‘_svc_generic’ and ‘administrator’.

The actor then abused these account credentials to pivot over RDP to internal servers, such as DCs. Targeted systems showed signs of using various tools, including the remote monitoring and management (RMM) tool AnyDesk, the proxy tool SystemBC, the data compression tool WinRAR, and the data transfer tool WinSCP.

The actor finally collected and exfiltrated several gigabytes of data to the cloud storage services, MEGA, Backblaze, and LimeWire, before returning to attempt ransomware detonation.

Figure 5: Cyber AI Analyst detailing its full investigation, linking 34 related Incident Events in a single pane of glass.

Cyber AI Analyst identified, analyzed, and reported on all corners of this attack, resulting in a threat tray made up of 34 Incident Events into a singular view of the attack chain.

Cyber AI Analyst identified activity associated with the following tactics across the MITRE attack chain:

Initial Access
Persistence
Privilege Escalation
Credential Access
Discovery
Lateral Movement
Execution
Command and Control
Exfiltration

Case 4: Cyber AI Analyst vs Ransomhub

Cyber AI Analyst presenting its full investigation into RansomHub, correlating 38 Incident Events. — Figure 6: Cyber AI Analyst presenting its full investigation into RansomHub, correlating **38 Incident Events**.

A malicious actor appeared to have entered the customer’s network their VPN, using a likely attacker-controlled device named 'DESKTOP-QIDRDSI'. The actor then pivoted to other systems via RDP and distributed payloads over SMB.

Some systems targeted by the attacker went on to exfiltrate data to the likely ReliableSite Bare Metal server, 104.194.10[.]170, via HTTP POSTs over port 5000. Others executed RansomHub ransomware, as evidenced by their SMB-based distribution of ransom notes named 'README_b2a830.txt' and their addition of the extension '.b2a830' to the names of files in network shares.

Through its live investigation of this attack, Cyber AI Analyst created and reported on 38 Incident Events that formed part of a single, wider incident, providing a full picture of the threat actor’s behavior and tactics, techniques, and procedures (TTPs). It identified activity associated with the following tactics across the MITRE attack chain:

Execution
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact (i.e., encryption)

Figure 7: Step-by-step details of one of the network scanning investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace.

Figure 8: Step-by-step details of one of the administrative connectivity investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace.

Step-by-step details of one of the external data transfer investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace. Step-by-step details of one of the external data transfer investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace. — Figure 9: Step-by-step details of one of the external data transfer investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace.

Figure 10: Step-by-step details of one of the data collection and exfiltration investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace.

Figure 11: Step-by-step details of one of the ransomware encryption investigations performed by Cyber AI Analyst in response to an anomaly alerted by Darktrace.

Conclusion

Security teams are challenged to keep up with a rapidly evolving cyber-threat landscape, now powered by AI in the hands of attackers, alongside the growing scope and complexity of digital infrastructure across the enterprise.

Traditional security methods, even those that use some simple machine learning, are no longer sufficient, as these tools cannot keep pace with all possible attack vectors or respond quickly enough machine-speed attacks, given their complexity compared to known and expected patterns. Security teams require a step up in their detection capabilities, leveraging machine learning to understand the environment, filter out the noise, and take action where threats are identified. This is where Cyber AI Analyst steps in to help.

Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISO), Sam Lister (Security Researcher), Emma Foulger (Global Threat Research Operations Lead), and Ryan Traill (Analyst Content Lead)

[related-resource]

Learn more about Cyber AI Analyst

Discover how Cyber AI Analyst boosts SOC efficiency with faster threat triage, investigation, and response.

