Blog
/
/
September 20, 2022

Modern Extortion: Detecting Data Theft From the Cloud

Darktrace highlights a handful of data theft incidents on shared cloud platforms, showing that cloud computing can be a vulnerable place for modern extortion.
Written by
Adrianne Marques
Senior Research Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adrianne Marques
Senior Research Analyst
Default blog image
20
Sep 2022

Ransomware Industry

The ransomware industry has benefitted from a number of factors in recent years: inadequate cyber defenses, poorly regulated cryptocurrency markets, and geopolitical tensions have allowed gangs to extort increasingly large ransoms while remaining sheltered from western law enforcement [1]. However, one of the biggest success stories of the ransomware industry has been the adaptability and evolution of attacker TTPs (tactics, techniques and procedures). The WannaCry and NotPetya attacks of 2017 popularized a form of ransomware which used encryption algorithms to hold data to ransom in exchange for a decryption key. Last year in 2021, almost all ransomware strains evolved to use double extortion tactics: holding stolen data to ransom as well as encrypted data [2]. Now, some ransomware gangs have dropped encryption entirely, and are using data theft as their sole means of extortion. 

Using data theft for extortion is not new. In 2020 the Finnish psychotherapy center Vastaamo had over 40,000 patient records stolen. Impacted patients were told that their psychiatric transcripts would be published online if they failed to pay a Bitcoin ransom. [3]. A later report by BlackFog in May 2021 predicted data theft extortion would become one of the key emerging cybersecurity trends that year [4]. Adoption of offline back-ups and endpoint detection had made encryption harder, while a large-scale move to Cloud and SaaS platforms offered new vectors for data theft. By moving from data encryption to data exfiltration, ransomware attackers pivoted from targeting data availability within the CIA triad (Confidentiality, Integrity, Availability) to threatening data confidentiality.

In November 2021, Darktrace detected a data theft incident following the compromise of two SaaS accounts within an American tech customer’s Office365 environment. The client was a longstanding user of Darktrace DETECT/Network, and was in the process of expanding their coverage by trialing Darktrace DETECT+RESPOND/ Apps + Cloud.

Attack Overview

On November 23rd 2021, an Ask the Expert (ATE) ticket was raised prompting investigation into a breached SaaS model, ‘SaaS / Access / Unusual External Source for SaaS Credential Use’, and the activities of a user (censored as UserA) over the prior week.

1. Office365: UserA 

The account UserA had been logging in from an unusual location in Nigeria on November 21st. At the time of the incident there were no flags of malicious activity from this IP in widely used OSINT sources. It is also highly probable the attacker was not located in Nigeria but using Nigerian infrastructure in order to hide their true location. Regardless, the location of the login from this IP and ASN was considered highly unusual for users within the customer’s digital estate. The specific user in question most commonly accessed their account from IP ranges located in the US.

Figure 1: In the Geolocation tab of the External Sites Summary on the SaaS Console, UserA was seen logging in from Nigeria when previous logins were exclusively from USA

Further investigation revealed an additional anomaly in the Outlook Web activity of UserA. The account was using the Firefox browser to access their account for the first time in at least 4 weeks (the maximum period for which the customer stored such data). SaaS logs detailing the access of confidential folders and other suspicious actions were identified using the Advanced Search (AS) query:

@fields.saas_actor:"UserA@[REDACTED]" AND @fields.saas_software:"Firefox"

Most actions were ‘MailItemsAccessed’ events originating from IPs located in Nigeria [5,6] and one other potentially malicious IP located in the US [7].

‘MailItemsAccessed’ is part of the new Advanced Audit functionality from Microsoft and can be used to determine when email data is accessed by mail protocols and clients. A bind mail access type denotes an individual access to an email message [8]. 

