September 21, 2022

Modern Extortion: Detecting Data Theft From the Cloud

Darktrace highlights a handful of data theft incidents on shared cloud platforms, showing that cloud computing can be a vulnerable place for modern extortion.

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adrianne Marques

Senior Research Analyst

Sep 2022

Ransomware Industry

The ransomware industry has benefitted from a number of factors in recent years: inadequate cyber defenses, poorly regulated cryptocurrency markets, and geopolitical tensions have allowed gangs to extort increasingly large ransoms while remaining sheltered from western law enforcement [1]. However, one of the biggest success stories of the ransomware industry has been the adaptability and evolution of attacker TTPs (tactics, techniques and procedures). The WannaCry and NotPetya attacks of 2017 popularized a form of ransomware which used encryption algorithms to hold data to ransom in exchange for a decryption key. Last year in 2021, almost all ransomware strains evolved to use double extortion tactics: holding stolen data to ransom as well as encrypted data [2]. Now, some ransomware gangs have dropped encryption entirely, and are using data theft as their sole means of extortion.

Using data theft for extortion is not new. In 2020 the Finnish psychotherapy center Vastaamo had over 40,000 patient records stolen. Impacted patients were told that their psychiatric transcripts would be published online if they failed to pay a Bitcoin ransom. [3]. A later report by BlackFog in May 2021 predicted data theft extortion would become one of the key emerging cybersecurity trends that year [4]. Adoption of offline back-ups and endpoint detection had made encryption harder, while a large-scale move to Cloud and SaaS platforms offered new vectors for data theft. By moving from data encryption to data exfiltration, ransomware attackers pivoted from targeting data availability within the CIA triad (Confidentiality, Integrity, Availability) to threatening data confidentiality.

In November 2021, Darktrace detected a data theft incident following the compromise of two SaaS accounts within an American tech customer’s Office365 environment. The client was a longstanding user of Darktrace DETECT/Network, and was in the process of expanding their coverage by trialing Darktrace DETECT+RESPOND/ Apps + Cloud.

Attack Overview

On November 23^rd 2021, an Ask the Expert (ATE) ticket was raised prompting investigation into a breached SaaS model, ‘SaaS / Access / Unusual External Source for SaaS Credential Use’, and the activities of a user (censored as UserA) over the prior week.

1. Office365: UserA

The account UserA had been logging in from an unusual location in Nigeria on November 21^st. At the time of the incident there were no flags of malicious activity from this IP in widely used OSINT sources. It is also highly probable the attacker was not located in Nigeria but using Nigerian infrastructure in order to hide their true location. Regardless, the location of the login from this IP and ASN was considered highly unusual for users within the customer’s digital estate. The specific user in question most commonly accessed their account from IP ranges located in the US.

Figure 1: In the Geolocation tab of the External Sites Summary on the SaaS Console, UserA was seen logging in from Nigeria when previous logins were exclusively from USA

Further investigation revealed an additional anomaly in the Outlook Web activity of UserA. The account was using the Firefox browser to access their account for the first time in at least 4 weeks (the maximum period for which the customer stored such data). SaaS logs detailing the access of confidential folders and other suspicious actions were identified using the Advanced Search (AS) query:

@fields.saas_actor:"UserA@[REDACTED]" AND @fields.saas_software:"Firefox"

Most actions were ‘MailItemsAccessed’ events originating from IPs located in Nigeria [5,6] and one other potentially malicious IP located in the US [7].

‘MailItemsAccessed’ is part of the new Advanced Audit functionality from Microsoft and can be used to determine when email data is accessed by mail protocols and clients. A bind mail access type denotes an individual access to an email message [8].

