A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.

Darktrace is integrating with Microsoft Agent 365 to bring behavior-based AI agent risk signals directly into the Microsoft 365 Admin Center. The integration gives security teams a more unified view of agent activity, helping them identify anomalous behavior, investigate potential risks, and manage AI agents more efficiently across Microsoft environments.

Darktrace tested whether an enterprise AI agent could be targeted through a hidden prompt injection delivered by email, and whether behavioral email analysis could detect and respond to the attack before it reached the agent. The experiment found that although the email contained no malware, malicious links, or sender reputation indicators, Darktrace / EMAIL identified the attack based on anomalous language and behavioral context.

Darktrace’s analysis of the first half of 2026 shows attackers increasingly exploiting trust rather than bypassing security controls. Identity compromise, supply-chain attacks, SaaS abuse, AI-enabled operations, and state-aligned activity demonstrate how trusted users, services, and infrastructure have become key attack paths. For defenders, context and behavioral analysis remain essential foundations of security.

This marine organization uses Darktrace to strengthen cyber resilience across its distributed marine operations, protecting email, identity, network, and cloud environments while reducing manual triage for its lean ICT team. With autonomous response and unified visibility, Darktrace helps support operational continuity across mission-critical services.

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.

New capabilities help employees understand suspicious content, give administrators more control over sensitive data, and show security teams where risky workflows sit across the organization.

Traditional security controls were built for predictable systems. AI is different. This blog explores why behavioral detection and explainable autonomous containment are essential security layers for managing AI risk without slowing innovation.

As AI agents become more autonomous, understanding behavior is becoming even more important. The OpenAI and Hugging Face incident highlights why behavioral security is foundational to securely deploying AI in the enterprise.

Stadiums’ scale and complexity make them some of the toughest environments in cybersecurity. Now, we’re adding AI to those operations and bringing a new dimension of risk. Explore how security teams can secure AI in live-event environments to make stadiums safer for fans.

As AI reshapes the threat landscape, attackers exploit vulnerabilities faster, abuse trusted identities, and leverage AI-driven tools and integrations to operate at scale. Drawing on real-world Darktrace observations, this article explores why behavioral detection, continuous trust validation, and early anomaly identification are becoming essential to defending modern enterprises.

Darktrace investigated a compromised AI gateway connected to Amazon Bedrock services that was later observed communicating with cryptomining infrastructure. The incident highlights how AI gateways are becoming part of the enterprise attack surface and demonstrates the importance of behavioral analysis, cloud visibility, and securing AI infrastructure alongside identities and workloads.

NIST's latest research argues that no finite set of AI guardrails can defend against every adversarial prompt, reinforcing a fundamental shift in how organizations should approach AI security. This blog explores why static rules alone are insufficient, why behavior provides the only stable signal of risk, and what this means for building resilient AI security strategies.

As organizations accelerate AI adoption, securing AI requires more than governance policies or model guardrails. This guide explores how security leaders can build a defense-in-depth strategy that addresses AI across governance, identity, data security, secure development, runtime monitoring, and incident response. Drawing on recent guidance from NIST and the Five Eyes alliance, it outlines the core capabilities organizations should prioritize to securely adopt AI while reducing operational and cyber risk.

We recently spoke with security leaders about the operational complexities and security risks AI is creating. As organizations accelerate adoption, five recurring concerns emerged, risks that are quietly reshaping the security landscape

As organizations rapidly adopt AI, Shadow AI is becoming one of the biggest governance and security challenges. This blog explores why Shadow AI is difficult to detect, where traditional visibility falls short, and how organizations can combine governance, behavioral analysis, and runtime visibility to reduce AI-related risk across enterprise environments

Healthcare CIO explains how layering Darktrace onto Microsoft security improved visibility, reduced risk, and minimized operational burden. Darktrace’s AI-native, agentless approach delivered proactive threat detection, seamless integration, and enterprise-grade protection, helping resource-constrained nonprofit teams balance strong cybersecurity with patient care priorities.

Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.

Prompt analysis is emerging as a critical frontier in AI security as enterprises increasingly interact with systems through language. While prompts can reveal user intent, they are inherently ambiguous when viewed in isolation. Effective prompt security requires contextual analysis across identity, behavior, systems, and business activity to distinguish normal AI use from real risk.

Darktrace is partnering with OpenAI to integrate their cyber capabilities within Darktrace products and services.

Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.

This blog examines how attackers abuse the Chinese-developed Nezha monitoring tool, a legitimate open-source platform with remote access capabilities. Darktrace analysis of a honeypot intrusion highlights malicious deployment via containers, demonstrating how dual-use software enables stealthy operations, trust inversion, and detection challenges in dynamic cloud and enterprise environments modern.

84% of sports organizations had a cyber incident in the past 12 months. Here is what the data and our analysis tells us about why sport has become such a target.

Healthcare organizations rely on OT and IoMT more than ever. Learn why OT cybersecurity expertise, visibility, and governance are critical to reducing operational risk and strengthening cyber resilience.

Security leaders from global organizations share how the SOC is being redefined under growing pressure. In this roundtable blog, they explore challenges facing today’s SOCs and how AI is transforming operations to drive resilience, efficiency, and business growth.