Cloud environments operate at speed, with workloads spinning up and down in seconds. This agility is great for business and is one of the main reasons for cloud adoption. But this same agility and speed presents new challenges for security teams. When a threat emerges, every second counts—yet many organizations struggle with slow Mean Time to Respond (MTTR) due to operational bottlenecks, outdated tooling, and the complexity of modern cloud infrastructure.

To minimize disruption and potential damage, containment is a critical step in incident response. By effectively responding to contain a threat, organizations can help prevent lateral movement limiting an attack’s impact.

However, containment is not the end goal. Full remediation requires a deep understanding of exactly what happened, how far the threat spread, and what assets were involved and what changes may be needed to prevent it from happening again.

This is why Darktrace’s recent acquisition of Cado is so exciting. Darktrace / CLOUD provides real-time threat detection and automated cloud native response for containment. With Cado, Darktrace / CLOUD ensures security teams have the forensic insights that are required to fully remediate and strengthen their defenses.

Why do organizations struggle with MTTR in the cloud?

Many security teams experience delays in fully responding to cloud threats due to several key challenges:

1. Limited access to cloud resources

Security teams often don’t have direct access to cloud environments because often infrastructure is managed by a separate operations team—or even an outsourced provider. When a threat is detected, analysts must submit access requests or escalate to another team, slowing down investigations.

This delay can be particularly costly in cloud environments where attacks unfold rapidly. Without immediate access to affected resources, the time to contain, investigate, and remediate an incident can increase significantly.

2. The cloud’s ephemeral nature

Cloud workloads are often dynamic and short-lived. Serverless functions, containers, and auto-scaling resources can exist for minutes or even seconds. If a security event occurs in one of these ephemeral resources and it disappears before forensic data is captured, understanding the full scope of the attack becomes nearly impossible.

Traditional forensic methods, which rely on static endpoints, fail in these environments—leaving security teams blind to what happened.

3. Containment is critical, but businesses require more

Automated cloud native response for containment is essential for stopping an attack in progress. However, regulatory frameworks underline the need for a full understanding to prove the extent of an incident and determine the root cause, this goes beyond just containing a threat.

Digital Operational Resilience Act (DORA): ^[1] Enacted by the European Union, DORA requires financial entities to establish robust incident reporting mechanisms. Organizations must detect, manage, and notify authorities of significant ICT-related incidents, ensuring a comprehensive understanding of each event's impact. This includes detailed analysis and documentation to enhance operational resilience and compliance.

Network and Information Security Directive 2 (NIS2): ^[2]This EU directive imposes advanced reporting obligations on essential and important entities, requiring them to report significant cybersecurity incidents to relevant authorities. Organizations must conduct thorough post-incident analysis to understand the incident's scope and prevent future occurrences.

Forensic analysis plays a critical role in full remediation, particularly when organizations need to:

• Conduct post-incident investigations for compliance and reporting.
• Identify affected data and impacted users.
• Understand attacker behavior to prevent repeat incidents.

Without a clear forensic understanding, security teams are at risk of incomplete remediation, potentially leaving gaps that adversaries can exploit in a future attack.

How Darktrace / CLOUD & Cado reduce MTTR and enable full remediation

By combining Darktrace / CLOUD’s AI-driven platform with Cado’s automated forensics capture, organizations can achieve rapid containment and deep investigative capabilities, accelerating MTTR metrics while ensuring full remediation in complex cloud environments.

Darktrace / CLOUD: Context-aware anomaly detection & cloud native response

Darktrace / CLOUD provides deep visibility into hybrid cloud environments, by understanding the relationships between assets, identity behaviours, combined with misconfiguration data and runtime anomaly activity. Enabling customers to:

• Detect and contain anomalous activity before threats escalate.
• Understand how cloud identities, permissions, and configurations contribute to organizational risk.
• Provide visibility into deployed cloud assets and services logically grouped into architectures.

Even in containerized services like AWS Fargate, where traditional endpoint security tools often struggle due to the lack of persistent accessible infrastructure, Darktrace / CLOUD monitors for anomalous behavior. If a threat is detected, security teams can launch a Cado forensic investigation from the Darktrace platform, ensuring rapid evidence collection and deeper analysis.