Figure 2: AS logs shows UserA had not used Firefox to access Office365 for at least 4 weeks prior to the unusual login on the 21st November

Below are details of the main suspicious SaaS activities:

· Time: 2021-11-21 09:05:25 - 2021-11-22 16:57:39 UTC

· SaaS Actor: UserA@[REDACTED]

· SaaS Service: Office365

· SaaS Service Product: Exchange

· SaaS Software: Firefox

· SaaS Office365 Parent Folders:

          o   \Accounts/Passwords
          o   \Invoices
         o   \Sent Items
          o   \Inbox
          o   \Recoverable Items\Deletions

· SaaS Event:

          o   MailItemsAccessed
          o   UserLoggedIn
          o   Update

· SaaS Office365 Mail Access Type: Bind (47 times)

· Source IP addresses:

          o   105.112.59[.]83
          o   105.112.36[.]212
          o   154.6.17[.]16
          o   45.130.83[.]129

· SaaS User Agents:

o Client=OWA;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0;
o Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

· Total SaaS logs: 57

At the start of the month on the 5^th November, the user had also been seen logging in from a potentially malicious endpoint [9] in Europe, performing ‘MailItemsAccessed’ and ‘Updates’ events with subjects and a resource location related to invoices and wire transfers from the Sent items folder. This suggests the initial compromise had been earlier in the month, giving the threat actor time to make preparations for the final stages of the attack.

Figure 3: Event log showing the activity of UserA from IP 45.135.187[.]108

2. Office365: UserB

Looking into the model breach ‘SaaS / Access / Suspicious Credential Use And Login User-Agent’, it was seen that a second account, UserB, was also observed logging in from a rare and potentially malicious location in Bangladesh [7]. Similar to UserA, this user had previously logged in exclusively from the USA, and no other accounts within the digital estate had been observed interacting with the Bangladeshi IP address. The login event appeared to bypass MFA (Multi-factor Authentication) and a suspicious user agent, BAV2ROPC, was used. Against misconfigured accounts, this Microsoft user agent is commonly used by attackers to bypass MFA on Office365. It targets Exchange’s Basic Authentication (normally used in POP3/IMAP4 conditions) and results in an OAuth flow which circumvents the additional password security brought by MFA [10].

During the session, additional resources were accessed which appear to be associated with bill and invoice payments. In addition, on the 4^th November, two new suspicious email rules named “..” were created from rare IPs (107.10.56[.]48 and 76.189.202[.]66). This type of behavior is commonly seen during SaaS compromises to delete or forward emails. Typically, an email rule created by a human user will be named to reflect the change being made, such as ‘Move emails from Legal to Urgent’. In contrast, malicious email rules are often short and undescriptive. The rule “..” is likely to blend in without arousing suspicion, while also being easy for the attacker to create and remember.

Details of these rule changes are as follows:

·      Time: 2021-11-04 13:25:06, 2021-11-05 15:50:00 [UTC]
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: True
·      SaaS Source IP addresses: 107.10.56[.]48, 76.189.202[.]66
·      SaaS Account Name: O365
·      SaaS Actor: UserB@[REDACTED]
·      SaaS Event: SetInboxRule
·      SaaS Office365 Modified Property Names:
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, MoveToFolder, Name, FromAddressContainsWords, StopProcessingRules
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, Name, FromAddressContainsWords, StopProcessingRules
·      SaaS Resource Name: ..

During cloud account compromises, attackers will often use sync operations to download emails to their local email client. During the operations, these clients typically download a large set of mail items from the cloud to a local computer. If the attacker is able to sync all mail items to their mail client, the entire mailbox can be compromised. The attacker is able to disconnect from the account and review and search the email without generating additional event logs.

Both accounts UserA and UserB were observed using ‘MailItemsAccessed’ sync operations between the 1^st and 23^rd November when this attack occurred. However, based on the originating IP of the sync operations, the activity is likely to have been initiated by the legitimate, US-based users. Once the security team were able to confirm the events were expected and legitimate, they could establish that the contents of the mailbox were not a part of the data breach.

Accomplish Mission

After gaining access to the Office365 accounts, sensitive data was downloaded by the attackers to their local system. Either on or before 14^th December, the attacker had seemingly uploaded the documents onto a data leak website. In total, 130MB of data had been made available for download in two separate packages. The packages included audit and accounting financial documents, with file extensions such as DB, XLSX, and PDF.

Figure 4: The two data packages uploaded by the attacker and the extracted contents

In a sample of past SaaS activity of UserA, the subject and attachments appear related to the ‘OUTSTANDING PREPAY WIRES 2021’ excel document found from the data leak website in Figure 4, suggesting a further possibility that the account was associated with the leaked data.

