As organizations accelerate AI adoption, securing AI requires more than governance policies or model guardrails. This guide explores how security leaders can build a defense-in-depth strategy that addresses AI across governance, identity, data security, secure development, runtime monitoring, and incident response. Drawing on recent guidance from NIST and the Five Eyes alliance, it outlines the core capabilities organizations should prioritize to securely adopt AI while reducing operational and cyber risk.

NIST's latest research argues that no finite set of AI guardrails can defend against every adversarial prompt, reinforcing a fundamental shift in how organizations should approach AI security. This blog explores why static rules alone are insufficient, why behavior provides the only stable signal of risk, and what this means for building resilient AI security strategies.

We recently spoke with security leaders about the operational complexities and security risks AI is creating. As organizations accelerate adoption, five recurring concerns emerged, risks that are quietly reshaping the security landscape

Healthcare CIO explains how layering Darktrace onto Microsoft security improved visibility, reduced risk, and minimized operational burden. Darktrace’s AI-native, agentless approach delivered proactive threat detection, seamless integration, and enterprise-grade protection, helping resource-constrained nonprofit teams balance strong cybersecurity with patient care priorities.

As organizations rapidly adopt AI, Shadow AI is becoming one of the biggest governance and security challenges. This blog explores why Shadow AI is difficult to detect, where traditional visibility falls short, and how organizations can combine governance, behavioral analysis, and runtime visibility to reduce AI-related risk across enterprise environments

Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.

Prompt analysis is emerging as a critical frontier in AI security as enterprises increasingly interact with systems through language. While prompts can reveal user intent, they are inherently ambiguous when viewed in isolation. Effective prompt security requires contextual analysis across identity, behavior, systems, and business activity to distinguish normal AI use from real risk.

ダークトレースはOpenAIと協調して両社のサイバー機能をダークトレースの製品とサービス内で統合します。

Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.

スポーツ組織の84%が過去12か月間にサイバーインシデントを経験しています。 なぜスポーツがこのように大きな標的となったかを説明するデータと当社の分析を紹介します。

A stadium during a major sporting event is simultaneously a city, a broadcast hub, a transport node, a public safety space, and a national symbol. That makes them attractive not just to criminals, but to politically motivated and state‑aligned threat actors willing to plan years ahead. With the 2026 FIFA World Cup spanning three nations and dozens of host cities, those challenges – and the AI now amplifying them – have never carried higher stakes.

This blog examines how attackers abuse the Chinese-developed Nezha monitoring tool, a legitimate open-source platform with remote access capabilities. Darktrace analysis of a honeypot intrusion highlights malicious deployment via containers, demonstrating how dual-use software enables stealthy operations, trust inversion, and detection challenges in dynamic cloud and enterprise environments modern.

Healthcare organizations rely on OT and IoMT more than ever. Learn why OT cybersecurity expertise, visibility, and governance are critical to reducing operational risk and strengthening cyber resilience.

Security leaders from global organizations share how the SOC is being redefined under growing pressure. In this roundtable blog, they explore challenges facing today’s SOCs and how AI is transforming operations to drive resilience, efficiency, and business growth.

Núclea prevented a highly targeted phishing attack exploiting trusted relationships—avoiding financial loss, data exposure, and disruption. Darktrace stopped the threat at the point of risk, protecting business continuity and strengthening resilience across the financial ecosystem.

製造業においては、効率、生産性、そしてオペレーショナル・レジリエンス（業務の強靭性・復旧力）を向上させるために、AIエージェントや自律型システムの導入が急速に進んでいます。しかしこれらの技術は新たなサイバーリスク、および運用上のリスクももたらしています。このブログでは、AI駆動の脅威、エージェントのアクティビティに対する可視性の欠如、そして攻撃手法の進化が、製造業にとってのセキュリティをどのように変化させているかを解説し、可視性、動作のコンテキスト、ガードレールの組み込みが、ITおよびOT環境の両方を保護する上で不可欠な基盤ととなりつつある理由について探ります。

Security leaders from global organizations across industries sat down with us to share their own front-line experiences and real-world perspectives on how modern attacks unfold, where hidden risks emerge, and how AI is reshaping the way organizations think about the role of security.

Buying AI cybersecurity tools requires more than evaluating features and marketing claims. This blog explores the challenges security teams face when assessing AI vendors, outlines five critical categories for AI evaluation, and explains how governance, transparency, model selection, and validation impact trust, adoption, and long-term security outcomes.

Follow a malicious email as it moves through Darktrace / EMAIL’s multi-layered AI system, from raw data to final decision. Each layer works together to detect threats, understand intent, and take autonomous action.

CIP-015 is pushing utilities beyond perimeter security toward continuous internal network visibility. This blog explores what the standard requires, why anomaly detection and evidence retention matter, and how utilities can build a defensible INSM capability before the October 2028 compliance deadline.