Figure 2: AS logs shows UserA had not used Firefox to access Office365 for at least 4 weeks prior to the unusual login on the 21st November

Below are details of the main suspicious SaaS activities: 

·      Time: 2021-11-21 09:05:25 - 2021-11-22 16:57:39 UTC

·      SaaS Actor: UserA@[REDACTED]

·      SaaS Service: Office365

·      SaaS Service Product: Exchange

·      SaaS Software: Firefox

·      SaaS Office365 Parent Folders:

          o   \Accounts/Passwords
          o   \Invoices
          o   \Sent Items
          o   \Inbox
          o   \Recoverable Items\Deletions

·      SaaS Event:

          o   MailItemsAccessed
          o   UserLoggedIn
          o   Update

·      SaaS Office365 Mail Access Type: Bind (47 times)

·      Source IP addresses:

          o   105.112.59[.]83
          o   105.112.36[.]212
          o   154.6.17[.]16
          o   45.130.83[.]129

·      SaaS User Agents: 

          o   Client=OWA;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0;
          o   Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

·      Total SaaS logs: 57 

At the start of the month on the 5th November, the user had also been seen logging in from a potentially malicious endpoint [9] in Europe, performing ‘MailItemsAccessed’ and ‘Updates’ events with subjects and a resource location related to invoices and wire transfers from the Sent items folder. This suggests the initial compromise had been earlier in the month, giving the threat actor time to make preparations for the final stages of the attack.

Figure 3: Event log showing the activity of UserA from IP 45.135.187[.]108 

2. Office365: UserB 

Looking into the model breach ‘SaaS / Access / Suspicious Credential Use And Login User-Agent’, it was seen that a second account, UserB, was also observed logging in from a rare and potentially malicious location in Bangladesh [7]. Similar to UserA, this user had previously logged in exclusively from the USA, and no other accounts within the digital estate had been observed interacting with the Bangladeshi IP address. The login event appeared to bypass MFA (Multi-factor Authentication) and a suspicious user agent, BAV2ROPC, was used. Against misconfigured accounts, this Microsoft user agent is commonly used by attackers to bypass MFA on Office365. It targets Exchange’s Basic Authentication (normally used in POP3/IMAP4 conditions) and results in an OAuth flow which circumvents the additional password security brought by MFA [10].  

During the session, additional resources were accessed which appear to be associated with bill and invoice payments. In addition, on the 4th November, two new suspicious email rules named “..” were created from rare IPs (107.10.56[.]48 and 76.189.202[.]66). This type of behavior is commonly seen during SaaS compromises to delete or forward emails. Typically, an email rule created by a human user will be named to reflect the change being made, such as ‘Move emails from Legal to Urgent’. In contrast, malicious email rules are often short and undescriptive. The rule “..” is likely to blend in without arousing suspicion, while also being easy for the attacker to create and remember. 

Details of these rule changes are as follows:

·      Time: 2021-11-04 13:25:06, 2021-11-05 15:50:00 [UTC]
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: True
·      SaaS Source IP addresses: 107.10.56[.]48, 76.189.202[.]66
·      SaaS Account Name: O365
·      SaaS Actor: UserB@[REDACTED]
·      SaaS Event: SetInboxRule
·      SaaS Office365 Modified Property Names:
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, MoveToFolder, Name, FromAddressContainsWords, StopProcessingRules
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, Name, FromAddressContainsWords, StopProcessingRules
·      SaaS Resource Name: .. 

During cloud account compromises, attackers will often use sync operations to download emails to their local email client. During the operations, these clients typically download a large set of mail items from the cloud to a local computer. If the attacker is able to sync all mail items to their mail client, the entire mailbox can be compromised. The attacker is able to disconnect from the account and review and search the email without generating additional event logs. 

Both accounts UserA and UserB were observed using ‘MailItemsAccessed’ sync operations between the 1st and 23rd November when this attack occurred. However, based on the originating IP of the sync operations, the activity is likely to have been initiated by the legitimate, US-based users. Once the security team were able to confirm the events were expected and legitimate, they could establish that the contents of the mailbox were not a part of the data breach. 

Accomplish Mission

After gaining access to the Office365 accounts, sensitive data was downloaded by the attackers to their local system. Either on or before 14th December, the attacker had seemingly uploaded the documents onto a data leak website. In total, 130MB of data had been made available for download in two separate packages. The packages included audit and accounting financial documents, with file extensions such as DB, XLSX, and PDF.