Historic SaaS activity associated with UserA:

·      Time: 2021-11-05 21:21:18 [UTC]
·      SaaS Office365 Logon Type: Owner
·      Protocol: OFFICE365
·      SaaS Account Name: O365
·      SaaS Actor: UserA@[REDACTED].com
·      SaaS Event: Send
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: Succeeded
·      SaaS Office365 Attachment: WIRE 2021.xlsx (92406b); image.png (9084b); image.png (1454b); image.png (1648b); image.png (1691b); image.png (1909b); image.png (2094b)
·      SaaS Office365 Subject: Wires 11/8/21
·      SaaS Resource Location: \Drafts
·      SaaS User Agent: Client=OWA;Action=ViaProxy

Based on the available evidence, it is highly likely that the data packages contain the data stolen during the account compromise the previous month.

Once the credentials of an Office365 account are stolen, an attacker can not only access the user's mailbox, but also a full range of Office365 applications such as SharePoint folders, Teams Chat, or files in the user's OneDrive [11]. For example, files shared in Teams chat are stored in OneDrive for Business in a folder named Microsoft Teams Chat Files in the default Document library on SharePoint. One of the files visible on the data leak website, called ‘[REDACTED] CONTRACT.3.1.2020.pdf’, was also observed in the default document folder of a third user account (UserC) within the victim organization, suggesting the compromised accounts may have been able to access shared files stored on other accounts by moving laterally via other O365 applications such as Teams.

One example can be seen in the below AS logs:

·      Time: 2021-11-11 01:58:35 [UTC]
·      SaaS Resource Type: File
·      Protocol: OFFICE365
·      SaaS Account Name: 0365
·      SaaS Actor: UserC@[REDACTED]
·      SaaS Event: FilePreviewed
·      SaaS Service Product: OneDrive
·      SaaS Metric: ResourceViewed
·      SaaS Office365 Application Name: Media Analysis and Transformation Service
·      SaaS Office365 File Extension: pdf
·      SaaS Resource Location: https://[REDACTED]-my.sharepoint.com/personal/userC_[REDACTED]_com/Documents/Microsoft Teams Chat Files/[REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Resource Name: [REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Service: Office365
·      SaaS Service Product: OneDrive
·      SaaS User Agent: OneDriveMpc-Transform_Thumbnail/1.0

In the period between the 1^st and 30^th November, the customer’s Darktrace DETECT/Apps trial had raised multiple high-level alerts associated with SaaS account compromise, but there was no evidence of file encryption.

Establish Foothold

Looking back at the start of the attack, it is unclear exactly how the attacker evaded the customer’s pre-existing security stack. At the time of the incident, the victim was using a Barracuda email gateway and Microsoft 365 Threat Management for their cloud environment.

Darktrace detected no indication the accounts were compromised via credential bruteforcing, which would have enabled the attacker to bypass the Azure Active Directory smart lockout (if enabled). The credentials may have been harvested via a phishing campaign which successfully evaded the list of known ‘bad’ domains maintained by their email gateway.

Upon gaining access to the account, the Microsoft Defender for Cloud Apps anomaly detection policies would have been expected to raise an alert [12]. In this instance, the unusual login from Nigeria occurred over 16 hours after the previous login from the US, potentially evading anomaly detection policies such as the ‘Impossible Travel’ rule.

Figure 5: Event log showing the user accessing mail from USA a day before the suspicious usage from Nigeria

Darktrace Coverage

Darktrace DETECT

Throughout this event, high scoring model breaches associated with the attack were visible in the customer’s SaaS Console. In addition, there were two Cyber AI Analyst incidents for ‘Possible Account Hijack’ associated with the two compromised SaaS Office365 accounts, UserA and UserB. The visibility given by Darktrace DETECT also enabled the security team to confirm which files had been accessed and were likely part of the data leak.

