Blog
/
/
May 25, 2021

How Autonomous Cyber AI Scaled to Protect Arrow McLaren SP

Darktrace's Cyber AI has seamlessly scaled, extended, and adapted to protect Arrow McLaren's Formula 1 and IndyCar teams from machine-speed cyberattacks.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Fier
SVP, Red Team Operations
Written by
Nick Snyder
Performance Director, Arrow McLaren SP
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
25
May 2021

It’s been decades since a racing team has had the ambition to compete at the highest level simultaneously in Formula 1 and in the NTT INDYCAR Series. And why would they? With hectic schedules, tight timelines, and the finest margins between victory and defeat, one series alone may seem a daunting enough feat. But to compete across both requires cross-continent collaboration, creativity, and innovation at every turn.

Rather than being daunted by the challenge, McLaren has embraced the unique advantages of racing in both series simultaneously. Arrow McLaren SP, in a strategic partnership with McLaren Racing, communicates on a daily basis with the McLaren Technology Centre in the UK, gathering and sharing data including car telemetry, on-board video and audio files, timing and scoring information, car set-ups, and reporting.

The security of this critical and highly sensitive data is paramount to the performance of AMSP, and after the success of Darktrace’s AI in protecting the cloud, email, and network environments of McLaren F1, AMSP recently announced they would be seamlessly extending the coverage to the US.

How adaptive, scalable AI drives success

Darktrace’s autonomous Cyber AI has protected the McLaren F1 team since early 2020, shielding their workforce and critical systems during a time of fundamental digital change, with conditions arising from COVID-19 forcing many employees to work from home. During this time the organization had a heightened reliance on cloud collaboration platforms, including video conferencing and file sharing.

Cyber AI technology adapted to these unforeseen changes, protecting the McLaren F1 team from novel and advanced attacks targeting their dynamic workforce. While traditional tools bound by set rules and playbooks had to be reconfigured, a self-learning approach allowed continuous protection of McLaren’s email systems, cloud services, and network traffic, with little maintenance required from busy human teams.

Now, the technology is being put to the test again. McLaren has extended Darktrace’s AI technology to protect the large volumes of sensitive data that travels back and forth between Arrow McLaren SP and the MTC.

Responding to machine-speed ransomware with Autonomous Response

As a wave of ransomware attacks brings fresh concerns to the cyber security industry, AMSP is turning to a technology fundamental to stopping these machine-speed attacks. With Autonomous Response, Darktrace not only detects emerging threats, but responds in real time, stopping attackers in their tracks without human teams having to lift a finger.

The response is surgical and proportionate: only the malicious activity is contained, whilst normal operations are allowed to continue. This will be a crucial capability for the AMSP team, as any unnecessary downtime severely undermines their ability to get access to the right data at the right time – ultimately having an impact on performance on race day.

With Darktrace’s autonomous Cyber AI protecting both its F1 and INDYCAR teams, McLaren’s human IT resources are augmented with real-time protection and Autonomous Response working across different time zones and providing that 24/7 overwatch they need.

Indianapolis 500: The toughest test yet

The month of May is a busy and critical period of the season for AMSP, with three races culminating in the 105th Running of the Indianapolis 500, which will be held in front of a reduced crowd of 135,000 spectators. The IT team has been busy preparing a temporary trackside data centre for this event, and the sheer volume of data circulating between that and the MTC is ramping up.

All of this data must be gathered, organized, and transferred securely back and forth between the two hubs. The speed of that transfer is absolutely vital, as speed of analysis and real-time decision-making is critical to race performance. AMSP’s engineering team and McLaren’s engineering team operate as if they’re sitting next to each other, despite being thousands of miles away.

Moreover, some data files can be extremely large, and reliable connectivity is key in ensuring that all files, no matter the size, can be transferred and downloaded as quickly as possible. Lack or loss of any data gathered trackside would prevent AMSP’s abilities to accurately recap on-track sessions.

This clearly represents an incredibly busy time for the security personnel on the ground both at Indianapolis and in the UK. Leaning on AI to facilitate the secure and reliable movement of highly sensitive data empowers AMSP’s IT team to stay proactive, rather than being reactive and playing catch up in the case of a security incident.

