Follow a malicious email as it moves through Darktrace / EMAIL’s multi-layered AI system, from raw data to final decision. Each layer works together to detect threats, understand intent, and take autonomous action.

Attackers abused a trojanized 7‑Zip installer distributed via a typo‑squatted domain to establish proxyware infections worldwide. This blog analyzes how social engineering, trusted open‑source software, and stealthy command‑and‑control activity enabled widespread compromise, highlighting the importance of software validation, user awareness, and proactive network‑level detection.

AI agents are transforming enterprise productivity, but they are also expanding the attack surface in new ways. This blog explores the benefits and challenges surrounding prompt security, where AI risk emerges across connected systems and autonomous actions, and how organizations can build a broader strategy to secure AI across the enterprise.

The blog examines how AI has changed the paradigm of understanding, and dealing with, insider threats. It also explores a defense-in-depth approach and discusses what CISOs and SOC leaders can do to protect their organization from AI insider threats.

ダークトレースの研究者はTwill Typhoonに関連するAPJ地域の顧客を標的とした中国系攻撃キャンペーンを特定しました。 観測されたアクティビティには、CDNなりすまし、正規のバイナリ、DLL サイドローディングによる .NET RATの展開が含まれていました。

AI is now embedded throughout the cybersecurity stack, but findings from the State of AI Cybersecurity 2026 show that adoption is growing much faster than trust or understanding. As vendors strive to capture market share, security leaders must learn how to distinguish the most valuable solutions from the hype.

AI-driven systems like Mythos are accelerating how quickly vulnerabilities are discovered, shrinking the gap between exposure and exploitation. This blog explores how security strategies need to adapt, shifting focus toward early detection, rapid containment, and limiting the impact of threats. It also outlines how a behavioral, AI-driven approach can help security teams identify subtle signs of compromise, respond in real time, and maintain control in an environment where attackers are moving faster than ever.

Software supply-chain attacks dominate the threat landscape in 2026, as adversaries exploit trusted build systems, CI/CD pipelines, and management tools to gain access to target environments. This blog examines Axios, Trivy and Quest Kace compromises observed in the Darktrace customer base, highlighting the need for anomaly detection, assumed breach and continuous visibility.

ダークトレースは、2026年Gartner® Network Detection and Response（NDR）部門のMagic Quadrant™レポートにおいて2年連続でLeaderの1社に認められました。 このことは、NDR分野における実績の積み重ね、継続したAIイノベーション、そして世界のお客様に提供してきた安定した成果が反映されたものと当社は確信しています。

Providing university students and faculty with broad access to information, platforms, and public databases is fundamental to learning and research. But that openness also creates greater exposure to cyber threats. In this blog, Irving Bruckstein shares why he deployed Darktrace at three institutions, how behavioral AI helped him achieve an A-rating security posture, and why autonomous detection is essential in an AI-driven threat landscape.

Prompt injection is a newly emerging threat, with only a handful of confirmed victims so far – targeting how AI systems use data rather than exploiting traditional software vulnerabilities. As agentic AI becomes embedded across enterprise environments, attackers may attempt to manipulate these systems through hidden instructions in everyday email content.

AI systems like Mythos are accelerating vulnerability discovery to the point where attackers can exploit weaknesses before they are ever disclosed, undermining the traditional model of CVE-driven defense. Learn how this shift is forcing security teams to move beyond patching and adopt behavioral detection to identify and contain threats before disclosure.

Findings from our annual survey of 1,500+ cyber professionals reveal that security leaders are confronting a surge in AI-driven attacks, which are faster, more personalized, and harder to detect than anything they’ve seen before. As these threats scale, the challenge for defenders is in evolving their security programs in tandem to defend with confidence.

A malicious eScan software update triggered a supply chain compromise that deployed multi‑stage malware and used blockchain‑based domains for resilient C2 communications. Darktrace identified rare, anomalous network activity across customer environments, helping organizations uncover the attack chain and strengthen defenses against increasingly sophisticated supply chain threats.

AIはパッチ適用が追い付かない速さでサイバー攻撃を加速させており、脆弱性の発見と修復の間のギャップは拡大しています。 このブログでは、なぜ予防第一のセキュリティではもはやAI駆動の脅威に追いつけないのかを解説します。 また、ダークトレースのビヘイビアAIによって、脆弱性が不明または未修正の場合でも、組織は攻撃を即座に検知し封じ込められることを説明します。

Darktrace analysis reveals ZionSiphon, an OT‑focused malware targeting Israeli water treatment and desalination systems. The malware combines privilege escalation, persistence, USB propagation, and ICS scanning with sabotage capabilities aimed at chlorine and pressure controls, highlighting growing experimentation with politically motivated critical ‑infrastructure attacks against industrial operational technologies globally.

As Model Context Protocol (MCP) becomes the control plane for autonomous AI agents, it creates a new and largely ungoverned security attack surface. This article outlines the key MCP risks CISOs must address and why governance and visibility are now essential.

As AI adoption accelerates, security teams face growing risk across interconnected systems. This blog explores why siloed tools fall short, how lifecycle thinking helps, and how to ensure your security functions work together.

Chaosマルウェアは、従来標的としていたルーターやエッジデバイスに加えて、クラウド環境の設定ミスを狙うケースが増えています。ダークトレースのハニーポットネットワークは、戦術の進化と新たな能力を明らかにし、クラウドサーバーに対するリスクの増大を浮き彫りにしました。

ダークトレースの最新の脅威調査は、中国系サイバー作戦が単発的な侵入から長期にわたる戦略的配置に進化している状況を明らかにしています。攻撃者は重要インフラやデジタルエコシステムへの永続的アクセスに重点を置くことで作戦上の利点や経済的優位性を持続させようとしています。

By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.

GhostSocks is an emerging threat turning compromised devices into residential proxy nodes to help attackers evade detection. Darktrace identifies its growing use alongside Lumma Stealer, highlighting the malware’s stealth, payload delivery, and persistence. AI-driven detection and Autonomous Response reveal the full attack lifecycle and underscore the need for proactive defense.

This Darktrace / OT release introduces new capabilities designed to help industrial organizations better understand, document, and operationalize their operational environments. With native OT architecture visualization, structured asset and compliance reporting, and expanded industrial protocol coverage, this release focuses on improving how teams manage real operational security workflows.

This blog explores how the Darktrace’s ActiveAI Security Portal supports efficient, AI driven triage across customers and Partner deployments

Introducing the adaptive era of email security: a unified platform that connects personalized coaching, collaboration tools, and user behavior into a self-improving defense system.