January 31, 2024

How Darktrace Defeated SmokeLoader Malware

Read how Darktrace's AI identified and neutralized SmokeLoader malware. Gain insights into their proactive approach to cybersecurity.

Written by

Patrick Anjos

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Patrick Anjos

Senior Cyber Analyst

Jan 2024

What is Loader Malware?

Loader malware is a type of malicious software designed primarily to infiltrate a system and then download and execute additional malicious payloads.

In recent years, loader malware has emerged as a significant threat for organizations worldwide. This trend is expected to continue given the widespread availability of many loader strains within the Malware-as-a-Service (MaaS) marketplace. The MaaS marketplace contains a wide variety of innovative strains which are both affordable, with toolkits ranging from USD 400 to USD 1,650 [1], and continuously improving, aiming to avoid traditional detection mechanisms.

SmokeLoader is one such example of a MaaS strain that has been observed in the wild since 2011 and continues to pose a significant threat to organizations and their security teams.

How does SmokeLoader Malware work?

SmokeLoader’s ability to drop an array of different malware strains onto infected systems, from backdoors, ransomware, cryptominers, password stealers, point-of-sale malware and banking trojans, means its a highly versatile loader that has remained consistently popular among threat actors.

In addition to its versatility, it also exhibits advanced evasion strategies that make it difficult for traditional security solutions to detect and remove, and it is easily distributed via methods like spam emails or malicious file downloads.

Between July and August 2023, Darktrace observed an increasing trend in SmokeLoader compromises across its customer base. The anomaly-based threat detection capabilities of Darktrace, coupled with the autonomous response technology, identified and contained the SmokeLoader infections in their initial stages, preventing attackers from causing further disruption by deploying other malicious software or ransomware.

SmokeLoader Malware Attack Details

PROPagate Injection Technique

SmokeLoader utilizes the PROPagate code injection technique, a less common method that inserts malicious code into existing processes in order to appear legitimate and bypass traditional signature-based security measures [2] [3]. In the case of SmokeLoader, this technique exploits the Windows SetWindowsSubclass function, which is typically used to add or change the behavior of Windows Operation System. By manipulating this function, SmokeLoader can inject its code into other running processes, such as the Internet Explorer. This not only helps to disguise the malware's activity but also allows attackers to leverage the permissions and capabilities of the infected process.

Obfuscation Methods

SmokeLoader is known to employ several obfuscation techniques to evade the detection and analysis of security teams. The techniques include scrambling portable executable files, encrypting its malicious code, obfuscating API functions and packing, and are intended to make the malware’s code appear harmless or unremarkable to antivirus software. This allows attackers to slip past defenses and execute their malicious activities while remaining undetected.

Infection Vector and Communication

SmokeLoader typically spreads via phishing emails that employ social engineering tactics to convince users to unknowingly download malicious payloads and execute the malware. Once installed on target networks, SmokeLoader acts as a backdoor, allowing attackers to control infected systems and download further malicious payloads from command-and-control (C2) servers. SmokeLoader uses fast flux, a DNS technique utilized by botets whereby IP addresses associated with C2 domains are rapidly changed, making it difficult to trace the source of the attack. This technique also boosts the resilience of attack, as taking down one or two malicious IP addresses will not significantly impact the botnet's operation.

Continuous Evolution

As with many MaaS strains, SmokeLoader is continuously evolving, with its developers regularly adding new features and techniques to increase its effectiveness and evasiveness. This includes new obfuscation methods, injection techniques, and communication protocols. This constant evolution makes SmokeLoader a significant threat and underscores the importance of advanced threat detection and response capabilities solution.

Darktrace’s Coverage of SmokeLoader Attack

Between July and August 2023, Darktrace detected one particular SmokeLoader infection at multiple stages of its kill chain on a customer network. This detection was made possible by Darktrace DETECT’s anomaly-based approach and Self-Learning AI that allows it to identify subtle deviations in device behavior.

One of the key components of this process is the classification of endpoint rarity and determining whether an endpoint is new or unusual for any given network. This classification is applied to various aspects of observed endpoints, such as domains, IP addresses, or hostnames within the network. It thereby plays a vital role in identifying SmokeLoader activity, such as the initial infection vector or C2 communication, which typically involve a device contacting a malicious endpoint associated with SmokeLoader.

The First Signs of Infection SmokeLoader Infection

Beginning in July 2023, Darktrace observed a surge in suspicious activities that were assessed with moderate to high confidence to be associated with SmokeLoader malware.