Facing the future with Cyber AI

AMSP is in a unique position in the INDYCAR paddock – no other team transmits so much data, so often or over so far of a distance. Darktrace’s Cyber AI technology is helping to protect AMSP’s at-track engineering crews, remote engineering teams, data transfer processes and cloud infrastructure, from an increasingly hostile cyber-threat landscape.

Relying on Darktrace to safeguard and protect its sensitive data and digital assets will become critical in securing AMSP’s overall approach to race weekend activation. As the collaboration between McLaren Racing and Arrow McLaren SP continues to drive success on the track, the targeted actions of Darktrace’s Autonomous Response capability ensures both sides of the technical partnership stay protected across different time zones, around the clock, no matter what threat is waiting round the corner.

Visit the McLaren hub

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Fier
SVP, Red Team Operations
Written by
Nick Snyder
Performance Director, Arrow McLaren SP

More in this series

No items found.

Blog

/

AI

/

March 2, 2026

What the Darktrace Annual Threat Report 2026 Means for Security Leaders

Image of the Earth from spaceDefault blog imageDefault blog image

The challenge for today’s CISOs

At the broadest level, the defining characteristic of cybersecurity in 2026 is the sheer pace of change shaping the environments we protect. Organizations are operating in ecosystems that are larger, more interconnected, and more automated than ever before – spanning cloud platforms, distributed identities, AI-driven systems, and continuous digital workflows.  

The velocity of this expansion has outstripped the slower, predictable patterns security teams once relied on. What used to be a stable backdrop is now a living, shifting landscape where technology, risk, and business operations evolve simultaneously. From this vantage point, the central challenge for security leaders isn’t reacting to individual threats, but maintaining strategic control and clarity as the entire environment accelerates around them.

Strategic takeaways from the Annual Threat Report

The Darktrace Annual Threat Report 2026 reinforces a reality every CISO feels: the center of gravity isn’t the perimeter, vulnerability management, or malware, but trust abused via identity. For example, our analysis found that nearly 70% of incidents in the Americas region begin with stolen or misused accounts, reflecting the global shift toward identity‑led intrusions.

Mass adoption of AI agents, cloud-native applications, and machine decision-making means CISOs now oversee systems that act on their own. This creates an entirely new responsibility: ensuring those systems remain safe, predictable, and aligned to business intent, even under adversarial pressure.

Attackers increasingly exploit trust boundaries, not firewalls – leveraging cloud entitlements, SaaS identity transitions, supply-chain connectivity, and automation frameworks. The rise of non-human identities intensifies this: credentials, tokens, and agent permissions now form the backbone of operational risk.

Boards are now evaluating CISOs on business continuity, operational recovery, and whether AI systems and cloud workloads can fail safely without cascading or causing catastrophic impact.

In this environment, detection accuracy, autonomous response, and blast radius minimization matter far more than traditional control coverage or policy checklists.

Every organization will face setbacks; resilience is measured by how quickly security teams can rise, respond, and resume momentum. In 2026, success will belong to those that adapt fastest.

Managing business security in the age of AI

CISO accountability in 2026 has expanded far beyond controls and tooling. Whether we asked for it or not, we now own outcomes tied to business resilience, AI trust, cloud assurance, and continuous availability. The role is less about certainty and more about recovering control in an environment that keeps accelerating.

Every major 2026 initiative – AI agents, third-party risk, cloud, or comms protection – connects to a single board-level question: Are we still in control as complexity and automation scale faster than humans?

Attackers are not just getting more sophisticated; they are becoming more automated. AI changes the economics of attack, lowering cost and increasing speed. That asymmetry is what CISOs are being measured against.

CISOs are no longer evaluated on tool coverage, but on the ability to assure outcomes – trust in AI adoption, resilience across cloud and identity, and being able to respond to unknown and unforeseen threats.

Boards are now explicitly asking whether we can defend against AI-driven threats. No one can predict every new behavior – survival depends on detecting malicious deviations from normal fast and responding autonomously.  

Agents introduce decision-making at machine speed. Governance, CI/CD scanning, posture management, red teaming, and runtime detection are no longer differentiators but the baseline.