Figure 4: The two data packages uploaded by the attacker and the extracted contents

In a sample of past SaaS activity of UserA, the subject and attachments appear related to the ‘OUTSTANDING PREPAY WIRES 2021’ excel document found from the data leak website in Figure 4, suggesting a further possibility that the account was associated with the leaked data. 

Historic SaaS activity associated with UserA: 

·      Time: 2021-11-05 21:21:18 [UTC]
·      SaaS Office365 Logon Type: Owner
·      Protocol: OFFICE365
·      SaaS Account Name: O365
·      SaaS Actor: UserA@[REDACTED].com
·      SaaS Event: Send
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: Succeeded
·      SaaS Office365 Attachment: WIRE 2021.xlsx (92406b); image.png (9084b); image.png (1454b); image.png (1648b); image.png (1691b); image.png (1909b); image.png (2094b)
·      SaaS Office365 Subject: Wires 11/8/21
·      SaaS Resource Location: \Drafts
·      SaaS User Agent: Client=OWA;Action=ViaProxy 

Based on the available evidence, it is highly likely that the data packages contain the data stolen during the account compromise the previous month.  

Once the credentials of an Office365 account are stolen, an attacker can not only access the user's mailbox, but also a full range of Office365 applications such as SharePoint folders, Teams Chat, or files in the user's OneDrive [11]. For example, files shared in Teams chat are stored in OneDrive for Business in a folder named Microsoft Teams Chat Files in the default Document library on SharePoint. One of the files visible on the data leak website, called ‘[REDACTED] CONTRACT.3.1.2020.pdf’, was also observed in the default document folder of a third user account (UserC) within the victim organization, suggesting the compromised accounts may have been able to access shared files stored on other accounts by moving laterally via other O365 applications such as Teams. 

One example can be seen in the below AS logs: 

·      Time: 2021-11-11 01:58:35 [UTC]
·      SaaS Resource Type: File
·      Protocol: OFFICE365
·      SaaS Account Name: 0365
·      SaaS Actor: UserC@[REDACTED]
·      SaaS Event: FilePreviewed
·      SaaS Service Product: OneDrive
·      SaaS Metric: ResourceViewed
·      SaaS Office365 Application Name: Media Analysis and Transformation Service
·      SaaS Office365 File Extension: pdf
·      SaaS Resource Location: https://[REDACTED]-my.sharepoint.com/personal/userC_[REDACTED]_com/Documents/Microsoft Teams Chat Files/[REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Resource Name: [REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Service: Office365
·      SaaS Service Product: OneDrive
·      SaaS User Agent: OneDriveMpc-Transform_Thumbnail/1.0 

In the period between the 1st and 30th November, the customer’s Darktrace DETECT/Apps trial had raised multiple high-level alerts associated with SaaS account compromise, but there was no evidence of file encryption.  

Establish Foothold 

Looking back at the start of the attack, it is unclear exactly how the attacker evaded the customer’s pre-existing security stack. At the time of the incident, the victim was using a Barracuda email gateway and Microsoft 365 Threat Management for their cloud environment. 

Darktrace detected no indication the accounts were compromised via credential bruteforcing, which would have enabled the attacker to bypass the Azure Active Directory smart lockout (if enabled). The credentials may have been harvested via a phishing campaign which successfully evaded the list of known ‘bad’ domains maintained by their email gateway.  

Upon gaining access to the account, the Microsoft Defender for Cloud Apps anomaly detection policies would have been expected to raise an alert [12]. In this instance, the unusual login from Nigeria occurred over 16 hours after the previous login from the US, potentially evading anomaly detection policies such as the ‘Impossible Travel’ rule. 