For example on July 30, a device was observed making a successful HTTPS request to humman[.]art, a domain that had never been seen on the network, and therefore classified as 100% rare by DETECT. During this connection, the device in question received a total of 6.0 KiB of data from the unusual endpoint. Open-source intelligence (OSINT) sources reported with high confidence that this domain was associated with the SmokeLoader C2 botnet.

The device was then detected making an HTTP request to another 100% rare external IP, namely 85.208.139[.]35, using a new user agent. This request contained the URI ‘/DefenUpdate.exe’, suggesting a possible download of an executable (.exe) file. This was corroborated by the total amount of data received in this connection, 4.3 MB. Both the file name and its size suggest that the offending device may have downloaded additional malicious tooling from the SmokeLoader C2 endpoint, such as a trojan or information stealer, as reported on OSINT platforms [4].

Figure 1: Device event log showing the moment when a device made its first connection to a SmokeLoader associated domain, and the use of a new user agent. A few seconds later, the DETECT model “Anomalous Connection / New User Agent to IP Without Hostname” breached.

The observed new user agent, “Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko” was identified as suspicious by Darktrace leading to the “Anomalous Connection / New User Agent to IP Without Hostname” DETECT model breach.

As this specific user agent was associated with the Internet Explorer browser running on Windows 10, it may not have appeared suspicious to traditional security tools. However, Darktrace’s anomaly-based detection allows it to identify and mitigate emerging threats, even those that utilize sophisticated evasion techniques.

This is particularly noteworthy in this case because, as discussed earlier, SmokeLoader is known to inject its malicious code into legitimate processes, like Internet Explorer.

Figure 2: Darktrace detecting the affected device leveraging a new user agent and establishing an anomalous HTTP connection with an external IP, which was 100% rare to the network.

C2 Communication

Darktrace continued to observe the device making repeated connections to the humman[.]art endpoint. Over the next few days. On August 7, the device was observed making unusual POST requests to the endpoint using port 80, breaching the ‘Anomalous Connection / Multiple HTTP POSTs to Rare Hostname’ DETECT model. These observed POST requests were observed over a period of around 10 days and consisted of a pattern of 8 requests, each with a ten-minute interval.

Figure 3: Model Breach Event Log highlighting the Darktrace DETECT model breach ‘Anomalous Connection / Multiple HTTP POSTs to Rare Hostname’.

Upon investigating the details of this activity identified by Darktrace DETECT, a particular pattern was observed in these requests: they used the same user-agent, “Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko”, which was previously detected in the initial breach.

Additionally, they the requests had a constantly changing eferrer header, possibly using randomly generated domain names for each request. Further examination of the packet capture (PCAP) from these requests revealed that the payload in these POST requests contained an RC4 encrypted string, strongly indicating SmokeLoader C2 activity.

Figure4: Advanced Search results display an unusual pattern in the requests made by the device to the hostname humman[.]art. This pattern shows a constant change in the referrer header for each request, indicating anomalous behavior.

Figure 5: The PCAP shows the payload seen in these POST requests contained an RC4 encrypted string strongly indicating SmokeLoader C2 activity.

Unfortunately in this case, Darktrace RESPOND was not active on the network meaning that the attack was able to progress through its kill chain. Despite this, the timely alerts and detailed incident insights provided by Darktrace DETECT allowed the customer’s security team to begin their remediation process, implementing blocks on their firewall, thus preventing the SmokeLoader malware from continuing its communication with C2 infrastructure.

Darktrace RESPOND Halting Potential Threats from the Initial Stages of Detection

With Darktrace RESPOND, organizations can move beyond threat detection to proactive defense against emerging threats. RESPOND is designed to halt threats as soon as they are identified by DETECT, preventing them from escalating into full-blown compromises. This is achieved through advanced machine learning and Self-Learning AI that is able to understand the normal ‘pattern of life’ of customer networks, allowing for swift and accurate threat detection and response.

One pertinent example was seen on July 6, when Darktrace detected a separate SmokeLoader case on a customer network with RESPOND enabled in autonomous response mode. Darktrace DETECT initially identified a string of anomalous activity associated with the download of suspicious executable files, triggering the ‘Anomalous File / Multiple EXE from Rare External Locations’ model to breach.

The device was observed downloading an executable file (‘6523.exe’ and ‘/g.exe’) via HTTP over port 80. These downloads originated from endpoints that had never been seen within the customer’s environment, namely ‘hugersi[.]com’ and ‘45.66.230[.]164’, both of which had strongly been linked to SmokeLoader by OSINT sources, likely indicating the initial infection stage of the attack [5].

Figure 6: This figure illustrates Darktrace DETECT observing a device downloading multiple .exe files from rare endpoints and the associated model breach, ‘Anomalous File / Multiple EXE from Rare External Locations’.