Figure 6: Example Cyber AI Analyst incident of UserB SaaS Office365 account

Darktrace RESPOND

In this incident, the attackers successfully compromised O365 accounts in order to exfiltrate customer data. Whilst Darktrace RESPOND/Apps was being trialed and suggested several actions, it was configured in human confirmation mode. The following RESPOND/Apps actions were advised for these activities:

· ‘Antigena [RESPOND] Unusual Access Block’ triggered by the successful login from an unusual IP address, would have actioned the ‘Block IP’ inhibitor, preventing access to the account from the unusual IP for up to 24 hours
· ‘Suspicious Source Activity Block’, triggered by the suspicious user agent used to bypass MFA, would have actioned the ‘Disable User’ inhibitor, disabling the user account for up to 24 hours

During this incident, Darktrace RESPOND/Network was being used in fully autonomous mode in order to prevent the threat actor from pivoting into the network. The security team were unable to conclusively say if any attempts by the attacker to do this had been made.

Concluding Thoughts

Data theft extortion has become a widely used attack technique, and ransomware gangs may increasingly use this technique alone to target organizations without secure data encryption and storage policies.

This case study describes a SaaS data theft extortion incident which bypassed MFA and existing security tools. The attacker appeared to compromise credentials without bruteforce activity, possibly with the use of social engineering through phishing. However, from the first new login, Darktrace DETECT identified the unusual credential use in spite of it being an existing account. Had Darktrace RESPOND/Apps been configured, it would have autonomously responded to halt this login and prevent the attacker from accomplishing their data theft mission.

Thanks to Oakley Cox, Brianna Leddy and Shuh Chin Goh for their contributions.

Appendices

References

[1] https://securelist.com/new-ransomware-trends-in-2022/106457/

[2] https://www.itpro.co.uk/security/ransomware/367624/the-rise-of-double-extortion-ransomware

[3] https://www.malwarebytes.com/blog/news/2020/10/vastaamo-psychotherapy-data-breach-sees-the-most-vulnerable-victims-extorted

[4] https://www.blackfog.com/shift-from-ransomware-to-data-theft-extortion/

[5] https://www.abuseipdb.com/check/105.112.59.83

[6] https://www.abuseipdb.com/check/105.112.36.212

[7] https://www.abuseipdb.com/check/45.130.83.129

[8] https://docs.microsoft.com/en-us/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide

[9] https://www.abuseipdb.com/check/45.135.187.108

[10] https://www.virustotal.com/gui/ip-address/45.137.20.65/details

[11] https://tidorg.com/new-bec-phishing-attack-steals-office-365-credentials-and-bypasses-mfa/

[12] https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Written by

Adrianne Marques

Senior Research Analyst

•

August 3, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

Watch the NIS2 Webinar

Blog

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

Darktrace successfully detected and quarantined a prompt injection email before it could be processed by an enterprise AI agent.
Prompt injection attacks increasingly rely on natural language rather than traditional malware, making behavioral analysis an important complement to signature-based detection.
Organizations deploying AI agents should combine model guardrails with behavioral monitoring to reduce the risk of malicious instructions reaching enterprise systems.

How behavioral detection helps stop prompt injection attacks

A Darktrace customer running a Gemini AI agent in Google Cloud asked us two simple questions:

“If my agent can read inbound emails and access internal data, what stops an attacker from hiding malicious instructions in the message? Couldn’t the agent be tricked into deleting or exfiltrating sensitive data?”

The scenario centers on an indirect prompt injection attack, where malicious instructions are hidden inside content that an AI model later interprets as trusted input. The same weakness was exposed by EchoLeak (CVE-2025-32711), a zero-click Microsoft 365 Copilot vulnerability enabled data exfiltration from a single well-crafted email..

This blog follows the Darktrace team’s investigation of the customer’s hypothesis and examines how the attack interacted with their existing security stack. The results highlight which defenses held, where gaps emerged, and how behavioral detection mattered more than guardrails. This investigation also demonstrates why behavioral detection is becoming increasingly important for AI security, as prompt injections often contain no traditional indicators of compromise.

How do prompt injection attacks work?

Prompt injection works by carefully crafting the content and structure of the prompt to alter the LLM’s behavior or output in unintended ways. This can cause models to violate guardrails, generate harmful content or enable unauthorised access.

Prompt injection attack example

The well-known example, EchoLeak (CVE-2025-32711), was a zero-click vulnerability in Microsoft 365 Copilot that relied on a carefully crafted email containing hidden instructions that the AI system interpreted as commands rather than content, creating a pathway for unauthorized access to sensitive information without any user interaction.