Download Now

Written by

Nathaniel Jones

SVP, Global Threat Intelligence

Inside the SOC

Written by

Nathaniel Jones

SVP, Global Threat Intelligence

•

October 21, 2026

Tara Gould

Malware Research Lead

Senior Product Executive

Watch the NIS2 Webinar

Blog

OT

October 21, 2026

Beyond the Fridge: Exposed Industrial Control Systems

Introduction

In October 2026, hundreds of supermarkets across France were reportedly affected by a cyberattack targeting their refrigeration systems. According to public reports, the attackers gained access to internet-connected controllers and modified their settings, forcing refrigeration units into high and extremely low temperatures and causing significant disruption. Total losses have been reported to reach several million euros.

The incident drew attention to the security of industrial refrigeration systems, particularly older devices with exposed management interfaces and known vulnerabilities.

The exact details of how the attackers gained access have not been confirmed, however it is speculated that the public-facing web server could be accessed with the username “admin” and password being the current date. Researchers from Claroty’s Team82 identified a vulnerability in Danfoss AK-SM 8xxA Series in 2025, “CVE-2025-41450", allowing for administrative access using a time-based “code-of-the-day" for authentication [1].

Default credentials, outdated firmware and publicly accessible administrative interfaces have been an issue for years. And yet these systems continue to appear in internet scans and require little sophistication to gain admin access. A simple search of internet-connected devices shows a range of exposed devices from Programmable Logic Controllers (PLCs) and remote gateways, to, yes, more fridges.

Darktrace malware researchers identified hundreds of IoT and OT devices publicly exposed on the internet, many of which are configured with no authentication, weak credentials, or default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability to remotely control connected devices.

‍

Figure 1: Copeland XWEB interface used to control systems including refrigerators and air conditioning.

However, it’s not only fridges; web management interfaces for industrial controls are also publicly accessible, often protected only by weak credentials. Figure 2 shows an example of a publicly exposed WAGO interface. The WAGO management interface is a configuration and administration panel for controllers. Through it, a logged-in user can view device details and diagnostics, manage user accounts and passwords, update firmware, back up or restore the full configuration, set the clock, and manage SD card storage. While it typically doesn’t manage switch outputs or read live process values, someone with access could still disrupt operation by changing network or Modbus settings, loading bad firmware or configurations, or by resetting passwords and enabling insecure services.

‍

‍

The issue extends beyond management interfaces. During our research, we identified publicly accessible web interfaces belonging to PLCs, including Rockwell Automation Allen-Bradley devices. In each case, the risk arises from how the devices have been deployed and configured, not from a flaw in the vendors’ products.

‍

Figure 3: Web interface for Allen-Bradley CompactLogix controller.

‍

Figure 3 shows the web interface of an Allen-Bradley CompactLogix controller. Unlike the previous examples, this interface provides a view into the controller's operation, including running tasks, network connections, memory usage and diagnostic information. Rockwell Automation's CompactLogix controllers are commonly used to automate industrial processes, from manufacturing and packaging lines to water treatment and material handling systems. Depending on their configuration, these controllers can operate motors, pumps, valves and other physical equipment.

Although in this example the interface shown does not provide direct control over the PLC's logic, it exposes information about the model, firmware, network layout, and connections, which is useful reconnaissance for a bigger attack.

The concern is not necessarily that every exposed interface allows an attacker to immediately manipulate industrial processes. However, these devices are accessible from the public internet in the first place, providing information about systems that may be responsible for controlling physical equipment.

The attacks on refrigeration systems in France highlight the consequences of poorly secured industrial devices. As demonstrated throughout this research, publicly accessible management interfaces are not limited to refrigeration controllers but extend to PLCs and other systems used to manage industrial equipment.

Finding these devices requires little effort. Internet scanners make it possible to identify publicly exposed interfaces quickly, and in some cases these interfaces rely on publicly documented default credentials or have no authentication at all. As attackers increasingly use AI tools, such attacks may be identified and carried out faster and at a greater scale.

The consequences of this access depend on the device and the functionality exposed. While some interfaces provide little more than diagnostic information, others allow users to modify configurations, disrupt communications, or change settings that affect physical equipment. In industrial environments, this can result in operational downtime, damaged equipment and financial losses.