Figure 5: Event log showing the user accessing mail from USA a day before the suspicious usage from Nigeria 

Darktrace Coverage

Darktrace DETECT 

Throughout this event, high scoring model breaches associated with the attack were visible in the customer’s SaaS Console. In addition, there were two Cyber AI Analyst incidents for ‘Possible Account Hijack’ associated with the two compromised SaaS Office365 accounts, UserA and UserB. The visibility given by Darktrace DETECT also enabled the security team to confirm which files had been accessed and were likely part of the data leak.

Figure 6: Example Cyber AI Analyst incident of UserB SaaS Office365 account

Darktrace RESPOND

In this incident, the attackers successfully compromised O365 accounts in order to exfiltrate customer data. Whilst Darktrace RESPOND/Apps was being trialed and suggested several actions, it was configured in human confirmation mode. The following RESPOND/Apps actions were advised for these activities:  

·      ‘Antigena [RESPOND] Unusual Access Block’ triggered by the successful login from an unusual IP address, would have actioned the ‘Block IP’ inhibitor, preventing access to the account from the unusual IP for up to 24 hours
·      ‘Suspicious Source Activity Block’, triggered by the suspicious user agent used to bypass MFA, would have actioned the ‘Disable User’ inhibitor, disabling the user account for up to 24 hours 

During this incident, Darktrace RESPOND/Network was being used in fully autonomous mode in order to prevent the threat actor from pivoting into the network. The security team were unable to conclusively say if any attempts by the attacker to do this had been made. 

Concluding Thoughts  

Data theft extortion has become a widely used attack technique, and ransomware gangs may increasingly use this technique alone to target organizations without secure data encryption and storage policies.  

This case study describes a SaaS data theft extortion incident which bypassed MFA and existing security tools. The attacker appeared to compromise credentials without bruteforce activity, possibly with the use of social engineering through phishing. However, from the first new login, Darktrace DETECT identified the unusual credential use in spite of it being an existing account. Had Darktrace RESPOND/Apps been configured, it would have autonomously responded to halt this login and prevent the attacker from accomplishing their data theft mission.

Thanks to Oakley Cox, Brianna Leddy and Shuh Chin Goh for their contributions.

Appendices

References 

[1] https://securelist.com/new-ransomware-trends-in-2022/106457/

[2] https://www.itpro.co.uk/security/ransomware/367624/the-rise-of-double-extortion-ransomware

[3] https://www.malwarebytes.com/blog/news/2020/10/vastaamo-psychotherapy-data-breach-sees-the-most-vulnerable-victims-extorted

[4] https://www.blackfog.com/shift-from-ransomware-to-data-theft-extortion/

[5] https://www.abuseipdb.com/check/105.112.59.83

[6] https://www.abuseipdb.com/check/105.112.36.212

[7] https://www.abuseipdb.com/check/45.130.83.129

[8] https://docs.microsoft.com/en-us/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide

[9] https://www.abuseipdb.com/check/45.135.187.108

[10] https://www.virustotal.com/gui/ip-address/45.137.20.65/details

[11] https://tidorg.com/new-bec-phishing-attack-steals-office-365-credentials-and-bypasses-mfa/

[12] https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide

Written by
Adrianne Marques
Senior Research Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adrianne Marques
Senior Research Analyst

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Network
•
May 14, 2026
Tara Gould
Malware Research Lead
Watch the NIS2 Webinar
Trending blogs
1
Darktrace Recognized as the Only Visionary in the 2026 Gartner® Magic Quadrant™ for CPS Protection Platforms
Mar 20, 2026
2
How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC
May 8, 2024
3
Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks
Jun 21, 2024
4
The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners
Apr 9, 2024
5
The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions
May 13, 2024

More in this series

No items found.
Continue reading
No items found.

Blog

/

Email

/

May 26, 2026

Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL

Man at a computerDefault blog imageDefault blog image

Darktrace / EMAIL is an implementation of the Darktrace methodology – a multi-layered AI system built into a single product. As with other Darktrace products, Darktrace / EMAIL learns the expected behaviours of an organization and its employees to identify novel threats and anomalous activity.

