Blog
/
Cloud
/
March 26, 2024

Enhancing Cloud Security with Business Context

Discover cloud migration insights, security challenges, best practices, and Darktrace's unique approach to enhancing cloud visibility and risk management.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Stevens
Director of Product, Cloud Security
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
26
Mar 2024

Why are businesses shifting to the cloud?

Businesses are increasingly migrating to cloud, due to its potential to streamline operations, reduce costs, and enhance scalability and flexibility. By shifting their infrastructure to the cloud, either as a whole or, more commonly in a hybrid model, organizations can access a wide array of services, such as storage, compute and software applications, without the need for extensive on-premises hardware. However, this transition isn't without challenges.  

Security challenges of cloud migration

Data security, compliance, integration with existing systems, and ensuring consistent performance are critical concerns that need to be addressed. Therefore, companies must develop robust oversight, implement comprehensive security measures, and invest in staff training to successfully navigate the transition to the cloud all while minimizing potential disruptions.

Implementing security measures within a company, however, is a complex endeavour that involves coordination among numerous internal stakeholders two of the most pivotal players involved in cloud security investment, are the security team, entrusted with crafting a business's defensive strategy, and the DevOps engineering team, architects of the infrastructure underpinning the organization's business operations.

Key questions to ask when securing the cloud

Which team is responsible for maintaining the application?  

What do they consider normal?  

How are potential misconfigurations increasing the potential risk of an incident?

Best practices of cloud security

Contextual awareness of the business is a crucial facet for securing a company's cloud infrastructure, as it enables organizations to align security measures with specific business objectives, risks, and regulatory requirements. Understanding the context of the business operations, its goals, critical assets, and compliance obligations, allows security teams to tailor their strategies and controls accordingly.

How does Darktrace help secure the cloud?

In response to the difficulties outlined above, Darktrace has adopted a holistic approach to security with an ActiveAI security platform that is context-aware. This platform enables stakeholders to effectively detect and respond to threats that may arise within their cloud or on premises environments.  

By monitoring your network and identity activity, Darktrace can identify what is considered “normal” within your organization. This however doesn’t tell the whole story. It is also important to understand where these actions are occurring within the context of the business.  

Visibility in the cloud

Without visibility into the individual assets that make up the cloud environment, how these are configured, and how they operate at run time, security is incredibly difficult to maintain. Visibility allows security teams to identify potential vulnerabilities, misconfigurations, or unauthorized access points that could be exploited by malicious actors. It enables proactive monitoring and rapid response to security incidents, ensuring that any threats are promptly identified and mitigated before they can cause significant damage.  

Building architecture diagrams

The cornerstone of our strategy lies in the architecture diagrams, which serve as a framework for organizing resources within our cloud environment. An architecture comprises of interconnected resources governed by access controls and network routing mechanisms. Its purpose is to logically group these resources into the applications they support.  

Achieving this involves compiling a comprehensive inventory of the cloud environment, analyzing resource permissions—including both outbound and inbound access—and considering any overarching organizational policies. For networked devices, we delve into route tables, firewalls, and subnet access control policies. This information is then utilized to build a graph of interconnected assets, wherein each resource constitutes a node, and the possible connections between resources are represented as edges.

Once we have built up an inventory of all the resources within your environments, we can then start building architectures based on the graph. We do this by selecting distinct starting points for graph traversal, which we infer from our deep understanding of the cloud, an example would be a Virtual Private Cloud (VPC) - A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center.  

All networked devices are usually housed within a VPC, with applications typically grouped into one or more VPCs. If multiple VPCs are detected with peering connections between them, we consider them as distinct parts of the same system. This approach enables us to comprehend applications across regions and accounts, rather than solely from the isolated viewpoint of a single VPC.

However, the cloud isn’t all about compute instances, serverless is a popular architecture. In fact, for many developers serverless architectures offer greater scalability and flexibility. Reviewing prevalent serverless architecture patterns, we've chosen some common fundamental resources as our starting point, Lambda functions and Elastic Container Service (ECS) clusters are prime examples, serving as crucial components in various serverless systems with distinct yet similar characteristics.