Weak passwords, default credentials and exposed administrative interfaces are not new security issues. Yet their continued presence on internet-connected industrial systems demonstrates how easily preventable weaknesses can leave physical operations vulnerable to attack.

Exposed devices often come from third-party suppliers and contractors, who frequently install refrigeration controllers, gateways and PLCs without the organization ever being aware they are connected to the internet. Asset visibility remains an important foundation, but organizations should assume that some unknown assets and services will exist. Effective security therefore also depends on continuous monitoring, anomaly detection, network segmentation and rapid response, so that risky exposure and unusual activity can be identified and addressed before it becomes disruptive.

Darktrace helps security teams gain visibility across IT and OT and respond to risks: https://www.darktrace.com/products/operational-technology.

Copeland, Dixell, WAGO, Rockwell Automation, Allen-Bradley and CompactLogix are trademarks of their respective owners. Their use here is for identification only and does not imply any affiliation with or endorsement by those owners.

References

1. https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

‍

About the author

Tara Gould

Malware Research Lead

Blog

Network

October 20, 2026

Why Kubernetes Security Needs A Behavioral Approach

Kubernetes has become a foundational technology for modern cloud-native infrastructure. It can orchestrate everything from customer-facing applications to data pipelines and, increasingly, AI workloads. This is due to the highly scalable nature of Kubernetes, making it cost efficient and reliable.

Gartner projects that by 2028, 95% of new AI deployments will run on Kubernetes, up from less than 30% today¹. However, the same qualities that make Kubernetes powerful also make it uniquely challenging to secure, leaving many organizations with limited visibility into their clusters. This lack of visibility increases risk - it’s difficult to secure what you can’t see.

However, this risk is often looked at as purely a posture management challenge. While Cloud Security Posture Management (CSPM) solutions can tell you how a cluster should be configured, they don’t tell you what it is doing in real time. This requires runtime behavioral monitoring of clusters to detect active threats.

Yet existing approaches to securing Kubernetes by most Cloud Detection and Response (CDR) and Network Detection and Response (NDR) vendors often have limited coverage or require a third-party integration to forward traffic and metadata. This means that capabilities can be limited and detections can lack the context of the wider environment, which slows down triage, investigation and response.

Why Kubernetes is hard to secure

Traditional security tooling was built for persistent, long-term infrastructure such as servers and virtual machines with fixed identities that last months or years. Some elements of Kubernetes environments can have a much shorter lifespan, breaking many assumptions those tools rely on:

Increased complexity
1. Kubernetes environments can be complex in comparison to traditional infrastructure, with many different elements to consider such as nodes, clusters, containers, pods and the workloads themselves.
Ephemeral by design
1. Kubernetes pods can spin up and terminate in seconds. A container that was compromised may no longer exist by the time a deeper investigation is required, leaving no artifact to analyze. This poses a unique challenge for security operations.
Weaker workload boundaries
1. Kubernetes containers use lightweight, shared-kernel isolation rather than separate virtual machines, improving efficiency but reducing separation between workloads and the host. As a result, a compromised container may have a greater potential impact on the node and neighboring workloads than a compromised virtual machine (VM).²
2. Recent vulnerabilities have shown that threat actors can escape a container and gain access to the underlying host.^{3, 4}
Everything is API-driven
1. Dozens or hundreds of microservices communicate over internal APIs, and the Kubernetes control plane itself is an API. This creates a large and dynamic attack surface, making it difficult to distinguish legitimate activity from malicious behavior.
2. Without identity-aware runtime visibility, threat actors can move laterally between pods and exploit misconfigured role-based access controls (RBAC) with little chance of detection.

Rising to the challenge of securing Kubernetes

With the release of Darktrace 7.2, Darktrace / HYBRID NETWORK can extend behavioral security into Kubernetes, delivering visibility, detection and response capabilities across runtime activity. Darktrace addresses the challenges of securing Kubernetes environments in several ways.