Ensuring:

• Complete timeline reconstruction to understand the full impact.
• Identification of persistence mechanisms that attackers may have left behind.
• Forensic data preservation to meet compliance mandates like DORA, NIS2, and ISO 27001.

The outcome: Faster, smarter incident response

Darktrace / CLOUD with Cado enables organizations to detect, contain and forensically analyse activity across hybrid cloud environments

• Reduce MTTR by automating containment and enabling forensic analysis.
• Seamlessly pivot to a forensic investigation when needed—right from the Darktrace platform.
• Ensure full remediation with deep forensic insights—even in ephemeral environments.

Stopping an attack is only the first step—understanding its impact is what prevents it from happening again. Together, Darktrace / CLOUD and Cado empower security teams to investigate, respond, and remediate cloud threats with speed and confidence.

References

^[1] eiopa.europa.eu

^[2] https://zcybersecurity.com/eu-nis2-requirements

At the end of 2023, over half of cybersecurity professionals (60%) reported feeling unprepared for the reality of AI-augmented cyber threats. Twelve months later, that number had dropped to 45%—a clear sign that the industry has recognized the urgency of AI-driven threats and is taking steps to prepare.

This preparation has involved enhancing and optimizing technology and processes in the SOC, improving cybersecurity awareness training, and improving integration among existing cybersecurity solutions. But the biggest priority in addressing the challenge posed by AI-powered cyber-threats, according to the more than 1,500 cybersecurity professionals we surveyed around the world, is defenders themselves adopting defensive AI to fight fire with fire.  

In December 2023, 58% listed ‘adding AI-powered security tools to supplement existing solutions’ as a top priority for their teams. By December 2024, it had risen to 64%.  

On the other end of the spectrum, ‘increasing security staff’ fell to just over 10% – and only 8% among CISOs. This is despite ‘insufficient personnel’ being listed as the top challenge which inhibits organizations in the fight against AI-powered cyber-threats. This underscores a stark reality: while teams are understaffed and struggling, hiring the right talent is so challenging that expanding headcount is often seen as an unrealistic solution.

What security leaders are looking for in AI-powered solutions

As AI adoption accelerates, confidence in AI-powered security tools remains high, with over 95% of respondents agreeing that AI-enhanced solutions improve their ability to combat advanced threats. But what exactly are security leaders prioritizing when evaluating vendors?

Three key principles emerged:

1. Platform solutions over point products – 88% of respondents prefer integrated security platforms over standalone tools, emphasizing the need for cohesive and streamlined defense strategies.

2. A shift toward proactive security – 87% favor solutions that free up security teams to focus on proactive risk management, rather than reacting to attacks after they occur.

3. Keeping data in-house – 84% express a strong preference for security tools that retain sensitive data within their organization, rather than relying on cloud-hosted ‘data lakes’ for analysis.

The knowledge delta: AI knowledge is growing, but there is a long way to go  

While AI adoption is accelerating, how well do security leaders understand the AI technologies they are deploying? Do they have the expertise to differentiate between effective solutions and vague marketing claims?

Our survey found that overall familiarity with AI techniques is improving, particularly with generative AI, which saw the most significant increase in understanding over the past year. Respondents also reported growing awareness of supervised machine learning, Generative Adversarial Networks (GANs), deep learning, and natural language processing. However, knowledge of unsupervised machine learning—critical for identifying novel threats—actually declined.

Alarmingly, 56% of respondents admitted they do not fully understand the AI techniques used in their existing security stack. Clearly there is a long way to go in understanding this vast and fast-changing landscape. Darktrace has recently published a whitepaper breaking down the different AI types in use in cybersecurity which you can read here.  

For many security leaders, staying ahead starts with understanding industry trends: how CISOs are thinking about AI’s impact, the steps they are taking, and the challenges they face. Our full State of AI Cybersecurity report is now available, offering deeper insights into these trends across industries, regions, company sizes, and job roles.

Download the full report to explore these findings in depth

‍