Prioritize risk in the cloud

Once we have built up an inventory of all the cloud asset, Darktrace / CLOUD utilizes an ‘outlier’ detection machine learning model. This looks to categorize all the assets and identifies the ones that look different or ‘odd’ when compared with the assets around it, this is based on a wide range of characteristics some of which will include, Name, VPC ID, Host Region etc, whilst also incorporating contextual knowledge of where these assets are found, and how they fit into the architecture they are in.  

Once outliers are identified, we can use this information to assess the potential risk posed by the asset. Context plays a crucial role in this stage, as incorporating observations about the asset enables effective scoring. For instance, detecting a misconfiguration, anomalous network connections, or unusual user activity can significantly raise the asset's score. Consequently, the architecture it belongs to can be flagged for further investigation.

Adapting to a dynamic cloud environment

The cloud is incredibly dynamic. Therefore, Darktrace does not see architectures as fixed entities. Instead, we're always on the lookout for changes, driven by user and service activity. This prompts us to dive back in, update our architectural view, and keep a living record of the cloud's ever-changing landscape, providing near real-time insights into what's happening within it.  

Darktrace / CLOUD doesn’t just consider isolated detections, it identifies assets that have misconfigurations and anomalous activity across the network and management plane and adjusts the priority of the alerting to match the potential risk that these assets could be leveraged to enable an attack.  

While in isolation misconfigurations don’t have much meaningful impact, when they are combined with real time updates and anomaly detection within the context of the architecture you see a very important and impactful perspective.  

Combining all of this into one view where security and dev ops teams can collaborate ensures continuity across teams, playing a vital role in providing effective security.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Stevens
Director of Product, Cloud Security

More in this series

No items found.

Blog

/

Proactive Security

/

June 3, 2025

Beyond Discovery: Adding Intelligent Vulnerability Validation to Darktrace / Attack Surface Management

Man on computer doing workDefault blog imageDefault blog image

Introducing Exploit Prediction Assessment

Security teams are drowning in vulnerability alerts, but only a fraction of those issues pose a real threat. The new Exploit Prediction Assessment feature in Darktrace / Attack Surface Management helps teams cut through the noise by validating which vulnerabilities on their external attack surface can be actively exploited.

Instead of relying solely on CVSS scores or waiting for patch cycles, Exploit Prediction Assessment uses safe, targeted simulations to test whether exposed systems can be compromised, delivering fast, evidence-based results in under 72 hours.

This capability augments traditional pen testing and complements existing ASM workflows by transforming passive discovery into actionable insight. With EPA, security teams move from reacting to long lists of potential vulnerabilities to making confident, risk-based decisions on what actually matters.

Key highlights of Exploit Prediction Assessment

Simulated attacks to validate real risk

Exploit Prediction Assessment conducts safe, simulated attacks on assets with potential security vulnerabilities that have been identified by Darktrace / Attack Surface Management. This real-time testing validates your systems' susceptibility to compromise by confirming which vulnerabilities are present and exploitable on your attack surface.

Prioritize what matters most

Confirmed security risks can be prioritized for mitigation, ensuring that the most critical threats are promptly addressed. This takes the existing letter ranking system and brings it a step further by drilling down to yet another level. Even in the most overwhelming situations, teams will be able to act on a pragmatic, clear-cut plan.

Fast results, tailored to your environment

Customers set the scope of the Exploit Prediction Assessment within Darktrace / Attack Surface Management and receive the results of the surgical vulnerability testing within 72 hours. Users will see 1 of 2 shields:

1. A green shield with a check mark: Meaning no vulnerabilities were found on scanned CVEs for the asset.

2. A red shield with a red x: Meaning at least one vulnerability was found on scanned CVEs for the asset.

Why it's a game changer

Traditionally, attack surface management tools have focused on identifying exposed assets and vulnerabilities but lacked the context to determine which issues posed the greatest risk. Without context on what’s exploitable, security teams are left triaging long lists of potential risks, operating in isolation from broader business objectives. This misalignment ultimately leads to both weakened risk posture and cross team communication and execution.