The diagram below represents the architecture of Darktrace / EMAIL’s multi-layered AI: a structured visualization of how intelligence is built, step by step, from raw data to actionable insight. Each layer plays a distinct role, feeding into the next: collecting data, understanding behaviour, analysing intent, making decisions, and presenting clear outcomes.

It all starts with an email

In this blog, we’ll follow a malicious email as it passes through the Darktrace / EMAIL system, showing exactly what happens as it travels through each layer of the pyramid, from basic data extraction to AI-powered metric creation, and finally deciding on any autonomous actions.

Let’s take this example email. As an end-user, you can see that this is an obvious extortion attempt where an adversary is threatening legal action if money isn’t paid within 24 hours, but how does Darktrace figure that out?

Part 1: Data Gathering

Processing of an email begins on point-of-transit for all inbound, outbound, or lateral emails. The first step is to extract information directly. This includes taking information from the headers (such as sending and receiving addresses, sender IP address, routing, and authentication protocols), as well as extraction of raw HTML and CSS data from the email itself.

This directly extracted information only allows for immediate surface level analysis, such as identifying signature-based attacks (known malicious addresses / domains), but is insufficient for identifying novel threats, complex attacks, or potential email or vendor compromise. This is where Darktrace’s AI analysis shines.

In this example, the SPF, DKIM, and DMARC authentication all passed successfully, showing that even malicious emails can still bypass these signature-based checks. Even with this success, Darktrace will continue to analyse the email.

Diving deeper into the technical information, we can see further information extracted from the headers, including aggregations from the header information, historical calculations such as the frequency and volume of emails to and from a particular domain, and much more.

Part 2: Social Graphing

Social Graphing involves the analysis of sending and receiving behaviours of different mailboxes to create peer-groups. Mailboxes who often send and receive to and from the same mailboxes, or exhibit other correlated behaviours, will be clustered together using a collection of unsupervised AI clustering systems. These groups may represent uses in the same teams who perform similar activity, groups of external facing mailboxes which often receive unsolicited emails, or groups of VIP users (such as C-suite or executives).

Social graphing is an essential component of Darktrace’s pattern of life analysis. This clustering allows Darktrace to understand the responsibilities of individuals – for example, behaviours which are anomalous for one group of users may be completely expected of another group.

In our example, the email was sent to 3 different users within the organization. As part of the social graphing, an “Association Anomaly” is calculated which indicates the likelihood that these users would receive emails from this user or domain, based on historical patterns.

Part 3: Metric Calculation

Metrics are calculated for every email, representing more complex characteristics of an email which can’t be directly extracted. Darktrace / EMAIL features over 1000 unique metrics, calculated both algorithmically and using an ensemble of AI systems.

Algorithmically calculated (non-AI) metrics include further historical calculations, and counts of features such as code blocks, and hidden text, to name a few.

AI-driven metrics include Inducement Classification which uses Natural Language Processing to identify potential phishing, solicitation, or extortion attempts; Named Entity Recognition to identify PII and other sensitive data within an email to support Data Loss Prevention; and many more.

We can follow our example email through this process and view the outcome of these metric calculations. Looking at the language metrics for this email, we can see that our email has reported a high extortion inducement, along with identification of banking information and language indicating urgency.

Part 4: Evaluation and Combination Engine (models)

Once all metrics have been calculated for an email, it gets sent to an evaluation and combination engine where the metrics are compared against blocks of logic to determine if an email contains a threat. One key model which alerted for this example message was a model to tag and block extortion attempts.

Since our example email has a high inducement score for extortion, along the presence of a bitcoin wallet address in the message, this model alerts. When a model in the engine is activated, actions are taken – in this case adding a tag to the email to flag it as extortion in the console and hold the email to prevent it from reaching the end-user mailbox.

Part 5: Meta-Modelling and Actions

Once the models have been run, the actions are taken against the email. If the email hasn’t been blocked or held, this is the point where it will reach the end-user's mailbox.

In the Darktrace / EMAIL UI, all actions models which alerted for an email and actions taken as a result can be seen. At the top of this page, you can see the alert indicating an extortion attempt along with the action to hold the message.