Cloud security is no longer architectural, it is operational. Identity, control planes, and SaaS exposure now sit firmly with the CISO.

AI-speed threats already reshaping security in 2026

We’re already seeing clear examples of how quickly the threat landscape has shifted in 2026. Darktrace’s work on React2Shell exposed just how unforgiving the new tempo is: a honeypot stood up with an exposed React was hit in under two minutes. There was no recon phase, no gradual probing – just immediate, automated exploitation the moment the code appeared publicly. Exposure now equals compromise unless defenses can detect, interpret, and act at machine speed. Traditional operational rhythms simply don’t map to this reality.

We’re also facing the first wave of AI-authored malware, where LLMs generate code that mutates on demand. This removes the historic friction from the attacker side: no skill barrier, no time cost, no limit on iteration. Malware families can regenerate themselves, shift structure, and evade static controls without a human operator behind the keyboard. This forces CISOs to treat adversarial automation as a core operational risk and ensure that autonomous systems inside the business remain predictable under pressure.

The CVE-2026-1731 BeyondTrust exploitation wave reinforced the same pattern. The gap between disclosure and active, global exploitation compressed into hours. Automated scanning, automated payload deployment, coordinated exploitation campaigns, all spinning up faster than most organizations can push an emergency patch through change control. The vulnerability-to-exploit window has effectively collapsed, making runtime visibility, anomaly detection, and autonomous containment far more consequential than patching speed alone.

These cases aren’t edge scenarios; they represent the emerging norm. Complexity and automation have outpaced human-scale processes, and attackers are weaponizing that asymmetry.  

The real differentiator for CISOs in 2026 is less about knowing everything and more about knowing immediately when something shifts – and having systems that can respond at the same speed.

[related-resource]

Continue reading
About the author
Mike Beck
Global CISO

Blog

/

Network

/

March 2, 2026

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

Default blog imageDefault blog image

Note: Darktrace's Threat Research team is publishing now to help defenders. We will continue updating this blog as our investigations unfold.

Background

On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests.  This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].

A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].

Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from  the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].

Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain  avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.

Darktrace Detections

Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:

Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation.  Associated Darktrace models include:

  • Compromise / Possible Tunnelling to Bin Services

Suspicious executable file downloads. Associated Darktrace models include:

  • Anomalous File / EXE from Rare External Location

Outbound beaconing to rare domains. Associated Darktrace models include:

  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Compromise / Sustained TCP Beaconing Activity To Rare Endpoint
  • Compromise / Beacon to Young Endpoint
  • Anomalous Server Activity / Rare External from Server
  • Compromise / SSL Beaconing to Rare Destination

Unusual cryptocurrency mining activity. Associated Darktrace models include:

  • Compromise / Monero Mining
  • Compromise / High Priority Crypto Currency Mining

And model alerts for:

  • Compromise / Rare Domain Pointing to Internal IP

IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.  

Appendices

Potential indicators of post-exploitation behavior:

·      217.76.57[.]78 – IP address - Likely C2 server

·      hXXp://217.76.57[.]78:8009/index.js - URL -  Likely payload

·      b6a15e1f2f3e1f651a5ad4a18ce39d411d385ac7  - SHA1 - Likely payload

·      195.154.119[.]194 – IP address – Likely C2 server

·      hXXp://195.154.119[.]194/index.js - URL – Likely payload

·      avg.domaininfo[.]top – Hostname – Likely C2 server

·      104.234.174[.]5 – IP address - Possible C2 server

·      35da45aeca4701764eb49185b11ef23432f7162a – SHA1 – Possible payload

·      hXXp://134.122.13[.]34:8979/c - URL – Possible payload

·      134.122.13[.]34 – IP address – Possible C2 server

·      28df16894a6732919c650cc5a3de94e434a81d80 - SHA1 - Possible payload

References:

1.        https://nvd.nist.gov/vuln/detail/CVE-2026-1731

2.        https://www.securityweek.com/beyondtrust-vulnerability-targeted-by-hackers-within-24-hours-of-poc-release/

3.        https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/

Continue reading
About the author
Emma Foulger
Global Threat Research Operations Lead
Your data. Our AI.
Elevate your network security with Darktrace AI