This is where Continuous Threat Exposure Management (CTEM) becomes essential. Introduced by Gartner, CTEM is a framework that helps organizations continuously assess, validate, and improve their exposure to real-world threats. The goal isn’t just visibility, it’s to understand how an attacker could move through your environment today, and what to fix first to stop them.

Exploit Prediction Assessment brings this philosophy to life within Darktrace / Attack Surface Management. By safely simulating exploit attempts against identified vulnerabilities, it validates which exposures are truly at risk—transforming ASM from a discovery tool into a risk-based decision engine.

This capability directly supports the validation and prioritization phases of CTEM, helping teams focus on exploitable vulnerabilities rather than theoretical ones.  This shift from visibility to action reduces the risk of critical vulnerabilities in the technology stack being overlooked, turning overwhelming vulnerability data into focused, clear actionable insights.

As attack surfaces continue to grow and change, organizations need more than static scans they need continuous, contextual insight. Exploit Prediction Assessment ensures your ASM efforts evolve with the threat landscape, making CTEM a practical reality, not just a strategy.

Exploit Prediction Assessment in action

With Darktrace / Attack Surface Management organizations can get Exploit Prediction Assessment, and the cyber risk team no longer guesses which vulnerabilities matter most. Instead, they identify several externally exposed areas of their attack surface, then use the feature to surgically test for exploitability across these exposed endpoints. Within 72 hours, they receive a report:  

Positive outcome: Based on information in the html or the headers it seems that a vulnerable software version is running on an externally exposed infrastructure. By running a targeted attack on this infrastructure, we can confirm that it cannot be abused.

Negative outcome: Based on information in the html or the headers it seems that a vulnerable software version is running on an externally exposed infrastructure. By running a targeted attack on this infrastructure, we can confirm that it can be exploited, so we can predict it being exploited.

This second outcome changes everything. The team immediately prioritizes the exploitable asset for patching and takes the necessary adjustments to mitigate exposure until the fix is deployed.

Instead of spreading their resources thin across dozens of alerts, they focus on what poses a real threat, saving time, reducing risk, and demonstrating actionable results to stakeholders.

Conclusion

Exploit Predication Assessment bolsters Darktrace’s commitment to proactive cybersecurity. It supports intelligent prioritization of vulnerabilities, keeping organizations ahead of emerging threats. With this new addition to / Attack Surface Management, teams have another tool to empower a more efficient approach to addressing security gaps in real-time.

Stay tuned for more updates and insights on how Darktrace continues to develop a culture of proactive security across the entire ActiveAI Security Platform.

[related-resource]

Continue reading
About the author
Kelland Goodin
Product Marketing Specialist

Blog

/

Network

/

June 3, 2025

Darktrace Recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for Network Detection and Response

Man using darktrace security software on computerDefault blog imageDefault blog image

Darktrace has been recognized as a Leader in the first ever Magic Quadrant™ for Network Detection and Response (NDR).

A Gartner Magic Quadrant is a culmination of research in a specific market, giving you a wide-angle view of the relative positions of the market’s competitors. CIOs and CISOs can use this research to make informed decisions about NDR, which is evolving to offer broader threat detection. We encourage our customers to read the full report to get the complete picture.

Darktrace has also received accolades in other recent NDR leadership evaluations including IDC named as market share leader, and  KuppingerCole’s heralding us as an Overall Leader, Product Leader, Market Leader and Innovation Leader. We believe we have continued to be identified as a Leader due to the strength of our capabilities in NDR, driven by our unique application of AI in cybersecurity, continuous product innovation, and our ability to execute on a global scale to meet the evolving needs of our customers.

We’re proud of Darktrace’s unrivaled market, and ability to execute effectively in the network security market, reflecting our commitment to delivering high-quality, reliable solutions that meet the evolving needs of our customers.

Gartner MQ for NDR, NDR mq, Gartner NDR, Gartner best NDR solution
Gartner MQ for NDR

Why is Darktrace the market share leader and undisputed force in NDR?