Alongside this, a meta-classifier is used to calculate an overall anomaly score for each email, based on how much the email differs from the pattern of life for the user. The score of the email is boosted by any actions that have taken place.

Part 6: Campaign Clustering

All emails are passed through the Darktrace / EMAIL campaign clustering system. This system creates clusters based on related features within the emails to identify groups of emails with the same sender or intent.

In our case, the email was identified as part of a campaign, alongside other emails which were also identified as extortion attempts against a small group of recipients.

Email campaigns may have additional actions applied to them if the campaign is deemed malicious, and in this case, you can see that the autonomous response was to hold all emails in the campaign. This means that if an email manages to avoid being blocked in the evaluation and combination engine but gets identified as part of the campaign, the hold action will be applied to it retroactively.

Part 7: Cyber AI Analyst

Darktrace’s Cyber AI Analyst presents key information and anomaly indicators for each email, such as further information about authentication, specific metrics, or other identified anomalies and mismatches.

Cyber AI Analyst can also utilize data from Darktrace / EMAIL to enhance its investigation of incidents from other Darktrace products, correlating relevant information to build a fuller picture. More information about the Cyber AI Analyst is available in the Darktrace AI Arsenal.

Part 8: Data Presentation (UI)

Once all processing has taken place against the email, it is presented in the Darktrace / EMAIL UI. Here, members of the SOC team can investigate incidents and anomalies, interact with malicious emails to see why they were blocked, and much more.

Our email stands out here with its 100 anomaly score. Every email which passes through a Darktrace / EMAIL will undergo the same thorough and rigorous analysis to identify potential risks, apply autonomous actions where required, and will ultimately be assigned a score to be displayed here. By providing a single overall score in the UI, rather than presenting emails in full, Darktrace / EMAIL allows SOC teams to more easily identify which emails are most important to investigate, increasing efficiency and reducing alert fatigue.

Take the next step

Many email security tools on the market that claim to be AI-driven are in fact bolting AI onto attack-centric approaches, which rely on automating the identification of known threats. These approaches struggle, and will continue to struggle, with adapting to novel, AI-generated threats.

By analyzing every email within its deeply integrated, multi-layered AI system, Darktrace / EMAIL is able to identify the subtle threats that others miss. This depth not only improves detection accuracy, but enables confident, autonomous action, giving security teams clearer insight into AI outcomes and greater control while supporting users.

‍

For a full deep dive into each stage of the AI system, check out the white paper: A Guide to the Multi-Layered AI in Darktrace / EMAIL

Learn more about securing AI in your enterprise.

[related-resource]

Continue reading
About the author
Jamie Bali
Technical Author (AI) Developer

Blog

/

Network

/

May 26, 2026

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

garnter ndr magic quadrantDefault blog imageDefault blog image

Continued recognition in NDR  

Darktrace has been recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), marking the second consecutive year in the Leaders quadrant.

We believe this consistency reflects sustained ability to execute, adapt, and deliver outcomes as the market evolves.

While we are immensely proud to be recognized by industry analysts as a Leader in NDR, that's just part of the story. Darktrace was also Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response based on direct customer feedback and real-world experience.

We believe the combination of these two signals is important. One reflects how the market is evaluated. The other reflects how technology performs in practice.

Why Darktrace continues to be recognized as a leader

We believe our position as a Leader for the second consecutive year reflects a combination of our sustained ability to execute in NDR, continued AI innovation, and proven delivery of security outcomes for customers and partners worldwide.

We also feel that our leadership in the NDR market is a testament to our unique and multi-layered AI approach, for which we were recognized as No.7 on Fast Company’s Most Innovative AI Companies of 2026 list, plus one of the hottest AI cybersecurity companies in CRN's AI 100.

Adapting to complex, real-world environments

Organizations are no longer protecting a single network perimeter. They are securing a mix of users, devices, applications, and data that move across hybrid environments.

Darktrace has focused on maintaining visibility and detection across these conditions, allowing security teams to understand activity as it scales.

