Blog
/
Network
/
November 13, 2024

Tactics Behind the Royal and Blacksuit Ransomware

Delve into the complexities of the Royal and Blacksuit ransomware strains and their implications for cybersecurity in today’s digital landscape.
Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst
Default blog image
13
Nov 2024

What is BlackSuit Ransomware?

Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.

Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.

BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.

The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].

Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.

Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].

About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.

An example of the contents of a BlackSuit ransom note being written over SMB.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.

During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.

10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.

Case 2, February 2024

Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.

Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.

Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.

Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.

In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.

Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.

Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.

A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.

Case 3, August 2024

The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.

Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.

The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.

Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.

Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.  

One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.

Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.

Conclusion

The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.

Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.

These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.

Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Insights from Darktrace’s First 6: Half-year threat report for 2024

First 6: half year threat report darktrace screenshot

Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.

  • Focuses on anomaly detection and behavioral analysis to identify threats
  • Maps mitigated cases to known, publicly attributed threats for deeper context
  • Offers guidance on improving security posture to defend against persistent threats

‍

‍

Appendices

Darktrace Model Detections

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / SMB Enumeration

Anomalous Connection / Suspicious Activity On High Risk Device

Anomalous Connection / Suspicious Read Write Ratio

Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB

Anomalous Connection / Sustained MIME Type Conversion

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin SMB Session

Anomalous File / Internal / Additional Extension Appended to SMB File

Anomalous File / Internal / Executable Uploaded to DC

Anomalous File / Internal / Unusual SMB Script Write

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Write to Network Accessible WebRoot

Compliance / Outgoing NTLM Request from DC

Compliance / Remote Management Tool On Server

Compliance / SMB Drive Write

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Ransomware / Possible Ransom Note Read

Compromise / Ransomware / Possible Ransom Note Write

Compromise / Ransomware / SMB Reads then Writes with Additional Extensions

Compromise / Ransomware / Suspicious SMB Activity

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / EXE Files Distributed to Multiple Devices

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Device / Large Number of Model Breaches from Critical Network Device

Device / Multiple Lateral Movement Model Breaches

Device / Network Scan

Device / New or Uncommon WMI Activity

Device / New or Unusual Remote Command Execution

Device / New User Agent To Internal Server

Device / SMB Lateral Movement

Device / SMB Session Brute Force (Admin)

Device / Suspicious SMB Scanning Activity

Device / Unusual LDAP Query For Domain Admins

SaaS / Access / Teams Activity from Rare Endpoint

SaaS / Resource / SaaS Resources With Additional Extensions

SaaS / Unusual Activity / Disabled Strong Authentication

SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores

SaaS / Unusual Activity / Unusual SaaS Activity Score

SaaS / Unusual Activity / Unusual Volume of SaaS Modifications

Unusual Activity / Anomalous SMB Delete Volume

Unusual Activity / Anomalous SMB Move & Write

Unusual Activity / High Volume Client Data Transfer

Unusual Activity / High Volume Server Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / SMB Access Failures

Unusual Activity / Sustained Anomalous SMB Activity

Unusual Activity / Unusual External Data to New Endpoint

User / New Admin Credentials on Client

User / New Admin Credentials on Server

User/ Kerberos Password Bruteforce

Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Ransomware Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / SMB Ratio Antigena Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Breaches

Antigena / SaaS / Antigena Unusual Activity Block

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High

readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High

mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High

137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium

173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium

216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium

MITRE ATT&CK Mapping

Tactic - Technqiue

Account Manipulation - PERSISTENCE - T1098

Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878

Application Layer Protocol - COMMAND AND CONTROL - T1071

Automated Collection - COLLECTION - T1119

Block Command Message - INHIBIT RESPONSE FUNCTION - T0803

Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804

Browser Extensions - PERSISTENCE - T1176

Brute Force I/O - IMPAIR PROCESS CONTROL - T0806

Brute Force - CREDENTIAL ACCESS - T1110

Client Configurations - RECONNAISSANCE - T1592.004 - T1592

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Data Destruction - IMPACT - T1485

Data Destruction - INHIBIT RESPONSE FUNCTION - T0809

Data Encrypted for Impact - IMPACT - T1486

Data from Cloud Storage Object - COLLECTION - T1530

Data Staged - COLLECTION - T1074

Domain Groups - DISCOVERY - T1069.002 - T1069

Email Collection - COLLECTION - T1114

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Exploit Public - Facing Application - INITIAL ACCESS - T1190

Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

File and Directory Discovery - DISCOVERY - T1083

File Deletion - DEFENSE EVASION - T1070.004 - T1070

IP Addresses - RECONNAISSANCE - T1590.005 - T1590

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557

Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838

Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833

Modify Parameter - IMPAIR PROCESS CONTROL - T0836

Network Service Scanning - DISCOVERY - T1046

Network Share Discovery - DISCOVERY - T1135

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563

Remote Access Software - COMMAND AND CONTROL - T1219

Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021

Remote System Discovery - DISCOVERY - T1018

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595

Scheduled Transfer - EXFILTRATION - T1029

Service Execution - EXECUTION - T1569.002 - T1569

Service Stop - IMPACT - T1489

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Stored Data Manipulation - IMPACT - T1565.001 - T1565

Taint Shared Content - LATERAL MOVEMENT - T1080

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

Web Shell - PERSISTENCE - T1505.003 - T1505

Windows Management Instrumentation - EXECUTION - T1047

Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021

References

1.     https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html

2.     https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/

3.     https://www.sentinelone.com/anthology/blacksuit/

4.     https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html

5.     https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened

6.     https://therecord.media/japanese-media-kadokawa-investigating-cyber

7.     https://therecord.media/plasma-donation-company-cyberattack-blacksuit

8.     https://thecyberexpress.com/government-of-brazil-cyberattack-by-blacksuit/

9.     https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Network
•
June 24, 2026
Justin Torres
Cyber Analyst
Watch the NIS2 Webinar
Trending blogs
1
Prompt Security in Enterprise AI: Strengths, Weaknesses, and Common Approaches
May 20, 2026
2
What the Darktrace Annual Threat Report 2026 Means for Security Leaders
Feb 26, 2026
3
Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL
May 26, 2026
4
How to Evaluate AI Vendors: 5 Key categories for AI Adoption
May 27, 2026
5
Darktrace Unites Human Behavior and Threat Detection Across Email, Slack, Teams, and Zoom
Mar 24, 2026

More in this series

No items found.
Continue reading
Network
•
June 24, 2026

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.
Justin Torres
Cyber Analyst
Read more
Network
•
June 15, 2026

Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining

Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.
Min Kim
Cyber Security Analyst
Read more
Network
•
June 10, 2026

How Attackers Abuse the Chinese Nezha Monitoring Tool

This blog examines how attackers abuse the Chinese-developed Nezha monitoring tool, a legitimate open-source platform with remote access capabilities. Darktrace analysis of a honeypot intrusion highlights malicious deployment via containers, demonstrating how dual-use software enables stealthy operations, trust inversion, and detection challenges in dynamic cloud and enterprise environments modern.
Nathaniel Bill
Malware Research Engineer
Read more

Blog

/

AI

/

June 30, 2026

5 Ways AI is changing traditional security models according to modern CISOs

Default blog imageDefault blog image

The Reality of Securing AI in Motion

Traditional security tools were built for environments defined by fixed rules and predictable workflows. But AI behavior is non-deterministic. The same prompt can produce different outcomes, and risk often emerges gradually as AI behavior adapts, and permissions drift over time. This creates a constantly shifting environment where security teams are working to define control in a system that resists stability. “In AI security, yesterday's priorities can become tomorrow's blind spots. The landscape shifts that fast,” warned the SVP and Head of Technology and Cybersecurity of a real estate investment trust. Conventional approaches, which rely on establishing and maintaining a steady baseline, struggle to keep up with that level of change.

At the same time, AI adoption is accelerating across organizations, often faster than security teams can implement the controls needed to manage it. “The car is being built while it’s already on the road,” explained the CISO of a global private fund administrator. “The threats we're securing against today won't be the threats we're facing tomorrow. What kept us up three months ago looks nothing like what we're dealing with today.”

As businesses move quickly to unlock value from AI, security teams are left closing gaps in real time, while also facing adversaries who are using AI to make their attacks more scalable, adaptive, and difficult to detect. In this recent roundtable discussion of CISOs and security leaders, five themes emerged around AI cyber risk.  

1. AI agents with human access but no human judgment

In Darktrace’s 2026 State of AI Cybersecurity report, 96% of the surveyed security professionals agree that AI significantly improves the speed and efficiency with which they work. Yet, 92% admitted that they’re concerned with the security implications of the use of AI agents across their workforce.