Around the same time, Darktrace also observed the same device downloading an unusual file with a numeric file name. Threat actors often employ this tactic in order to avoid using file name patterns that could easily be recognized and blocked by traditional security measures; by frequently changing file names, malicious executables are more likely to remain undetected.

Figure 7: Graph showing the unusually high number of executable files downloaded by the device during the initial infection stage of the attack. The orange and red circles represent the number of model breaches that the device made during the observed activity related to SmokeLoader infection.

Figure 8: This figure illustrates the moment when Darktrace DETECT identified a suspicious download with a numeric file name.

With Darktrace RESPOND active and enabled in autonomous response mode, the SmokeLoader infection was thwarted in the first instance. RESPOND took swift autonomous action by blocking connections to the suspicious endpoints identified by DETECT, blocking all outgoing traffic, and enforcing a pre-established “pattern of life” on offending devices. By enforcing a patten of life on a device, Darktrace RESPOND ensures that it cannot deviate from its ‘normal’ activity to carry out potentially malicious activity, while allowing the device to continue expected business operations.

Figure 9: A total of 8 RESPOND actions were applied, including blocking connections to suspicious endpoints and domains associated with SmokeLoader.

In addition to the autonomous mitigative actions taken by RESPOND, this customer also received a Proactive Threat Notification (PTN) informing them of potentially malicious activity on their network. This prompted the Darktrace Security Operations Center (SOC) to investigate and document the incident, allowing the customer’s security team to shift their focus to remediating and removing the threat of SmokeLoader.

Conclusion

Ultimately, Darktrace showcased its ability to detect and contain versatile and evasive strains of loader malware, like SmokeLoader. Despite its adeptness at bypassing conventional security tools by frequently changing its C2 infrastructure, utilizing existing processes to infect malicious code, and obfuscating malicious file and domain names, Darktrace’s anomaly-based approach allowed it to recognize such activity as deviations from expected network behavior, regardless of their apparent legitimacy.

Considering SmokeLoader’s wide array of functions, including C2 communication that could be used to facilitate additional attacks like exfiltration, or even the deployment of information-stealers or ransomware, Darktrace proved to be crucial in safeguarding customer networks. By identifying and mitigating SmokeLoader at the earliest possible stage, Darktrace effectively prevented the compromises from escalating into more damaging and disruptive compromises.

With the threat of loader malware expected to continue growing alongside the boom of the MaaS industry, it is paramount for organizations to adopt proactive security solutions, like Darktrace DETECT+RESPOND, that are able to make intelligent decisions to identify and neutralize sophisticated attacks.

Credit to Patrick Anjos, Senior Cyber Analyst, Justin Torres, Cyber Analyst

Appendices

Darktrace DETECT Model Detections

- Anomalous Connection / New User Agent to IP Without Hostname

- Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

- Anomalous File / Multiple EXE from Rare External Locations

- Anomalous File / Numeric File Download

List of IOCs (IOC / Type / Description + Confidence)

- 85.208.139[.]35 / IP / SmokeLoader C2 Endpoint

- 185.174.137[.]109 / IP / SmokeLoader C2 Endpoint

- 45.66.230[.]164 / IP / SmokeLoader C2 Endpoint

- 91.215.85[.]147 / IP / SmokeLoader C2 Endpoint

- tolilolihul[.]net / Hostname / SmokeLoader C2 Endpoint

- bulimu55t[.]net / Hostname / SmokeLoader C2 Endpoint

- potunulit[.]org / Hostname / SmokeLoader C2 Endpoint

- hugersi[.]com / Hostname / SmokeLoader C2 Endpoint

- human[.]art / Hostname / SmokeLoader C2 Endpoint

- 371b0d5c867c2f33ae270faa14946c77f4b0953 / SHA1 / SmokeLoader Executable

References:

[1] https://bazaar.abuse.ch/sample/d7c395ab2b6ef69210221337ea292e204b0f73fef8840b6e64ab88595eda45b3/#intel

[2] https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

[3] https://www.darkreading.com/cyber-risk/breaking-down-the-propagate-code-injection-attack

[4] https://n1ght-w0lf.github.io/malware%20analysis/smokeloader/

[5] https://therecord.media/surge-in-smokeloader-malware-attacks-targeting-ukrainian-financial-gov-orgs