While Darktrace / SECURE AI is designed to prevent agents from producing unintended outcomes, we wanted to see if we could catch and prevent this threat type earlier in the attack life-cycle, at the email security layer.

How we tested prompt injection attacks on an enterprise agent

Summary:

Claude generated a prompt injection payload.
Hidden instructions were embedded in an email.
The email passed traditional validation checks.
Darktrace analyzed the language and sender behavior.
The email was quarantined before the AI agent could process it.

To test Darktrace / EMAIL against this attack class, we opened Claude, gave it the customer's context and problem statement (Gemini agent with inbox access, internal tool calls), told it we were validating Darktrace / EMAIL's detection of prompt injections, and asked for a test payload. See below:

Despite the guardrails supposedly built into the model, Claude surprisingly gave us the entire exploit in plaintext (albeit very basic), illegible to a human as the text was sent in white text (see Figure 1) but framed as an authoritative override for anything downstream reading the mail programmatically (i.e. the Gemini agent).

How Darktrace detected a prompt injection attack

We then sent the Claude-crafted email from a freemail address to the target recipient’s inbox. Despite the email containing no malicious payload, the freemail address having no malicious reputation, and the validation checks all passing, Darktrace /EMAIL flagged the email as a 93/100 anomaly and moved it to junk, out of scope for the AI agent.

Figure 3: *The test email sent with the hidden prompt injection*

*Figure 4: The email analysis in Darktrace / EMAIL*

Figure 5: Darktrace / EMAIL detection of malicious activity

The interesting part is what triggered the detection (see Figure 5)

Possible machine prompt content: text in the body detected as instructions written for a machine to execute, not for a human to read

Possible machine prompt content + basic suspicious correspondence: the same content, correlated with sender-side anomalies: freemail domain (yahoo[.]com), unknown correspondent, no prior mail history with the recipient, and suspicious references to payment information

Neither of those is a signature match. Nothing in the email was on a blacklist. There was no malware, no link and no attachment. Darktrace analyzed the context in which the email was delivered and flagged it as likely risky. The anomalous language features and the context of the sender relative to the recipient's normal behavior, combined with the unusual hidden text (prompt) were enough for Darktrace / EMAIL to act on the risk.

Result: Darktrace / EMAIL autonomously junked the email, out of scope for any AI agent parsing the inbox.

Why behavioral security makes a difference detecting prompt injection attacks

Cyberattacks don't look like traditional exploits anymore. They now operate in natural language, not strictly code.

That breaks the traditional stack. AV, firewalls, static scanning and signature-based SEGs all assume a payload to inspect.

A prompt injection has no payload. It's just an instruction, written in natural language, dressed up as anything the attacker wants: an invoice, an HR request, a calendar invite, some simple PowerPoint slides.

EchoLeak proved that hidden instructions can sit inside an email invisible to the user but fully readable by the LLM, and the LLM will follow them blindly.

This test and GTG-1002 proved that the LLM itself can be socially engineered. Tell it you're an authorized tester and it will hand you the attack.

Rules and static classifiers can catch the obvious cases. But natural language has infinite variants, and the attack surface is the model's innate functionality to comply.

The deeper problem here is intent: an LLM can't reliably tell whether an instruction in its context came from its developer, its user, or an attacker who slipped it into an email. To the LLM, everything reads as language and looks like a legitimate ask. This is why behavioural detection wins, as you become aware of intent when you look at the context of an interaction. Does this sender normally send this kind of message to this recipient? Does this prompt fit the user's normal pattern? Is this agent behaving the way this agent normally behaves?

Intent can't be read off a single email, it emerges from behavioral context. Which is how Darktrace enables threat detection, through behavioral understanding.

Why enterprise AI security requires more than guardrails

Claude didn't roll over immediately… the first section of the response was a (slight) pushback, but then it wrote the payload anyway without having to ask twice.

Here the framing of the prompt did all the work. The “testing security capabilities” angle moved the model from refusal to unquestioned compliance to the user prompt.

This isn't the first time this has happened, of course. Anthropic disclosed in November 2025 that a Chinese state-sponsored group they tracked as GTG-1002 ran the first documented AI-orchestrated espionage campaign against ~30 targets by posing as employees of a legitimate cybersecurity firm doing authorised penetration testing.