AI agents now operate with human-level permissions across systems, acting at machine speed, orchestrating actions across platforms, and making decisions without the judgment or caution a person would apply. Unlike human users, they cannot be expected to pause and question whether a given action is appropriate.

Their identities are also difficult to inventory, govern, and audit. As agents become easier to deploy than legacy IT systems ever were, organizations are quickly losing track of what is running, what it has access to, and what it is doing. This creates a growing class of highly privileged, autonomous actors operating without the visibility or oversight that traditional identity and access controls were designed to provide.“While AI adoption is critical to running a modern business, AI alone can’t solve all our cybersecurity challenges,” said a global financial sector CISO. “We still need think critically and use human judgement. Those are two things AI can’t do.”

This lack of human judgment becomes especially risky as new architectures, such as Model Context Protocol (MCP), can expand how agents connect to data, tools, and external systems. By design, MCP enables agents to dynamically discover and interact with new resources, increasing flexibility but also introducing new pathways for unintended access, data exposure, or abuse if not properly governed.

The CISO of a fund administrator highlighted one emerging vector as an example: rogue MCP servers. “Our developers want to move quickly and bring value to the business, but technologies like these can unintentionally expose sensitive data in ways that would never have happened before.”

2. Increased digital complexity and expanded attack surface

AI activity rarely stays contained. A single prompt can trigger a chain of actions across networks, email, cloud infrastructure, SaaS platforms, endpoints, identity systems, and development environments, spanning systems that were never designed to be secured as a single, connected flow. This expands both the scale and complexity of what security teams need to monitor and defend.

Yet no single control has visibility across that entire chain. “You can’t defend effectively what you can’t see,” cautioned the private fund administrator CISO. As AI-driven activity moves fluidly across environments, gaps in coverage become inevitable, creating blind spots that attackers can exploit.

Threat actors are already capitalizing on this lack of visibility. “Threat actors have advanced their use of generative AI to launch more convincing phishing campaigns, automate social engineering, and scale attacks with greater precision down to the individual level,” said the SVP of Technology and Cybersecurity for the real estate investment trust. What was once manual and targeted can now be automated and personalized at scale, making attacks harder to detect and easier to execute.

At the same time, the pace of exploitation is accelerating. As a global CISO operating across 40+ countries described it: “Zero-day vulnerabilities are no longer zero day; it’s minus one day. By the time you get to it and address it, it’s already a problem.” By the time risk is identified, it has often already been realized.

The result is a rapidly expanding and increasingly interconnected attack surface that challenges security teams to maintain visibility, context, and control across AI-driven activity.

3. Shadow AI is already everywhere

76% of organizations now cite shadow AI as a problem, one that is spreading through organizations in ways that are hard to track and even harder to control.

Employees are experimenting with publicly available Gen AI tools. Teams are spinning up low-code automations on their own. SaaS providers are quietly embedding AI into existing products. Developers are plugging AI services directly into workflows, often without pausing to consider what that exposure means.

The result is a lack of visibility into:

  • What AI tools are being used
  • What data those tools can access
  • Where prompts and outputs are going
  • Which AI agents are interacting with enterprise systems

The SVP of Cybersecurity at a real estate investment trust described the shift: “Before, I was worried about someone sending data erroneously to their personal email. Now we have all these agents online that people are utilizing, and we’re looking at those vectors as well.” For security teams, this means operating without a complete view of how AI is being used, what it can access, and where risk may already be emerging.

4. Built-in guardrails are not enough

Organizations often assume that native AI guardrails or provider-level controls are sufficient to manage AI risk. But securing AI requires ongoing visibility, oversight, and governance, not just controls configured at deployment. "It’s a misconception that adopting AI is going to solve all your problems,” warns a global financial services CISO.

Security leaders are increasingly recognizing the limitations of these controls as:

  • Fragmented and difficult to enforce consistently across multiple AI systems, workflows, and environments
  • Ambiguous in terms of accountability due to shared responsibility for AI governance between IT, security, developers, business teams, and third-party providers
  • Limited in end-to-end oversight, leaving gaps that stretch from the initial prompt all the way through to the downstream impact of an agent's actions

Securing AI demands more than simple prompt filtering or static policy enforcement. It requires understanding intent, behavior, and context across both human and AI activity.