MITRE ATT&CK Mapping

Model: Anomalous Connection / New User Agent to IP Without Hostname

ID: T1071.001

Sub technique: T1071

Tactic: COMMAND AND CONTROL

Technique Name: Web Protocols

‍

Model: Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

ID: T1185

Sub technique: -

Tactic: COLLECTION

Technique Name: Man in the Browser

‍

ID: T1071.001

Sub technique: T1071

Tactic: COMMAND AND CONTROL

Technique Name: Web Protocols

‍

Model: Anomalous File / Multiple EXE from Rare External Locations

ID: T1189

Sub technique: -

Tactic: INITIAL ACCESS

Technique Name: Drive-by Compromise

‍

ID: T1588.001

Sub technique: - T1588

Tactic: RESOURCE DEVELOPMENT

Technique Name: Malware

‍

Model: Anomalous File / Numeric File Download

ID: T1189

Sub technique: -

Tactic: INITIAL ACCESS

Technique Name: Drive-by Compromise

‍

ID: T1588.001

Sub technique: - T1588

Tactic: RESOURCE DEVELOPMENT

Technique Name: Malware

Written by

Patrick Anjos

Senior Cyber Analyst

Inside the SOC

Written by

Patrick Anjos

Senior Cyber Analyst

•

February 13, 2026

Emma Foulger

Global Threat Research Operations Lead

•

February 13, 2026

Watch the NIS2 Webinar

Blog

February 13, 2026

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

Note: Darktrace's Threat Research team is publishing now to help defenders. We will update continue updating this blog as our investigations unfold.

Background

On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests. This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].

A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].

Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].

Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.

Darktrace Detections

Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:

- Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation. Associated Darktrace models include:

o Compromise / Possible Tunnelling to Bin Services
‍

- Suspicious executable file downloads. Associated Darktrace models include:

o Anomalous File / EXE from Rare External Location
‍

- Outbound beaconing to rare domains. Associated Darktrace models include:

o Compromise / Agent Beacon (Medium Period)

o Compromise / Agent Beacon (Long Period)

o Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

o Compromise / Beacon to Young Endpoint

o Anomalous Server Activity / Rare External from Server

o Compromise / SSL Beaconing to Rare Destination
‍

- Unusual cryptocurrency mining activity. Associated Darktrace models include:

o Compromise / Monero Mining

o Compromise / High Priority Crypto Currency Mining

‍‍

And model alerts for:

o Compromise / Rare Domain Pointing to Internal IP

‍

IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.

‍

Appendices

Potential indicators of post-exploitation behavior:

· 217.76.57[.]78 – IP address - Likely C2 server

· hXXp://217.76.57[.]78:8009/index.js - URL - Likely payload

· b6a15e1f2f3e1f651a5ad4a18ce39d411d385ac7 - SHA1 - Likely payload

· 195.154.119[.]194 – IP address – Likely C2 server

· hXXp://195.154.119[.]194/index.js - URL – Likely payload

· avg.domaininfo[.]top – Hostname – Likely C2 server

· 104.234.174[.]5 – IP address - Possible C2 server

· 35da45aeca4701764eb49185b11ef23432f7162a – SHA1 – Possible payload

· hXXp://134.122.13[.]34:8979/c - URL – Possible payload

· 134.122.13[.]34 – IP address – Possible C2 server

· 28df16894a6732919c650cc5a3de94e434a81d80 - SHA1 - Possible payload

References:

1. https://nvd.nist.gov/vuln/detail/CVE-2026-1731

2. https://www.securityweek.com/beyondtrust-vulnerability-targeted-by-hackers-within-24-hours-of-poc-release/

3. https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/

‍

About the author

Emma Foulger

Global Threat Research Operations Lead

Blog

February 13, 2026

How AI is redefining cybersecurity and the role of today’s CIO

Why AI is essential to modern security

As attackers use automation and AI to outpace traditional tools and people, our approach to cybersecurity must fundamentally change. That’s why one of my first priorities as Withum's CIO was to elevate cybersecurity from a technical function to a business enabler.

What used to be “IT’s problem” is now a boardroom conversation – and for good reason. Protecting our data, our people, and our clients directly impacts revenue, reputation and competitive positioning.

As CIOs / CISOs, our responsibilities aren’t just keeping systems running, but enabling trust, protecting our organization's reputation, and giving the business confidence to move forward even as the digital world becomes less predictable. To pull that off, we need to know the business inside-out, understand risk, and anticipate what's coming next. That's where AI becomes essential.

Staying ahead when you’re a natural target

With more than 3,100 team members and over 1,000 CPAs (Certified Public Accountant), Withum’s operates in an industry that naturally attracts attention from attackers. Firms like ours handle highly sensitive financial and personal information, which puts us squarely in the crosshairs for sophisticated phishing, ransomware, and cloud-based attacks.

