Blog
/
/
November 16, 2021

The Tech Driving Arrow McLaren SP to the Top

As Arrow McLaren SP looks back on a positive season, the team reflects on key challenges, success, and how AI and automation is leveraged in their work!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
16
Nov 2021

As Arrow McLaren SP looks back on a positive season and prepares to build momentum into next year, Taylor Kiel (Team President) and Craig Hampson (Director of Trackside Engineering) reflect on key challenges and successes. With Pato O’Ward’s No. 5 car in the running to win the championship until the final race of the season, they reveal the formula for success – and how the team leverages AI and automation in every aspect of their work – from driver simulation to cyber security.

Data as the lifeblood for performance

In INDYCAR qualifiying, the difference between P1 and P10 can be as little as half a second, and when margins are that tight, the finer details in preparation make the difference. For us, that preparation is driven by data. Every race weekend and every practice session, over 100 lightweight sensors and several computers on the cars produce masses of data that is stored and analyzed for performance optimization.

This ecosystem includes an engine controller, a gear shift controller computer, and a computer unit that controls the clutch, and these systems all talk to each other across what is called a Controller Area Network (CAN). So the key question for us becomes: how do we get useful insights from that data, securely, and in a short period of time?

If you can think of something that’s happening on the car, the likelihood is our team is doing everything we can to try and measure it. Air speed, acceleration, tyre temperature, and so much more – we currently record over 1,500 data channels on the car itself, and we then process another 838 ‘math channels’ from combinations of this data – giving us, for example, the ride height of and downforce on the car.

This is more data than we can ever process with human beings alone, and a lot of our work now is figuring out how to automate these processes, using AI to look for patterns that humans simply cannot identify.

Pitting: More than just a tyre change

Each of our cars have two cellular-based telemetry systems built into them, but we are still limited on the amount of throughput we can observe real time, which is why we need to offload this data each time we pit during practice. This involves plugging in what we call an ‘umbilical cord’ that has a communication line and also powers the car.

Figure 1: A typical INDYCAR would last only minutes on its own battery without the engine running

Any typical race produces between 2.5GB and 3.3GB of data, in addition to in-car video, and a GPS system recording the car’s position on the track, which not only goes back to us but also to the relevant television broadcasters. So, we need to have a lot of storage available both in the cloud and on hard drives using a server. That data needs to be available not just to us at trackside but virtually to engineers not present at the race. And most importantly, that data needs to be secure, and protected from outside interference.

The cyber side: Turning to AI

All that precious data coming from the car, residing in the cloud or elsewhere in our organization, is susceptible to tampering from insiders and outsiders who may – deliberately or indirectly – compromise our ability to access or use that data reliably. As the cyber-threat landscape evolves – with ransomware bringing organizations of all shapes and sizes to a halt – we need to make sure we’re prepared for whatever attack is around the corner.

Firewalls, email gateways, and other perimeter protections are one part of the puzzle. But while these tools are focussed on keeping an attacker out – we needed another layer of defense that ensures that if these defenses are bypassed, we have an autonomous system that knows our organization inside out and can fight back on our behalf to disrupt emerging threats.

That’s where Darktrace has provided a revolutionary solution – using Self-Learning AI that understands every person and device from the ground up and identifies subtle deviations that point to a cyber-threat. And if ransomware strikes, 24/7 Autonomous Response is there in the form of Darktrace Antigena, taking precise action to contain ransomware and other threats at machine speed.

Double wins at doubleheaders

Using automation and AI throughout our technology stack enables us to extract meaningful insights from large pools of data and take quick, decisive action in the form of changes to the car or on-the-fly changes in race strategy.

The ability to react and react quickly is really put to the test on doubleheader race weekends, where any room for improvement you identify from Saturday’s race can be rectified in the form of overnight changes and implemented on Sunday. We believe it’s no coincidence that both of Pato’s No. 5 car’s wins came on the back end of doubleheader events, at Texas and Detroit Belle Isle. With people working in harmony with technology, our engineering team were able to make significant improvements to the car, react on the fly, and ultimately ensure we ended up ahead of the competition.

Digital fakes: Breaking new ground at Nashville

This year’s INDYCAR season featured a brand new track in Nashville, an exciting but daunting prospect for both the drivers and the team as a whole. Having access to a driver simulator, thanks to our partners at Chevrolet, we were able to run a virtual version of our car to try different setups, different techniques, and in this case have the driver learn his way round a whole new circuit.