The next phase of cybersecurity: securing AI

To safely and responsibly adopt AI at scale, organizations need a new operational model for cybersecurity that’s capable of:

• Understanding AI behavior

• Identifying risk in real time

• Maintaining governance without slowing innovation

The CSO of a $10 billion municipal utility organization described the challenge with precision: “We have to move at the speed of innovation and risk, because both are accelerating faster than ever.”

Embrace AI with confidence with Darktrace / SECURE AI

Darktrace has introduced Darktrace / SECURE AI™, a new product within the Darktrace ActiveAI Security Platform™  ,designed to provide enterprise-wide security for AI by applying industry leading behavioral analysis to how prompts, agents, and AI systems are used.

Darktrace / SECURE AITM delivers real-time visibility and control across Enterprise and SaaS GenAI prompts, AI agent identities, development and production environments, and Shadow AI - detecting even subtle misuse, misconfiguration, and drift that traditional, rule-based controls simply do not understand. By interpreting context and intent across humans and machines, Darktrace enables organizations to adopt AI at scale without introducing unmanaged risk

What makes this possible is Darktrace’s decade-long maturity and expertise in behavioral understanding and AI-native cybersecurity. Achieved with Self-Learning AI that has been proven across more than 10,000 organizations, Darktrace understands what “normal” looks like for a business, across its users, systems, and now AI, so that meaningful deviations can be detected and acted on before they become incidents.

With one CISO describing Darktrace’s Self-Learning AI as “a leap forward compared to other tools” and another as a “force multiplier,” the technology can interpret ambiguous interactions, understand how access accumulates over time, and recognize when behavior, human or machine, begins to drift.

“Strategically, we’re looking to gain more visibility into how AI is operating across the environment and achieve greater control over what AI should be allowed to access and do,” shared the CISO at a private fund administrator.  

“What I’ve seen from Darktrace / SECURE AI is extremely promising. I have tremendous confidence in Darktrace’s vision for where this is headed and its ability to execute on this new solution.”

‍

Continue reading
About the author
The Darktrace Community

Blog

/

Email

/

June 29, 2026

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

Default blog imageDefault blog image

How Darktrace Transformed Cybersecurity at Our Health Center: A CIO’s Perspective

In my role as CIO, I bring years of experience leading IT for healthcare organizations. I’ve seen firsthand the unique cybersecurity challenges that nonprofit health centers face: limited budgets, small IT teams, and the constant pressure to prioritize patient care over technology investments. Yet, the threat landscape for health is relentless, and the stakes for protecting patient data and ensuring operational continuity have never been higher. It’s a balancing act.

The search for a better solution

Like many nonprofits, organizations I work at start with Microsoft’s security stack. The discounted pricing for nonprofits makes it an obvious choice, and Microsoft Defender provided a solid foundation for endpoint and email security. However, I quickly realized that relying on a single vendor, even one as robust as Microsoft, left gaps in our defenses. Cybersecurity is never one-size-fits-all, which is why my preference was to layer an additional solution on top of our native security to improve our security posture.

Teams needed a solution that could layer seamlessly on top of Microsoft, without adding complexity or draining limited resources. That’s when I found Darktrace. I had heard of their reputation after seeing how other organizations used Darktrace to secure their infrastructure and was impressed by their AI-native, agentless approach and agreed to a proof of value (POV).

Our goal was to elavate Microsoft with an additional layer of intelligence- one that could seamlessly integrate, operate autonomously, and support a small team without increasing overhead. We turned to Darktrace because its AI-native, agentless approach offered a fundamentally different way to detect and respond to threats, learning our environment in real time and filling gaps that traditional tools can miss. With a quick POV, we were able to validate how effectively Darktrace works alongside Microsoft to deliver a more complete and resilient security architecture.

Why Darktrace stood out

From the start, Darktrace differentiated itself in several critical ways:

  • Deep visibility: Unlike other solutions that rely simply on host-based monitoring with endpoint agents, Darktrace operates passively at the network layer and integrates via APIs for email and identity security. This gave full visibility into network traffic that we previously didn’t have, going beyond our existing endpoint-based tools without adding additional maintenance overhead for our small IT team.
  • AI-native from the ground up: Darktrace wasn’t just layering AI on top of an existing product; it was built with AI at its core. Their autonomous detection and response to threats immediately reduced the need for constant human supervision. In a world where cyber-attacks are increasingly sophisticated and subtle, having an AI that learns our environment and adapts in real time is invaluable.
  • Comprehensive coverage: We started with a POV focused on email security, but quickly expanded to full deployment across our entire infrastructure. Darktrace’s products now protect our email, network, and identity layers, providing visibility and defense against lateral movement and abnormal behavior that traditional tools often miss.