Behavioral detection, not static rules

Many Kubernetes runtime tools rely on predefined rules and signatures - a fixed list of “bad” behaviors to match against. That approach struggles with novel attacks and generates noise at scale. Darktrace takes a different approach: our Adaptive AI builds a Unique Behavioral Profile for each organization from the ground up, learning the normal behavior of every workload, node and identity in your cluster. It then uses this understanding to detect meaningful deviations from expected behavior, which serves as the basis for surfacing suspicious and malicious activity.

A pod reaching out to an unfamiliar destination, an unexpected executable launching inside a workload, or an identity performing an action it has never performed, all surface as anomalies without anyone having to write a rule in advance.

Darktrace surfaces unexpected Kubernetes activity that does not align with an organization’s Unique Behavioral Profile

‍

Visibility across the network, the process, and the control plane

Darktrace monitors Kubernetes at three levels that together provide comprehensive runtime visibility:

Network-layer
1. Traffic between pods, across nodes and out to the internet. This helps to detect lateral movement and unusual connectivity, whether internal or external.
Process-layer
1. What is executing inside your containers. If a process reads a sensitive credential file or spawns an unexpected shell inside a production pod, Darktrace can identify that activity and use it as context for further detections.
Control plane
1. Activity against the Kubernetes API itself: someone executes a command in a running pod, RBAC changes, or unusual administrative actions. Many high-impact security events involve the control plane, an area that is often less visible to solutions that only analyze or scan network-layer telemetry.

Misconfiguration and vulnerability awareness

Runtime detection is strongest when combined with posture and exposure management. Darktrace surfaces risky pod configurations, such as privileged containers, host networking, and over-permissive service accounts as workloads are deployed, and links CVEs from images to the workloads running them. Security teams can go beyond simply knowing that a vulnerability exists and see exactly where it is in the cluster. When combined with behavior-based detections, this provides invaluable context that can help prioritize incidents and proactively identify areas that need further attention. For example, anomalous workload behavior on its own might not be very interesting to a security team at first, but if that same workload is known to host sensitive data, is known to have critical vulnerabilities associated with it, or is publicly accessible, then this narrative becomes much more suspicious and demanding of their attention.

Darktrace highlights Kubernetes misconfigurations such as privileged containers, host networking, and missing security controls, helping teams prioritize runtime alerts with valuable exposure and risk context

‍

Response, tailored to Kubernetes

Detection is most effective when paired with response. Darktrace can take precise actions on Kubernetes workloads, including blocking a malicious connection at the pod level, helping to safely contain threats while security teams investigate. Response actions can be taken fully autonomously or via a human-in-the-loop process, which is completely configurable depending on the desired level of autonomy and scope. Darktrace is expanding the number of Kubernetes-native response actions to give customers even more flexibility when containing threats.

Forensics that survive the workload

Because containers are so short-lived, evidence disappears fast and this can make it very difficult to answer questions related to the initial detections. Darktrace solves this with Forensic Acquisition & Investigation capabilities that extend to Kubernetes containers, allowing investigations to be triggered manually by an analyst, or automatically from an alert, preserving evidence before the workload is gone.

For incident responders, this addresses a key challenge in container security: being able to answer “what actually happened?” after an ephemeral workload has vanished.

One platform, not another silo

Kubernetes doesn't exist in isolation, and neither should its security. Darktrace correlates cluster activity with the surrounding cloud environment, including AWS, Azure and GCP identities, network activity and cloud assets, allowing analysts to pivot between a Kubernetes workload and its wider context. A single anomalous action can be traced from the control plane to the pod, and from the pod to the cloud identity behind it, all within a single investigation workflow. This can also include alerts from other areas of hybrid infrastructure or third-party sources where relevant, adding more context to investigations and speeding up workflows for human analysts.