We’ve built our security program around resilience, visibility, and scale. By using Darktrace’s AI-powered platform, we can defend against both known and unknown threats, across email and network, without slowing our teams down.

Our focus is always on what we’re protecting: our clients’ information, our intellectual property, and the reputation of the firm. With Darktrace, we’re not just keeping up with the massive volume of AI-powered attacks coming our way, we’re staying ahead. The platform defends our digital ecosystem around the clock, detecting potential threats across petabytes of data and autonomously investigating and responding to tens of thousands of incidents every year.

Catching what traditional tools miss

Beyond the sheer scale of attacks, Darktrace ActiveAI Security PlatformTM is critical for identifying threats that matter to our business. Today’s attackers don’t use generic techniques. They leverage automation and AI to craft highly targeted attacks – impersonating trusted colleagues, mimicking legitimate websites, and weaving in real-world details that make their messages look completely authentic.

The platform, covering our network, endpoints, inboxes, cloud and more is so effective because it continuously learns what’s normal for our business: how our users typically behave, the business- and industry-specific language we use, how systems communicate, and how cloud resources are accessed. It picks up on minute details that would sail right past traditional tools and even highly trained security professionals.

Freeing up our team to do what matters

On average, Darktrace autonomously investigates 88% of all our security events, using AI to connect the dots across email, network, and cloud activity to figure out what matters. That shift has changed how our team works. Instead of spending hours sorting through alerts, we can focus on proactive efforts that actually strengthen our security posture.

For example, we saved 1,850 hours on investigating security issues over a ten-day period. We’ve reinvested the time saved into strengthening policies, refining controls, and supporting broader business initiatives, rather than spending endless hours manually piecing together alerts.

Real confidence, real results

The impact of our AI-driven approach goes well beyond threat detection. Today, we operate from a position of confidence, knowing that threats are identified early, investigated automatically, and communicated clearly across our organization.

That confidence was tested when we withstood a major ransomware attack by a well-known threat group. Not only were we able to contain the incident, but we were able to trace attacker activity and provided evidence to law enforcement. That was an exhilarating experience! My team did an outstanding job, and moments like that reinforce exactly why we invest in the right technology and the right people.

Internally, this capability has strengthened trust at the executive level. We share security reporting regularly with leadership, translating technical activity into business-relevant insights. That transparency reinforces cybersecurity as a shared responsibility, one that directly supports growth, continuity, and reputation.

Culturally, we’ve embedded security awareness into daily operations through mandatory monthly training, executive communication, and real-world industry examples that keep cybersecurity top of mind for every employee.

The only headlines we want are positive ones: Withum expanding services, Withum growing year over year. Security plays a huge role in making sure that’s the story we get to tell.

What’s next

Looking ahead, we’re expanding our use of Darktrace, including new cloud capabilities that extend AI-driven visibility and investigation into our AWS and Azure environments.

As I continue shaping our security team, I look for people with passion, curiosity, and a genuine drive to solve problems. Those qualities matter just as much as formal credentials in my view. Combined with AI, these attributes help us build a resilient, engaged security function with low turnover and high impact.

For fellow technology leaders, my advice is simple: be forward-thinking and embrace change. We must understand the business, the threat landscape, and how technology enables both. By augmenting human expertise rather than replacing it, AI allows us to move upstream by anticipating risk, advising the business, and fostering stronger collaboration across teams.

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

How Darktrace Defeated SmokeLoader Malware

What is Loader Malware?

How does SmokeLoader Malware work?

SmokeLoader Malware Attack Details

PROPagate Injection Technique

Obfuscation Methods

Infection Vector and Communication

Continuous Evolution

Darktrace’s Coverage of SmokeLoader Attack

The First Signs of Infection SmokeLoader Infection

C2 Communication

Darktrace RESPOND Halting Potential Threats from the Initial Stages of Detection

Conclusion

Appendices

Darktrace DETECT Model Detections

List of IOCs (IOC / Type / Description + Confidence)

References:

MITRE ATT&CK Mapping

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

How AI is redefining cybersecurity and the role of today’s CIO

Enjoying the blog?

More in this series

AI/LLM-Generated Malware Used to Exploit React2Shell

AppleScript Abuse: Unpacking a macOS Phishing Campaign

Darktrace Malware Analysis: Unpacking SnappyBee

Blog

February 13, 2026

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

Background

Darktrace Detections

Appendices

Potential indicators of post-exploitation behavior:

References:

Blog

February 13, 2026

How AI is redefining cybersecurity and the role of today’s CIO

Why AI is essential to modern security

Staying ahead when you’re a natural target

Catching what traditional tools miss

Freeing up our team to do what matters

Real confidence, real results

What’s next