Integration and workflow: Smooth and simple

One of the most impressive aspects of Darktrace is how easy it was to integrate into an existing environment. For network security, it was as simple as plugging an appliance into our top-of-rack switch – no downtime, no complex configuration. For email and identity, API integrations meant we could be up and running in hours, not weeks.

This simplicity extended to day-to-day operations. Our IT team received regular security reports, and any time we had questions or needed to adjust policies, Darktrace’s support team was there with white-glove service. Their responsiveness- even in the middle of the night- gave us confidence that we had true partners, not just a vendor.

Real-world impact: Threats stopped, time saved

The results spoke for themselves. During the time with Darktrace, I did not experience any security incidents. The team slept better at night knowing that Darktrace was monitoring for anomalies and proactively blocking suspicious activity, alerting us even before we noticed anything was wrong.

A memorable example was during an Electronic Health Record (EHR) upgrade, when my team forgot to adjust the policy in advance. Darktrace’s autonomous response was so effective that it blocked our upgrade activities- proof that nothing, not even internal changes, could slip by unnoticed. This level of vigilance meant that ransomware, data exfiltration attempts, or insider threats would be detected and contained before causing harm.

While I can’t share specific ROI numbers, the value was clear: we’ve avoided costly breaches, reduced the time spent investigating alerts, and eliminated the performance drag of agent-based tools. With Darktrace layered on top of Microsoft, I’ve hit the right balance of maximum protection with minimal spending. The cost of Darktrace / EMAIL was competitive, especially when factoring in the included Managed Detection and Response (MDR) service, which provides expert human oversight on top of the AI.

Key differentiators over the competition

  • Extending visibility beyond the endpoint: Traditional host-based monitoring solutions, such as EDR, play a critical role in securing individual devices. By adding a network detection and response (NDR) layer, we gained visibility into activity across our wider digital environment, surfacing threats that move laterally, operate between devices, or bypass endpoint controls. Darktrace also stood out for its ability to learn our normal patterns of behavior and identify subtle deviations in real time, not just known indicators of compromise. Because this is delivered through passive, non-disruptive monitoring, we were able to strengthen our defenses without adding complexity or impacting performance.
  • Layered security without complexity: Darktrace elevated our Microsoft foundation without creating conflicts or requiring us to disable existing protections. This layered approach maximized our security posture without adding operational burden.
  • Expert partnership: Beyond technology, Darktrace’s team acted as true partners, guiding us through deployment, providing ongoing support, and helping us interpret findings. This partnership was as valuable as the technology itself.

Advice for other nonprofits

If you’re an IT leader in a nonprofit, my advice is simple: look for solutions that are easy to deploy, intelligent in their response, and cost-effective. Don’t settle for more endpoint based tools that overlap with what you already have. Seek out a layered approach that covers your blind spots – especially at the network and email layers- at a price point that suits your organization.

Most importantly, don’t be afraid to evaluate new solutions. Even if you’re inundated with vendor pitches, you owe it to your organization to explore options that could save you time, money, and sleepless nights.

For organizations I work at, combining Microsoft’s security stack with Darktrace’s AI-native, platform struck the right balance between protection and practicality. We gained enterprise-grade security without sacrificing performance or stretching our budget. In the end, that meant more resources for what matters most: delivering care to our patients. If you’re facing similar challenges, I encourage you to consider how Darktrace could transform your security posture, and give your team the peace of mind they deserve.

For the organization I work in, combining Microsoft with Darktrace delivered a clear step-change in our security posture. Microsoft provided the foundation, while Darktrace’s behavioral intelligence added visibility into the unknown, surfacing emerging threats based on deviations in real-time activity, not just known indicators.

The result was enterprise-grade protection without added overhead, allowing us to stay focused on patient outcomes, not security operations. For organizations facing similar pressures, this layered approach offers a smarter, more efficient path to securing modern environments.

Continue reading
About the author
Mice Chen
Chief Information Security Officer
Your data. Our AI.
Elevate your network security with Darktrace AI