Built to deploy easily

Operational complexity can be a barrier to security adoption. Darktrace / HYBRID NETWORK for Kubernetes installs with a single command, and for teams that manage their infrastructure as code, it supports raw manifests so the deployment can live in a Git repository and be managed through existing GitOps workflows. The same deployment approach works across Kubernetes environments in AWS, Azure, Google Cloud, and on-premises infrastructure. Early adopters of Darktrace’s Kubernetes capabilities have highlighted the simplicity of deployment and time to value.

Darktrace can deploy across your Kubernetes environment and wider hybrid infrastructure, while also providing visibility into Kubernetes deployment structure and status

Next steps

Kubernetes environments are dynamic, ephemeral and API-driven in ways that challenge traditional security tooling. With Kubernetes usage increasing due to widespread AI adoption, it is essential to secure Kubernetes environments as part of securing what AI can do. Darktrace / HYBRID NETWORK addresses these challenges by learning normal behavior in Kubernetes environments across network, process and control-plane layers, identifying meaningful threats and enabling targeted response. Combined with the context of wider hybrid infrastructure and forensic investigation capabilities, Darktrace provides visibility into both emerging threats and active incidents.

To see how Darktrace can help secure your Kubernetes environment and your wider hybrid infrastructure, get in touch to arrange your free trial. Existing customers can contact their Darktrace Account Team for more information about deployment options and licensing.

‍

Sources

[1] Gartner, Container Management research, 2025: "By 2028, 95% of new AI deployments will use Kubernetes, up from less than 30% today." https://www.gartner.com/en/documents/7913109. (quote reproduced under Gartner reprint at https://www.kubermatic.com/magic-quadrant-and-critical-capabilities-for-container-management/)

[2] Palo Alto Networks (Unit 42) – Container Breakouts: Escape Techniques in Cloud Environments. https://unit42.paloaltonetworks.com/container-escape-techniques/

[3] runC container-escape vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881), disclosed by a SUSE researcher on November 5, 2025. https://www.securityweek.com/runc-vulnerabilities-can-be-exploited-to-escape-containers/

[4] NVIDIAScape (CVE-2025-23266), CVSS 9.0. https://nvidia.custhelp.com/app/answers/detail/a_id/5659

[related-resource]

‍

About the author

Elise Longhurst

Senior Product Executive

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: AI Analyst in Action: 4 Real-World Investigations using AI Investigations

Darktrace's Cyber AI Analyst in Action: 4 Real-World Investigations into Advanced Threat Actors

From automation to intelligence

How Darktrace’s Cyber AITM Analyst works

Case 1: Cyber AI Analyst vs. ShadowPad Malware: East Asian Advanced Persistent Threat (APT)

The first of these threads...

The second thread of activity...

Case 2: Cyber AI Analyst vs. Blind Eagle: South American APT

Case 3: Cyber AI Analyst vs. Ransomware Gang

Case 4: Cyber AI Analyst vs Ransomhub

Conclusion

Learn more about Cyber AI Analyst

Beyond the Fridge: Exposed Industrial Control Systems

Why Kubernetes Security Needs A Behavioral Approach

Enjoying the blog?

More in this series

AI-Assisted Attacks Still Leave a Behavioral Trace

Detecting Rogue Agent Behavior in the Enterprise

Agent Hijacks: Hijacking Agentic Harnesses to Attack an Organization

Blog

OT

October 21, 2026

Beyond the Fridge: Exposed Industrial Control Systems

Introduction

References

Blog

Network

October 20, 2026

Why Kubernetes Security Needs A Behavioral Approach

Why Kubernetes is hard to secure

Rising to the challenge of securing Kubernetes

Behavioral detection, not static rules

Visibility across the network, the process, and the control plane

Misconfiguration and vulnerability awareness

Response, tailored to Kubernetes

Forensics that survive the workload

One platform, not another silo

Built to deploy easily

Next steps

How Darktrace’s Cyber AI^TMAnalyst works