Figure 2: The Chevrolet simulator projects a digital twin of the Nashville circuit

The track is recreated down to the nearest millimetre using a laser scanner, and then there is a lot of digital rendering involved, making it as realistic as possible with stands, fencing, and sponsor banners. Using this ‘digital fake’ representation was super helpful to the drivers in determining the correct approaches to corners, and for our engineers, enabling them to use the outputs to characterize the track.

The setup of the car in the simulator is effectively the same as the setup of the car in the real world: you set the spring rate and the ride height, it has the aerodynamic map, it knows the inertias and the masses of the car. It’s an incredibly complicated and powerful physics engine, but it gives us the ability to test things out in a controlled environment, and contributed toward one of Felix Rosenqvist’s strongest races of the season in the No. 7 car.

Simulations like these are the way of the future – not just for new circuits but in general. Rather than going through tyres and engines, we can replicate practice sessions in digital form, and the software gets closer to reality every day.

Looking ahead

What is next for Arrow McLaren SP? As we are now a part of the McLaren Racing family, new efficiencies and synergies are realized every month. We’ll certainly continue to leverage that valuable partnership, as well as our technology partnership with Darktrace, continuing to roll out their technology across our digital estate, including our email and cloud services.

In the INDYCAR Series, if you stay still, you go backwards, and the competition hots up every year. We know that now more than ever, the answer lies in using cutting-edge technologies across every aspect of the business to make our lives easier and ultimately propel us to the very top.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP

More in this series

No items found.

Blog

/

Network

/

May 21, 2026

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

garnter ndr magic quadrantDefault blog imageDefault blog image

Continued recognition in NDR  

Darktrace has been recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), marking the second consecutive year in the Leaders quadrant.

We believe this consistency reflects sustained ability to execute, adapt, and deliver outcomes as the market evolves.

While we are immensely proud to be recognized by industry analysts as a Leader in NDR, that's just part of the story. Darktrace was also Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response based on direct customer feedback and real-world experience.

We believe the combination of these two signals is important. One reflects how the market is evaluated. The other reflects how technology performs in practice.

Why Darktrace continues to be recognized as a leader

We believe our position as a Leader for the second consecutive year reflects a combination of our sustained ability to execute in NDR, continued AI innovation, and proven delivery of security outcomes for customers and partners worldwide.

We also feel that our leadership in the NDR market is a testament to our unique and multi-layered AI approach, for which we were recognized as No.7 on Fast Company’s Most Innovative AI Companies of 2026 list, plus one of the hottest AI cybersecurity companies in CRN's AI 100.

Adapting to complex, real-world environments

Organizations are no longer protecting a single network perimeter. They are securing a mix of users, devices, applications, and data that move across hybrid environments.

Darktrace has focused on maintaining visibility and detection across these conditions, allowing security teams to understand activity as it scales.

Supporting organizations globally, not just technically

Security outcomes are shaped as much by deployment and support as they are by detection capability.

Darktrace continues to invest in regional presence across 29 countries around the world, helping organizations operationalize NDR in ways that align with local requirements, internal processes, and team structures.

Continuing to push AI beyond detection

AI in cybersecurity is often positioned as a way to improve detection accuracy. But the more important shift is how AI can influence decision-making and response.

Darktrace continues to develop models that learn from both live environments and historical incident data, combining real-time behavioral analysis with insights derived from prior attack patterns.

Using technologies such as the Incident Graph and DIGEST (Darktrace Incident Graph Evaluation for Security Threats), activity is not analyzed in isolation. Instead, relationships between users, devices, connections, and events are mapped over time, allowing the system to reconstruct how an incident is unfolding and how similar incidents have progressed in the past.

By evaluating these patterns, Darktrace can assess the likelihood that an incident will escalate, prioritizing the activity that poses the greatest risk and surfacing the most relevant context for investigation.

This shifts security operations from simply identifying anomalies to understanding their trajectory, helping teams anticipate potential impact and respond earlier with greater precision.

Why NDR is shifting from reactive detection to proactive, AI-driven security

Traditional approaches to NDR have been built around reactively identifying threats once they become clearly visible. That model is increasingly difficult to rely on.

