Recent guidance from the NCSC sets out the controls needed to deploy agentic AI safely. But approval is only the starting point – the next step is understanding how agents actually behave once they are operating in the enterprise.

With the growing prevalence of generative AI, attackers are increasingly exploiting interest in AI tools to distribute malware. Darktrace recently investigated an incident in which a malicious executable masquerading as a Google Gemini installer resulted in a Vidar information stealer infection.

A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.

Darktrace is integrating with Microsoft Agent 365 to bring behavior-based AI agent risk signals directly into the Microsoft 365 Admin Center. The integration gives security teams a more unified view of agent activity, helping them identify anomalous behavior, investigate potential risks, and manage AI agents more efficiently across Microsoft environments.

Darktrace tested whether an enterprise AI agent could be targeted through a hidden prompt injection delivered by email, and whether behavioral email analysis could detect and respond to the attack before it reached the agent. The experiment found that although the email contained no malware, malicious links, or sender reputation indicators, Darktrace / EMAIL identified the attack based on anomalous language and behavioral context.

ダークトレースが実施した2026年度前半の脅威分析では、攻撃者はセキュリティコントロールを回避するのではなく、信頼を利用する傾向がますます強まっていることが明らかになりました。アイデンティティ侵害、サプライチェーン攻撃、SaaSの悪用、AIを利用した作戦、および国家と連携したさまざまな活動は、信頼されるユーザー、サービス、およびインフラが重要な攻撃経路となっていることを示しています。これは防御者にとって、コンテキストとビヘイビア分析がセキュリティを維持するための根本的な基盤であることを意味しています。

This marine organization uses Darktrace to strengthen cyber resilience across its distributed marine operations, protecting email, identity, network, and cloud environments while reducing manual triage for its lean ICT team. With autonomous response and unified visibility, Darktrace helps support operational continuity across mission-critical services.

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.

New capabilities help employees understand suspicious content, give administrators more control over sensitive data, and show security teams where risky workflows sit across the organization.

Traditional security controls were built for predictable systems. AI is different. This blog explores why behavioral detection and explainable autonomous containment are essential security layers for managing AI risk without slowing innovation.

As AI agents become more autonomous, understanding behavior is becoming even more important. The OpenAI and Hugging Face incident highlights why behavioral security is foundational to securely deploying AI in the enterprise.

その規模と複雑性により、スタジアムはサイバーセキュリティにとって最も過酷な環境の1つとなっています。その運営に今、AIを導入することで私たちは新たな次元のリスクを負おうとしています。 スタジアムをファンにとって安全な場所にするためにセキュリティチームはAIをどのように使うべきかを解説します。

As AI reshapes the threat landscape, attackers exploit vulnerabilities faster, abuse trusted identities, and leverage AI-driven tools and integrations to operate at scale. Drawing on real-world Darktrace observations, this article explores why behavioral detection, continuous trust validation, and early anomaly identification are becoming essential to defending modern enterprises.

ダークトレースは、Amazon Bedrockサービスに接続されたAIゲートウェイが侵害され、その後暗号通貨マイニングインフラとの通信が観測された事例を調査しました。このインシデントは、AIゲートウェイが企業のアタックサーフェス（攻撃対象領域）の一部となりつつあること浮き彫りにしており、ビヘイビア分析、クラウドの可視性、そしてAIインフラをアイデンティティおよびワークロードとあわせて保護することの重要性を示しています。

NIST's latest research argues that no finite set of AI guardrails can defend against every adversarial prompt, reinforcing a fundamental shift in how organizations should approach AI security. This blog explores why static rules alone are insufficient, why behavior provides the only stable signal of risk, and what this means for building resilient AI security strategies.

As organizations accelerate AI adoption, securing AI requires more than governance policies or model guardrails. This guide explores how security leaders can build a defense-in-depth strategy that addresses AI across governance, identity, data security, secure development, runtime monitoring, and incident response. Drawing on recent guidance from NIST and the Five Eyes alliance, it outlines the core capabilities organizations should prioritize to securely adopt AI while reducing operational and cyber risk.

We recently spoke with security leaders about the operational complexities and security risks AI is creating. As organizations accelerate adoption, five recurring concerns emerged, risks that are quietly reshaping the security landscape

As organizations rapidly adopt AI, Shadow AI is becoming one of the biggest governance and security challenges. This blog explores why Shadow AI is difficult to detect, where traditional visibility falls short, and how organizations can combine governance, behavioral analysis, and runtime visibility to reduce AI-related risk across enterprise environments

Healthcare CIO explains how layering Darktrace onto Microsoft security improved visibility, reduced risk, and minimized operational burden. Darktrace’s AI-native, agentless approach delivered proactive threat detection, seamless integration, and enterprise-grade protection, helping resource-constrained nonprofit teams balance strong cybersecurity with patient care priorities.

Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.

Prompt analysis is emerging as a critical frontier in AI security as enterprises increasingly interact with systems through language. While prompts can reveal user intent, they are inherently ambiguous when viewed in isolation. Effective prompt security requires contextual analysis across identity, behavior, systems, and business activity to distinguish normal AI use from real risk.

ダークトレースはOpenAIと協調して両社のサイバー機能をダークトレースの製品とサービス内で統合します。

Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.

This blog examines how attackers abuse the Chinese-developed Nezha monitoring tool, a legitimate open-source platform with remote access capabilities. Darktrace analysis of a honeypot intrusion highlights malicious deployment via containers, demonstrating how dual-use software enables stealthy operations, trust inversion, and detection challenges in dynamic cloud and enterprise environments modern.

スポーツ組織の84%が過去12か月間にサイバーインシデントを経験しています。 なぜスポーツがこのように大きな標的となったかを説明するデータと当社の分析を紹介します。