The takeaway isn't that AI guardrails are ineffective. They raise the cost of low-effort attacks and remain an important first layer of defense. However, for most organizations today, they’re the only line of defense when deploying AI agents. If a prompt injection bypasses those controls, organizations still need a way to detect and stop malicious behavior elsewhere in the attack chain.

Attackers will continue to have working prompt injections easily and quickly. The question is what stops one when it lands in an inbox your agent is reading.

That's where behavioral detection comes in.

How Darktrace detects prompt injection attacks in emails

Two things Darktrace does that a model-level guardrail or static rules and signatures can't:

Natural language analysis at the email or prompt layer. The email is assessed on its own merits: is this content shaped like instructions for a machine, regardless of what the receiving agent decides to do about it?

Behavioral context around the language. An AI agent behaves like an extremely agreeable human, and it will go above and beyond to comply with the user’s request. That's exactly why you must consider the business context, such sender behaviour, mailing history, and organisational norms, as these matter even more when the recipient is an AI.

Darktrace has been perfecting behavioral anomaly detection for over a decade; the same self-learning approach that catches BEC and account takeover applies directly to prompt injection delivery. Our multi-layered AI stack extracts content from the message, builds behavioural understanding through social graphing and Pattern of Life analysis, and then combines natural language, topic, inducement, sender relationship and anomaly signals before deciding what action to take.

This matters for prompt injection because the threat is not the plain language itself, but the intent behind the language that can cause an AI agent to respond in unexpected ways.

How to secure enterprise AI operations from prompt injection attacks

Email was the entry point in this case, but it is only one of many possible vectors.

Anywhere an agent can retrieve information, an attacker can potentially introduce a prompt injection.

Emails, documents, SharePoint sites, web pages, knowledge bases, chat platforms, and third-party integrations all provide opportunities to influence an agent's behavior. Wherever an agent finds its orders, a prompt injection opportunity exists.

This is why securing AI requires more than blocking malicious inputs. Organizations also need visibility into how agents behave after consuming information from across their environment. If an agent begins accessing unexpected data, taking unusual actions, or operating outside its normal patterns, those behaviors may provide the strongest signal that something has gone wrong.

Effective AI security requires defense in depth: reducing the likelihood of malicious instructions reaching the agent while maintaining the ability to detect and investigate suspicious behavior if they do.

The challenge isn't protecting a single entry point. It's recognizing that, in an AI-powered environment, every source of information is also a potential source of influence.

Are you deploying autonomous agents across your enterprise and want to see this tested in your environment? Let's talk.

About the author

Carlo Loregian

Solutions Engineer

Blog

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

AI agents are rapidly becoming embedded in everyday business operations, helping employees automate workflows, access information, and accelerate decision-making. As organizations embrace agentic AI, security teams face a growing challenge: understanding how AI is being used, what agents can access, and where risk may emerge.

As agents take on more business-critical work, security teams often need to move across multiple portals to understand risks spanning identity, data, and threat activity. This fragmented view can make it difficult to assess an agent's overall risk posture and determine where attention is needed. Organizations need a way to bring these signals together without disrupting existing security investments or workflows.

Today, Darktrace is announcing an integration between Darktrace / SECURE AI and Microsoft Agent 365 that brings Darktrace's Adaptive AI-driven risk signals directly into the Microsoft 365 Admin Center. By extending the visibility and risk understanding provided by Darktrace / SECURE AI into the Microsoft ecosystem, organizations can gain a more unified understanding of AI agent risk across their environments.

As one of the first security companies to partner with Microsoft to contribute third-party risk signals to the Agent Registry, Darktrace is helping shape how organizations understand and manage AI agent risk.

Extending visibility into the Microsoft Agent 365 experience

Microsoft Agent 365 provides administrators with a centralized registry of AI agents operating within their environment. As organizations expand their use of AI agents, this centralized visibility becomes increasingly important for governance and oversight.

This new integration extends that visibility by allowing Darktrace-generated risk signals to be surfaced directly within the Microsoft Agent 365 experience. By combining Microsoft's agent management and security capabilities with Darktrace's AI-powered risk analysis, organizations gain greater awareness of potential security concerns associated with AI agents operating across their environments.

By integrating Darktrace telemetry into Agent 365, customers can:

Surface Darktrace-detected risks and signals alongside Microsoft-native signals in a single interface

Identify potentially compromised or anomalous AI agents more quickly

Gain unified understanding of context and agent behavior

This approach reinforces a single control plane for AI security while allowing organizations to continue leveraging existing investments across both platforms.

Why unified visibility of AI agent risk signals matters

As AI adoption accelerates across Microsoft environments, organizations must manage new forms of behavior, access patterns, and risk. Security teams need more than inventories and permissions. They need visibility into how AI systems operate and how risk evolves over time.

This integration addresses a critical gap: how to bring behavioral AI security insights into the same control plane as identity, access, and agent management.

With Darktrace and Microsoft Agent 365 together, organizations benefit from:

Unified visibility: A single pane of glass for understanding AI agent risk signals across Microsoft and Darktrace signals

Faster detection of abnormal agent behavior: Darktrace's Adaptive AI highlights deviations that may not be captured by static controls

Operational efficiency: Security teams can triage and prioritize risk signals without switching between systems

Stronger trust in AI deployments: Clear attribution, context, and investigation pathways improve confidence in AI agent usage

Extending Microsoft's AI security model, not replacing it

Securing AI requires a layered approach that combines governance, visibility, threat detection, and risk management. This integration is designed to complement Microsoft's security capabilities, not duplicate them.

Through Darktrace / SECURE AI, Darktrace contributes:

Identification of risk via advanced prompt analysis

Behavioral anomaly detection across AI agents

Cross-environment threat correlation

Autonomous insight into emerging or unknown risks

Microsoft provides:

Centralized agent management

Identity and access governance

Native detection of risk signals and enforcement capabilities

Together, these capabilities create a more complete, layered approach to securing AI-driven enterprises. Organizations gain the governance and policy controls needed to manage AI adoption while benefiting from continuous visibility into how AI is used across the business.

Building the future of secure AI

As AI agents become more deeply embedded in business processes, organizations need more than inventories and static controls. They need to understand how AI is being used, how agents behave, and where risk is emerging across the enterprise.

Darktrace / SECURE AI delivers that understanding through continuous visibility into AI activity, helping security teams assess intent, identify behavioral drift, and uncover emerging risk across both human and agent-driven workflows. Powered by Adaptive AI, it provides the context needed to secure AI as it evolves.

The integration with Microsoft Agent 365 extends those insights into the workflows organizations already use. Agent 365 provides a unified control plane for governing and securing AI agents, while Darktrace contributes complementary behavioral risk signals that can be surfaced within the Agent 365 experience. Together, they give customers broader context on agent activity and risk while preserving the value of their existing Microsoft and Darktrace investments.

As enterprises move from AI experimentation to AI-powered execution, Microsoft and Darktrace help bring together governance, compliance, behavioral understanding, and oversight in a unified approach to AI security. For organizations adopting Microsoft 365 E7, Darktrace / SECURE AI further strengthens that foundation by providing continuous visibility into AI activity, agent behavior, and emerging risk as AI adoption scales.

About the author

The Darktrace Community

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Modern Extortion: Detecting Data Theft From the Cloud

Modern Extortion: Detecting Data Theft From the Cloud

Ransomware Industry

Attack Overview

Accomplish Mission

Establish Foothold

Darktrace Coverage

Darktrace DETECT

Darktrace RESPOND

Concluding Thoughts

Appendices

Why Trust is the New Attack Surface: Darktrace’s Mid-Year Threat Update 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Enjoying the blog?

More in this series

Blog

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

How behavioral detection helps stop prompt injection attacks

How do prompt injection attacks work?

Prompt injection attack example

How we tested prompt injection attacks on an enterprise agent

How Darktrace detected a prompt injection attack

Why behavioral security makes a difference detecting prompt injection attacks

Why enterprise AI security requires more than guardrails

How Darktrace detects prompt injection attacks in emails

How to secure enterprise AI operations from prompt injection attacks

Blog

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

Extending visibility into the Microsoft Agent 365 experience

Why unified visibility of AI agent risk signals matters

Extending Microsoft's AI security model, not replacing it

Building the future of secure AI