Supporting organizations globally, not just technically

Security outcomes are shaped as much by deployment and support as they are by detection capability.

Darktrace continues to invest in regional presence across 29 countries around the world, helping organizations operationalize NDR in ways that align with local requirements, internal processes, and team structures.

Continuing to push AI beyond detection

AI in cybersecurity is often positioned as a way to improve detection accuracy. But the more important shift is how AI can influence decision-making and response.

Darktrace continues to develop models that learn from both live environments and historical incident data, combining real-time behavioral analysis with insights derived from prior attack patterns.

Using technologies such as the Incident Graph and DIGEST (Darktrace Incident Graph Evaluation for Security Threats), activity is not analyzed in isolation. Instead, relationships between users, devices, connections, and events are mapped over time, allowing the system to reconstruct how an incident is unfolding and how similar incidents have progressed in the past.

By evaluating these patterns, Darktrace can assess the likelihood that an incident will escalate, prioritizing the activity that poses the greatest risk and surfacing the most relevant context for investigation.

This shifts security operations from simply identifying anomalies to understanding their trajectory, helping teams anticipate potential impact and respond earlier with greater precision.

Why NDR is shifting from reactive detection to proactive, AI-driven security

Traditional approaches to NDR have been built around reactively identifying threats once they become clearly visible. That model is increasingly difficult to rely on.

Attackers are no longer operating in ways that stand out. They use valid credentials, trusted tools, and low-and-slow techniques that blend into everyday activity. By the time something looks obviously malicious, the impact is often already underway.

This is the core limitation of reactive detection. It depends on recognizing something that already looks like a threat.

As a result, many of the most consequential incidents today fall into a gap.

Insider activity, compromised credentials, and novel attacks rarely trigger traditional alerts because they do not follow known patterns. On the surface, they often appear legitimate, making them difficult to distinguish from normal behavior without deeper context.

This is why we believe this Gartner recognition reflects a broader shift in NDR toward autonomous, proactive and pre‑emptive security operations.

By understanding normal behavior within an environment, it is possible to identify subtle deviations rather than waiting for confirmation of threats as they are taking place.

Darktrace’s Self-Learning AI is designed for behavioral understanding. By continuously learning each organization’s normal patterns, it can detect deviations in real time, enabling a proactive and pre-emptive model of NDR where security teams can respond to early signs of risk as they emerge, reducing the window in which attacks can develop.

In multiple cases, this behavioral approach has led to early threat detection where Darktrace identified completely unknown threats, including pre-CVE zero-day activity. By detecting subtle behavioral changes before vulnerabilities were publicly disclosed or widely understood, organizations can mitigate threats before they do damage.

This shift is subtle but important. Modern NDR solutions must shift from a system that explains what happened to one that helps prevent threats from developing in the first place, and Darktrace is proud to be at the forefront of this shift - helping organizations build and maintain a state of proactive network resilience.

Continuing to innovate at the forefront of NDR

In our view, recognition as a Leader reflects where the market is today. Continuing to innovate defines what comes next.

As businesses evolve, new technologies like AI tools and agents introduce new security risks and challenges; security teams need more than simple detection. They need a complete understanding of risk as it develops, the ability to investigate it in context, and to contain threats at machine speed.  

Darktrace / NETWORK is built to deliver across that full spectrum. Its Self-Learning AI continuously adapts to each organization’s environment, identifying subtle behavioral changes that signal emerging threats. Integrated investigation and autonomous response reduce the time between detection and action, allowing teams to move with greater speed and confidence.

This combination enables organizations to detect and contain known, unknown, and insider threats as they develop, while also strengthening resilience over time.

As a two-time Leader in the Gartner® Magic Quadrant™ for NDR and the only 2025 Gartner® Peer Insights™ Customers’ Choice, we feel Darktrace continues to evolve its platform to meet the demands of modern environments, delivering a more complete and adaptive approach to network security.

‍

[related-resource]

Disclaimer: The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) ,The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), Thomas Lintemuth, Charanpal Bhogal, Nahim Fazal, 18 May 2026.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI