Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
For Managed Security Service Providers (MSSPs), this challenge is amplified: delivering consistent, high quality outcomes across multiple customers and deployments without multiplying tools, consoles, or analyst workload.
Darktrace aims to address this challenge with new capabilities within the ActiveAI Security Portal. This includes the introduction of a new Alerts Dashboard, designed to help MSSPs, and the customers they serve, operate more efficiently when triaging security alerts at scale.
From alert volume to operational clarity
Modern security teams often struggle to coordinate alerts across complex environments with multiple deployments, whether due to geography, regulation, or organizational structure.
As environments expand across regions, business units, and architectures, analysts are frequently required to log into multiple systems simply to understand what requires attention. This fragmentation slows triage, increases cognitive load, and makes it harder to deliver consistent outcomes.
The ActiveAI Security Portal addresses this challenge by providing a single, unified triage workspace that brings alerts from multiple Darktrace deployments together in one place without changing how those environments are architected.
For MSSPs, this creates a clearer operational view across customer accounts. For internal SOC teams, it delivers the same clarity across distributed enterprise environments.
Built for alert investigation across complex and multi-customer environments
The new ActiveAI Security Portal Alerts Dashboard is designed as a coordination layer, not a replacement for investigation tools.
From a single view, teams can:
Triage alerts across connected deployments
Assign and track investigations across analysts
Capture notes to support clean handoffs and auditability
Move seamlessly into deeper investigation when required
By reducing context switching and manual coordination, the dashboard helps SOC teams focus on decision making rather than navigation, improving efficiency across shifts and service tiers.
Figure 1: ActiveAI Security Portal Dashboard
AI driven triage that reduces analyst burden
At the core of the triage workflow is Darktrace’s Cyber AI Analyst, which automatically performs Level 1 and Level 2 triage by grouping related activity into evolving incidents.
Rather than presenting analysts with disconnected alerts, Cyber AI Analyst builds context automatically,reducing noise and surfacing what matters most. As new events or assets are detected, incidents update dynamically, ensuring teams are always working with the most current information.
This allows analysts to prioritize effectively, respond faster, and spend less time manually correlating activity across systems.
Unified visibility for multiple deployments in a single operational queue
Many MSSPs and enterprises operate environments that are intentionally segmented by geography, regulation, or business function. The ActiveAI Security Portal respects this reality.
Alerts from multiple deployments are surfaced in a single operational queue, but incidents remain scoped to how environments are configured. Where customers use a Unified View, Cyber AI Analyst can correlate activity across submasters; where they do not, the dashboard still provides consolidated triage without forcing artificial correlation.
This flexibility makes the Alerts Dashboard valuable across a wide range of operational and architectural models.
Figure 2: ActiveAI Security Portal AI Analyst Alerts Dashboard
Supporting MSSPs and complex customers alike
While the ActiveAI Security Portal is purpose-built for MSSPs managing multi-customer operations, it also delivers immediate value for customers with complex, multi-deployment environments.
Enterprise SOC teams can now triage alerts across regions or business units from one place without deploying additional infrastructure purely for visibility. In this way, the dashboard supports both outsourced and in-house security teams facing similar coordination challenges.
Continuing the ActiveAI Security Portal journey
The new Alerts Dashboard builds on capabilities introduced in the ActiveAI Security Portal in November, reflecting Darktrace’s continued focus on operational efficiency and AI-driven workflows.
Together, these enhancements bring the efficiency gains of Cyber AI Analyst and self-learning detection directly into the day-to-day work of SOC teams, making it easier to operate, scale, and deliver outcomes across increasingly complex environments.
This is not a one-off feature launch, but part of a broader evolution toward AI-native security operations.
Looking Ahead
As AI continues to reshape both the threat landscape and security operations, the ability to coordinate, prioritize, and respond efficiently will define successful SOCs.
The ActiveAI Security Portal is designed to help MSSPs and customers meet that challenge today, while providing a strong foundation for what comes next.
To learn more about availability and onboarding, contact your Darktrace partner manager.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