Attackers are no longer operating in ways that stand out. They use valid credentials, trusted tools, and low-and-slow techniques that blend into everyday activity. By the time something looks obviously malicious, the impact is often already underway.

This is the core limitation of reactive detection. It depends on recognizing something that already looks like a threat.

As a result, many of the most consequential incidents today fall into a gap.

Insider activity, compromised credentials, and novel attacks rarely trigger traditional alerts because they do not follow known patterns. On the surface, they often appear legitimate, making them difficult to distinguish from normal behavior without deeper context.

This is why we believe this Gartner recognition reflects a broader shift in NDR toward autonomous, proactive and pre‑emptive security operations.

By understanding normal behavior within an environment, it is possible to identify subtle deviations rather than waiting for confirmation of threats as they are taking place.

Darktrace’s Self-Learning AI is designed for behavioral understanding. By continuously learning each organization’s normal patterns, it can detect deviations in real time, enabling a proactive and pre-emptive model of NDR where security teams can respond to early signs of risk as they emerge, reducing the window in which attacks can develop.

In multiple cases, this behavioral approach has led to early threat detection where Darktrace identified completely unknown threats, including pre-CVE zero-day activity. By detecting subtle behavioral changes before vulnerabilities were publicly disclosed or widely understood, organizations can mitigate threats before they do damage.

This shift is subtle but important. Modern NDR solutions must shift from a system that explains what happened to one that helps prevent threats from developing in the first place, and Darktrace is proud to be at the forefront of this shift - helping organizations build and maintain a state of proactive network resilience.

Continuing to innovate at the forefront of NDR

In our view, recognition as a Leader reflects where the market is today. Continuing to innovate defines what comes next.

As businesses evolve, new technologies like AI tools and agents introduce new security risks and challenges; security teams need more than simple detection. They need a complete understanding of risk as it develops, the ability to investigate it in context, and to contain threats at machine speed.  

Darktrace / NETWORK is built to deliver across that full spectrum. Its Self-Learning AI continuously adapts to each organization’s environment, identifying subtle behavioral changes that signal emerging threats. Integrated investigation and autonomous response reduce the time between detection and action, allowing teams to move with greater speed and confidence.

This combination enables organizations to detect and contain known, unknown, and insider threats as they develop, while also strengthening resilience over time.

As a two-time Leader in the Gartner® Magic Quadrant™ for NDR and the only 2025 Gartner® Peer Insights™ Customers’ Choice, we feel Darktrace continues to evolve its platform to meet the demands of modern environments, delivering a more complete and adaptive approach to network security.

[related-resource]

Disclaimer: The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) ,The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), Thomas Lintemuth, Charanpal Bhogal, Nahim Fazal, 18 May 2026.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response

Blog

/

/

May 21, 2026

Prompt Security in Enterprise AI: Strengths, Weaknesses, and Common Approaches

prompt securityDefault blog imageDefault blog image

How enterprise AI Agents are changing the risk landscape  

Generative AI Agents are changing the way work gets done inside enterprises, and subsequently how security risks may emerge. Organizations have quickly realized that providing these agents with wider access to tooling, internal information, and granting permissions for the agent to perform autonomous actions can greatly increase the efficiency of employee workflows.

Early deployments of Generative AI systems led many organizations to scope individual components as self-contained applications: a chat interface, a model, and a prompt, with guardrails placed at the boundary. Research from Gartner has shown that while the volume and scope of Agentic AI deployments in enterprise environments is rapidly accelerating, many of the mechanisms required to manage risk, trust, and cost are still maturing.

The issue now resides on whether an agent can be influenced, misdirected, or manipulated in ways that leads to unsafe behavior across a broader system.

Why prompt security matters in enterprise AI

Prompt security matters in enterprise AI because prompts are the primary way users and systems interact with Agentic AI models, making them one of the earliest and most visible indicators of how these systems are being used and where risk may emerge.

For security teams, prompt monitoring is a logical starting point for understanding enterprise AI usage, providing insight into what types of questions are being asked and tasks are being given to AI Agents, how these systems are being guided, and whether interactions align with expected behavior. Complete prompt security takes this one step further, filtering out or blocking sensitive or dangerous content to prevent risks like prompt injection and data leakage.

However, visibility only at the prompt layer can create a false sense of security. Prompts show what was asked, but not always why it was asked, or what downstream actions were triggered by the agent across connected systems, data sources, or applications.

What prompt security reveals  

The primary function of prompt security is to minimize risks associated with generative and agentic AI use, but monitoring and analysis of prompts can also grant insight into use cases for particular agents and model. With comprehensive prompt security, security teams should be able to answer the following questions for each prompt:

  • What task was the user attempting to complete?
  • What data was included in the request, and was any of the data high-risk or confidential?
  • Was the interaction high-risk, potentially malicious, or in violation of company policy?
  • Was the prompt anomalous (in comparison to previous prompts sent to the agent / model)?

Improving visibility at this layer is a necessary first step, allowing organizations to establish a baseline for how AI systems are being used and where potential risks may exist.  

Prompt security alone does not provide a complete view of risk. Further data is needed to understand how the prompt is interpreted, how context is applied, what autonomous actions the agent takes (if any), or what downstream systems are affected. Understanding the outcome of a query is just as important for complete prompt security as understanding the input prompt itself – for example, a perfectly normal, low-risk prompt may inadvertently result in an agent taking a high-risk action.

Comprehensive AI security systems like Darktrace / SECURE AI can monitor and analyze both the prompt submitted to a Generative AI system, as well as the responses and chain-of-thought of the system, providing greater insight into the behavior of the system. Darktrace / SECURE AI builds on the core Darktrace methodology, learning the expected behaviors of your organization and identifying deviations from the expected pattern of life.

How organizations address prompt security today

As prompt-level visibility has become a focus, a range of approaches have emerged to make this activity more observable and controllable. Various monitoring and logging tools aim to capture prompt inputs to be analyzed after the fact.  

Input validation and filtering systems attempt to intervene earlier, inspecting prompts before they reach the model. These controls look for known jailbreak patterns, language indicative of adversarial attacks, or ambiguous instructions which could push the system off course.

Importantly, for a prompt security solution to be accurate and effective, prompts must be continually observed and governed, rather than treated as a point-in-time snapshot.  

Where prompt security breaks down in real environments

In more complex environments, especially those involving multiple agents or extensive tool use, AI security becomes harder to define and control.

Agent-to-Agent communications can be harder to monitor and trace as these happen without direct user interaction. Communication between agents can create routes for potential context leakage between agents, unintentional privilege escalation, or even data leakage from a higher privileged agent to a lower privileged one.

Risk is shaped not just by what is asked, but by the conditions in which that prompt operates and the actions an agent takes. Controls at the orchestration layer are starting to reflect this reality. Techniques such as context isolation, scoped memory, and role-based boundaries aim to limit how far a prompt’s influence can extend.  

Furthermore, Shadow AI usage can be difficult to monitor. AI systems that are deployed outside of formal governance structures and Generative AI systems hosted on unknown endpoints can fly under the radar and can go unseen by monitoring tools, leaving a critical opening where adversarial prompts may go undetected. Darktrace / SECURE AI features comprehensive detection of Shadow AI usage, helping organizations identify potential risk areas.

How prompt security fits in a broader AI risk model

Prompt security is an important starting point, but it is not a complete security strategy. As AI systems become more integrated into enterprise environments, the risks extend to what resources the system can access, how it interprets context, and what actions it is allowed to take across connected tools and workflows.

This creates a gap between visibility and control. Prompt security alone allows security teams to observe prompt activity but falls short of creating a clear understanding of how that activity translates into real-world impact across the organization.

Closing that gap requires a broader approach, one that connects signals across human and AI agent identities, SaaS, cloud, and endpoint environments. It means understanding not just how an AI system is being used, but how that usage interacts with the rest of the digital estate.

Prompt security, in that sense, is less of a standalone solution and more of an entry point into a larger problem: securing AI across the enterprise as a whole.

Explore how Darktrace / SECURE AI brings prompt security to enterprises

Darktrace brings more than a decade of AI expertise, built on an enterprise‑wide platform designed to operate in and understand the behaviors of the complex, ambiguous environments where today’s AI now lives. With Darktrace / SECURE AI, enterprises can safely adopt, manage, monitor, and build AI within their business.  

Learn about Darktrace / SECURE AI here.

Sign up today to stay informed about innovations across securing AI.

[related-resource]

Continue reading
About the author
Jamie Bali
Technical Author (AI) Developer
Your data. Our AI.
Elevate your network security with Darktrace AI