Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
22
Feb 2022
Today Darktrace announced the acquisition of best-in-class Attack Surface Management (ASM) company Cybersprint. This is hugely exciting for both our companies, our customers and the wider security industry.
After months of meeting with the Cybersprint teams, diving into their technology and shared opportunities, we are truly excited for the way ahead. Cybersprint is a fantastic fit for Darktrace because of their technology, their people and their data. I want to go into those three reasons in a little more detail.
The Technology
We have tested Cybersprint’s technology intensely ourselves and have seen first-hand great benefits in the short, medium and long-term for our customers.
There are three technical requirements to ensure it met Darktrace’s architectural needs:
Unique to each customer; delivering a bespoke perspective of the attack surface of a given organisation by starting just with a brand or domain. No access to sensitive customer data is required. No installation or integration is required to get started.
The analysis of data had to be real-time and continuous. This is critically important for Darktrace’s Continuous Cyber AI Loop. We always operate on real-time data that is continuously updated as things change; so does Cybersprint.
Built-in automation and integration. Cybersprint automates everything possible in Attack Surface Management and integrates with every external data source.
We have already identified several high-impact integration opportunities where Cybersprint and its external data can be additive to Darktrace’s self-learning, internal data; applying this to each area of the Loop.
The People
Thinking about people, Cybersprint has a well-functioning technical team that we welcome with open arms here at Darktrace, to help accelerate our Prevent vision and create something better together.
When we first started meeting with the Cybersprint teams, we immediately noticed that this is a meeting of minds. We both share a vision for cyber security – using smart tech to move the needle in favour of defenders. We both believe that cyber security is not a human-scale problem – this won’t be solved by throwing more humans in the mix.
Their world-class teams of researchers, ethical hackers and developers are a great addition to our own R&D capabilities in Cambridge, who have a heavy focus on AI. We share many common values across both organizations – such as friends & family first. It is great to have another European research hub that is only a short train-ride or flight away from our Cambridge R&D HQ. It’s important to note that the vast majority of Cybersprint employees are deep technologists.
The Data
Lastly, touching on data, Cybersprint has unparalleled access to attack surface data – basically an up-to-date, continuous copy of the internet. Having access to this data and being able to intelligently analyse it is a huge benefit in itself.
At Darktrace, we already have complete visibility over the internal data of our customers – their email environment, SaaS data, operational technology, IoT, network, zero-trust and other coverage areas – but being able to combine those data sets and deriving insights from them will further drive breakthrough innovations.
Delivering on a shared vision
To understand why we are so excited about Cybersprint and see it as a great fit, one has to be aware of our technology vision of a closed loop system:
Darktrace is already well-known for its offering in the Detect (Enterprise Immune System), Investigate (Cyber AI Analyst) and Respond (Antigena) areas. As we work towards further augmenting security teams in other areas, we are starting to productize technology that makes it more costly and harder for attackers to succeed – we refer to this area broadly as ‘Prevent’.
Prevent is all about being proactive, hardening your environment and reducing risk. The core technology for Prevent is Attack Path Modeling – feeding Attack Path Modeling with various telemetry and working out the most critical attack paths and chokepoints to remediate.
Darktrace already has complete coverage of an organization’s digital estate from an internal perspective, thanks to our various coverage areas. Our Attack Path Modeling is currently producing powerful results based on an organization’s internal data only – but by adding Cybersprint’s attack surface data and external asset information, we will have complete visibility, internal and external, and bespoke to each individual organization.
While the ASM data in itself is valuable to harden the external attack surface, feeding it into our Attack Path Modeling engine will unlock further capabilities. It allows us to model bespoke, multi-domain, end-to-end attack paths in real time.
Stay tuned
This is the beginning of an exciting journey for both Cybersprint and Darktrace. We look forward to updating you again on the evolution of our upcoming Prevent offering.
In the meantime, feel free to send any questions relating to Cybersprint to [email protected]
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption
Núclea prevented a highly targeted phishing attack exploiting trusted relationships—avoiding financial loss, data exposure, and disruption. Darktrace stopped the threat at the point of risk, protecting business continuity and strengthening resilience across the financial ecosystem.
Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense
Security leaders from global organizations across industries sat down with us to share their own front-line experiences and real-world perspectives on how modern attacks unfold, where hidden risks emerge, and how AI is reshaping the way organizations think about the role of security.
AI-powered security for a rapidly growing grocery enterprise
By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