Transforming network security and shifting to an AI-led SOC

Darktrace’s Self-Learning AITM understands normal for your entire network, intelligently detecting anomalies and containing sophisticated threats without historical attack data. This approach, based on advanced, unsupervised machine learning, enables Darktrace to catch novel, unknown and insider threats that traditional tools miss and other NDR vendors can’t detect. Darktrace has identified and contained attempted exploits of zero-day vulnerabilities up to 11 days before public disclosure.

We change SOC dynamics with our Cyber AI AnalystTM, which eliminates manual triage and investigation by contextualizing all relevant alerts across your environment, including third-party alerts, and performing end-to-end investigations at machine speed. Cyber AI Analyst gives your team the equivalent of 30 extra full time Level 2 analysts without the hiring overhead2, so you can shift your team away from manual, reactive workflows and uplift them to focus on more proactive tasks.

When combined, Darktrace Self-Learning AI and Cyber AI Analyst go far beyond the capabilities of traditional NDR approaches to completely transform your network security and help your teams operate at the speed and scale of AI.

Coverage across the extended IT enterprise and all-important OT devices

We believe the report validates the business-centric approach that Darktrace uses to deploy AI locally and train it solely on each unique environment, giving our customers tailored security outcomes without compromising on privacy.

This contrasts with other NDR vendors that require cloud connectivity to either deliver full functionality or to regularly update their globally trained models with the latest attack data. This capability is particularly sought after by organizations who are no longer just on-premise, have operational technology (OT) networks, or those that operate in classified environments.

Darktrace serves these organizations and industries by extending IT and unifying OT security within a single solution, reducing alert fatigue and accelerating alert investigation in industrial environments.

With Darktrace / NETWORK you can achieve:

  • Full visibility across your modern network, including on-premises, virtual networks, hybrid cloud, identities, remote workers and OT devices
  • Precision threat detection across your modern network to identify known, unknown and insider threats in real-time without relying on rules, signatures or threat intelligence,
  • 10x accelerated incident response times with agentic AI that uplifts your team and enables them to focus on more proactive tasks
  • Containment of threats with the first autonomous response solution proven to work in the enterprise, stopping attacks from progressing at the earliest stages with precise actions that avoid business disruption

Going beyond traditional NDR to build proactive network resilience

Darktrace does not just stop at threat detection, it helps you prevent threats from occurring and increase your resiliency for when attacks do happen. We help discover and prioritize up to 50% more risks across your environment and optimize incident response processes, reducing the impact of active cyber-attacks using an understanding of your data.

Attack path modeling: By leveraging attack path modeling and AI-driven risk validation, customers can close gaps before they’re exploited, focusing resources where they’ll have the greatest impact.

AI-driven playbooks and breach simulations: With AI-driven playbooks and realistic breach simulations, Darktrace helps your team practice response, strengthen processes, and reduce the impact of real-world incidents. You’re not just reacting; you’re proactively building long-term resilience.

Continued innovation in network security

Darktrace leads innovation in the NDR market with more than 200+ patents and active filings, covering a range of detection, response and AI techniques. Our AI Research Center is foundational to our ongoing innovation, including hundreds of R&D employees examining how AI can be applied to real-world problems and augment human teams.

Trusted by thousands of customers globally

Our commitment to innovation and patented Self-Learning AITM has protected organizations in all industries from known and novel attacks since 2013, bolstering network security and augmenting human teams for our 10,000 active customers across 110 countries. These organizations place a great deal of trust in Darktrace’s unique approach to cybersecurity and application of AI to detect and respond to threats across their modern network.

A new standard for NDR

Darktrace / NETWORK is not just another NDR tool; we are the most advanced network security platform in the industry that pushes beyond traditional capabilities to protect thousands of organizations against known and novel threats.

From real-time threat detection and autonomous response to proactive risk management, we’re transforming network security from reactive to resilient.

[related-resource]

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

References

1, 3 Gartner, Magic Quadrant for Network Detection and Response, by Thomas Lintemuth, Esraa ElTahawy, John Collins, Charanpal Bhogal, 29 May, 2025

2 Darktrace Cyber AI Analyst fleet data, 2023

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI