Blog
/
AI
/
July 16, 2025

サイバーセキュリティのためのAI成熟度モデルの紹介

サイバーセキュリティのためのAI成熟度モデルは、実際のユースケースとエキスパートの知見に基づいた、この種の指針の中でも最も詳細なガイドです。CISOが戦略的な意思決定を行うための力となり、どのAIを導入すべきかだけではなく、組織を段階的に強化し優れた成果を得るためにどのように進めるべきかを知ることができます。
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Ashanka Iddya
Senior Director, Product Marketing
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
16
Jul 2025

サイバーセキュリティへのAIの導入:宣伝文句を超えて

今日のセキュリティオペレーションはパラドックスに直面しています。業界ではAI(Artificial Intelligence)が全面的な変革を約束し、ルーチンタスクを自動化することにより検知と対処が強化されると言われています。しかしその一方で、セキュリティリーダーは意味のあるイノベーションとベンダーの宣伝文句を区別しなければならないという大きなプレッシャーに直面しています。

CISOとセキュリティチームがこの状況を乗り越えるのを支援するため、私たちは業界で最も詳細、かつアクション可能なAI成熟度モデルを作成しました。AIおよびサイバーセキュリティ分野のエキスパートと協力して作成したこの枠組みは、セキュリティライフサイクル全体を通じてAIの導入を理解し、測定し、進めていくためのしっかりとした道筋を提供します。

なぜ成熟度モデル?なぜ今必要?

セキュリティリーダー達との対話と調査の中で繰り返し浮かび上がってきたテーマがあります。

それは、AIソリューションはまったく不足していないが、AIのユースケースの明瞭性と理解が不足している、ということです。

事実、Gartner社は「2027年までに、エージェント型AIプロジェクトの40%以上が、コスト上昇、不明瞭なビジネス上の価値、あるいは不十分なリスク制御を理由として打ち切られるだろう」と予測しています。多くのセキュリティチームが実験を行っていますが、その多くは意味のある成果を得られていません。セキュリティの向上を評価し情報に基づいた投資を行うための、標準化された方法に対する必要性はかつてなく高まっています。

AI成熟度モデルが作成されたのはこのような背景によるものであり、これは次を行うための戦略的枠組みです:

  • 人手によるプロセス(L0)からAIへの委任(L4)に至る5段階の明確なAI成熟度を定義
  • エージェント型生成AIと専用AIエージェントシステムから得られる結果を区別
  • リスク管理、脅威検知、アラートトリアージ、インシデント対応といった中核的な機能にわたって評価
  • AI成熟度を、リスクの削減、効率の向上、スケーラブルなオペレーションなど、現実の成果に対応させる

[related-resource]

このモデルで成熟度はどのように評価されるか?

「サイバーセキュリティにおけるAI成熟度モデル」は、世界で10,000社に及ぶDarktraceの自己学習型AIおよびCyber AI Analystの導入例から得られたセキュリティオペレーションの知見に基づいています。抽象的な理論やベンダーのベンチマークに頼るのではなく、このモデルは実際にセキュリティチームが直面している課題に基づき、AIがどこに導入されているか、どのように使用されているか、そしてどのような成果をもたらしているかを反映しています。

こうした現実に即した基盤により、このモデルはAI成熟度に対する実務的な、体験に基づいた視点を提供します。セキュリティチームが現在の状態を把握し、同じような組織がどのように進化しているかに基づいて現実的な次のステップを知るのに役立ちます。

Darktraceを選ぶ理由

AIは2013年のダークトレースの設立以来そのミッションの中心であり、単なる機能ではなく、企業の基盤です。10年以上にわたりAIを開発し現実のセキュリティ環境にAIを適用してきた経験から、私たちはAIがどこに有効で、どこに有効でないか、そしてAIから最も大きな価値を得るにはどうすべきかを学びました。

私たちは、現代のビジネスが膨大な、相互に接続されたエコシステム内で動いていること、そしてそこには従来のサイバーセキュリティアプローチの維持を不可能にする新たな複雑さや脆弱さが生まれていることを知っています。多くのベンダーは機械学習を使用していますが、AIツールはそれぞれ異なり、どれも同じように作られているわけではありません。

Darktraceの自己学習型AIは多層的なAIアプローチを使用して、それぞれの組織から学習することにより、現代の高度な脅威に対するプロアクティブかつリジリエントな防御を提供します。機械学習、深層学習、LLM、自然言語処理を含む多様なAIテクニックを戦略的に組み合わせ、連続的、階層的に統合することにより、私たちの多層的AIアプローチはそれぞれの組織専用の、変化する脅威ランドスケープに適応する強力な防御メカニズムを提供します。

この成熟度モデルはこうした知見を反映し、セキュリティリーダーが組織の人、プロセス、ツールに適した適切な道筋を見つけるのに役立ちます。

今日のセキュリティチームは次のような重要な問いに直面しています:

  • AIを具体的に何のために使うべきか?
  • 他のチームはどのように使っているのか?そして何が機能しているのか?
  • ベンダーはどのようなツールを提供しているのか、そして何が単なる宣伝文句なのか?
  • AIはSOCの人員を置き換える可能性があるのか?

これらはもっともな質問ですが、簡単に答えられるとは限りません。それが、私たちがこのモデルを作成した理由です。セキュリティリーダーが単なるバズワードに惑わされず、SOC全体にAIを適用するための明確かつ現実的な計画を作成するのを助けるために、このモデルが作成されました。

構成:実験から自律性まで

このモデルは5つの成熟段階で構成されています:

L0 –  人手によるオペレーション:プロセスはほとんどが人手によるものであり、一部のタスクにのみ限定的な自動化が使用されます。

L1 –  自動化ルール:人手により管理されるか、外部ソースからの自動化ルールとロジックが可能な範囲で使用されます。    

L2 –  AIによる支援:AIは調査を支援するが、良い判断をするかどうかは信頼されていません。これには人手によるエラーの監視が必要な生成AIエージェントが含まれます。    

L3 –  AIコラボレーション:組織のテクノロジーコンテキストを理解した専用のサイバーセキュリティAIエージェントシステムに特定のタスクと判断を任せます。生成AIはエラーが許容可能な部分に使用が限定されます。  

L4 –  AIに委任:組織のオペレーションと影響について格段に幅広いコンテキストを備えた専用のAIエージェントがほとんどのサイバーセキュリティタスクと判断を単独で行い、ハイレベルの監督しか必要としません。

それぞれの段階が、テクノロジーだけではなく、人とプロセスもシフトすることを表しています。AIが成熟するにつれ、アナリストの役割は実行者から戦略的監督者へと進化します。

セキュリティリーダーにとっての戦略上の利益

成熟度モデルの目的はテクノロジーの導入だけではなく、AIへの投資を測定可能なオペレーションの成果に結びつけることです。AIによって次のことが可能になります:

SOCの疲労は切実、AIが軽減に貢献

ほとんどのセキュリティチームは現在もアラートの量、調査の遅延、受け身のプロセスに苦労しています。しかしAIの導入には一貫性がなく、多くの場合サイロ化しています。上手く統合すれば、AIはセキュリティチームの効率を高めるための、意味のある違いをもたらすことができます。

生成AIはエラーが起こりやすく、人間による厳密な監視が必要

生成AIを使ったエージェント型システムについては多くの誇大広告が見られますが、セキュリティチームはエージェント型生成AIシステムの不正確性とハルシネーションの可能性についても考慮に入れる必要があります。

AIの本当の価値はセキュリティの進化にある

AI導入の最も大きな成果は、リスク対策から検知、封じ込め、修復に至るまで、セキュリティライフサイクル全体にAIを統合することから得られます。

AIへの信頼と監督は初期段階で必須となるが次第に変化する

導入の初期段階では、人間が完全にコントロールします。L3からL4に到達する頃には、AIシステムは決められた境界内で独立して機能するようになり、人間の役割は戦略的監督になります。

人間の役割が意味のあるものに変化する

AIが成熟すると、アナリストの役割は労働集約的な作業から高価値な意思決定へと引き上げられ、重要な、ビジネスへの影響が大きいアクティビティやプロセスの改良、AIに対するガバナンスなどに集中できるようになります。

成熟度を定義するのは宣伝文句ではなく成果

AIの成熟度は単にテクノロジーが存在しているかどうかではなく、リスク削減、対処時間、オペレーションのリジリエンスに対して測定可能な効果が見られるかどうかで決まります。

[related-resource]

AI成熟度モデルの各段階の成果

セキュリティ組織は人手によるオペレーションからAIへの委任へと進むにつれてサイバーセキュリティの進化を体験するでしょう。成熟度の各レベルは、効率、精度、戦略的価値の段階的変化を表しています。

L0 – 人手によるオペレーション

この段階では、アナリストが手動でトリアージ、調査、パッチ適用、報告を、基本的な自動化されていないツールを使って行います。その結果、受け身の労働集約的なオペレーションになり、ほとんどのアラートは未調査のままとなり、リスク管理にも一貫性がありません。

L1 – 自動化ルール

この段階では、アナリストがSOARあるいはXDRといったルールベースの自動化ツールを管理します。これにより多少の効率化は図れますが、頻繁な調整を必要とします。オペレーションは依然として人員数と事前に定義されたワークフローに制限されます。

L2 – AIによる支援

この段階では、AIが調査、まとめ、トリアージを支援し、アナリストの作業負荷を軽減しますが、エラーの可能性もあるためきめ細かな監督が必要です。検知は向上しますが、自律的な意思決定に対する信頼度は限定的です。

L3 – AIコラボレーション

この段階では、AIが調査全体を行いアクションを提示します。アナリストは高リスクの判断を行うことと、検知戦略の精緻化に集中します。組織のテクノロジーコンテキストを考慮した専用のエージェント型AIエージェントシステムに特定のタスクが任され、精度と優先度の判断が向上します。

L4 – AIに委任

この段階では、専用のAIエージェントシステムが単独でほとんどのセキュリティタスクをマシンスピードで処理し、人間のチームはハイレベルの戦略的監督を行います。このことは、人間のセキュリティチームが最も時間と労力を使うアクティビティはプロアクティブな活動に向けられ、AIがルーチンのサイバーセキュリティ作業を処理することを意味します。

専用のAIエージェントシステムはビジネスへの影響を含めた深いコンテキストを理解して動作し、高速かつ効果的な判断を行います。

AI成熟度モデルのどこに位置しているかを調べる

「サイバーセキュリティのためのAI成熟度モデル」 ホワイトペーパーを入手し、評価を行ってみましょう。自社の現在の成熟段階をベンチマークし、主なギャップがどこにあるのかを調べ、次のステップの優先順位を特定するためににお役立てください。

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Ashanka Iddya
Senior Director, Product Marketing

More in this series

No items found.

Blog

/

Email

/

September 30, 2025

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

Default blog imageDefault blog image

What is Vendor Email Compromise?

Vendor Email Compromise (VEC) refers to an attack where actors breach a third-party provider to exploit their access, relationships, or systems for malicious purposes. The initially compromised entities are often the target’s existing partners, though this can extend to any organization or individual the target is likely to trust.

It sits at the intersection of supply chain attacks and business email compromise (BEC), blending technical exploitation with trust-based deception. Attackers often infiltrate existing conversations, leveraging AI to mimic tone and avoid common spelling and grammar pitfalls. Malicious content is typically hosted on otherwise reputable file sharing platforms, meaning any shared links initially seem harmless.

While techniques to achieve initial access may have evolved, the goals remain familiar. Threat actors harvest credentials, launch subsequent phishing campaigns, attempt to redirect invoice payments for financial gain, and exfiltrate sensitive corporate data.

Why traditional defenses fall short

These subtle and sophisticated email attacks pose unique challenges for defenders. Few busy people would treat an ongoing conversation with a trusted contact with the same level of suspicion as an email from the CEO requesting ‘URGENT ASSISTANCE!’ Unfortunately, many traditional secure email gateways (SEGs) struggle with this too. Detecting an out-of-character email, when it does not obviously appear out of character, is a complex challenge. It’s hardly surprising, then, that 83% of organizations have experienced a security incident involving third-party vendors [1].  

This article explores how Darktrace detected four different vendor compromise campaigns for a single customer, within a two-week period in 2025.  Darktrace / EMAIL successfully identified the subtle indicators that these seemingly benign emails from trusted senders were, in fact, malicious. Due to the configuration of Darktrace / EMAIL in this customer’s environment, it was unable to take action against the malicious emails. However, if fully enabled to take Autonomous Response, it would have held all offending emails identified.

How does Darktrace detect vendor compromise?

The answer lies at the core of how Darktrace operates: anomaly detection. Rather than relying on known malicious rules or signatures, Darktrace learns what ‘normal’ looks like for an environment, then looks for anomalies across a wide range of metrics. Despite the resourcefulness of the threat actors involved in this case, Darktrace identified many anomalies across these campaigns.

Different campaigns, common traits

A wide variety of approaches was observed. Individuals, shared mailboxes and external contractors were all targeted. Two emails originated from compromised current vendors, while two came from unknown compromised organizations - one in an associated industry. The sender organizations were either familiar or, at the very least, professional in appearance, with no unusual alphanumeric strings or suspicious top-level domains (TLDs). Subject line, such as “New Approved Statement From [REDACTED]” and “[REDACTED] - Proposal Document” appeared unremarkable and were not designed to provoke heightened emotions like typical social engineering or BEC attempts.

All emails had been given a Microsoft Spam Confidence Level of 1, indicating Microsoft did not consider them to be spam or malicious [2]. They also passed authentication checks (including SPF, and in some cases DKIM and DMARC), meaning they appeared to originate from an authentic source for the sender domain and had not been tampered with in transit.  

All observed phishing emails contained a link hosted on a legitimate and commonly used file-sharing site. These sites were often convincingly themed, frequently featuring the name of a trusted vendor either on the page or within the URL, to appear authentic and avoid raising suspicion. However, these links served only as the initial step in a more complex, multi-stage phishing process.

A legitimate file sharing site used in phishing emails to host a secondary malicious link.
Figure 1: A legitimate file sharing site used in phishing emails to host a secondary malicious link.
Another example of a legitimate file sharing endpoint sent in a phishing email and used to host a malicious link.
Figure 2: Another example of a legitimate file sharing endpoint sent in a phishing email and used to host a malicious link.

If followed, the recipient would be redirected, sometimes via CAPTCHA, to fake Microsoft login pages designed to capturing credentials, namely http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html and https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html#.

The latter made use of homoglyphs to deceive the user, with a link referencing ‘s3cure0line’, rather than ‘secureonline’. Post-incident investigation using open-source intelligence (OSINT) confirmed that the domains were linked to malicious phishing endpoints [3] [4].

Fake Microsoft login page designed to harvest credentials.
Figure 3: Fake Microsoft login page designed to harvest credentials.
Phishing kit with likely AI-generated image, designed to harvest user credentials. The URL uses ‘s3cure0line’ instead of ‘secureonline’, a subtle misspelling intended to deceive users.
Figure 4: Phishing kit with likely AI-generated image, designed to harvest user credentials. The URL uses ‘s3cure0line’ instead of ‘secureonline’, a subtle misspelling intended to deceive users.

Darktrace Anomaly Detection

Some senders were unknown to the network, with no previous outbound or inbound emails. Some had sent the email to multiple undisclosed recipients using BCC, an unusual behavior for a new sender.  

Where the sender organization was an existing vendor, Darktrace recognized out-of-character behavior, in this case it was the first time a link to a particular file-sharing site had been shared. Often the links themselves exhibited anomalies, either being unusually prominent or hidden altogether - masked by text or a clickable image.

Crucially, Darktrace / EMAIL is able to identify malicious links at the time of processing the emails, without needing to visit the URLs or analyze the destination endpoints, meaning even the most convincing phishing pages cannot evade detection – meaning even the most convincing phishing emails cannot evade detection. This sets it apart from many competitors who rely on crawling the endpoints present in emails. This, among other things, risks disruption to user experience, such as unsubscribing them from emails, for instance.

Darktrace was also able to determine that the malicious emails originated from a compromised mailbox, using a series of behavioral and contextual metrics to make the identification. Upon analysis of the emails, Darktrace autonomously assigned several contextual tags to highlight their concerning elements, indicating that the messages contained phishing links, were likely sent from a compromised account, and originated from a known correspondent exhibiting out-of-character behavior.

A summary of the anomalous email, confirming that it contained a highly suspicious link.
Figure 5: Tags assigned to offending emails by Darktrace / EMAIL.

Figure 6: A summary of the anomalous email, confirming that it contained a highly suspicious link.

Out-of-character behavior caught in real-time

In another customer environment around the same time Darktrace / EMAIL detected multiple emails with carefully crafted, contextually appropriate subject lines sent from an established correspondent being sent to 30 different recipients. In many cases, the attacker hijacked existing threads and inserted their malicious emails into an ongoing conversation in an effort to blend in and avoid detection. As in the previous, the attacker leveraged a well-known service, this time ClickFunnels, to host a document containing another malicious link. Once again, they were assigned a Microsoft Spam Confidence Level of 1, indicating that they were not considered malicious.

The legitimate ClickFunnels page used to host a malicious phishing link.
Figure 7: The legitimate ClickFunnels page used to host a malicious phishing link.

This time, however, the customer had Darktrace / EMAIL fully enabled to take Autonomous Response against suspicious emails. As a result, when Darktrace detected the out-of-character behavior, specifically, the sharing of a link to a previously unused file-sharing domain, and identified the likely malicious intent of the message, it held the email, preventing it from reaching recipients’ inboxes and effectively shutting down the attack.

Figure 8: Darktrace / EMAIL’s detection of malicious emails inserted into an existing thread.*

*To preserve anonymity, all real customer names, email addresses, and other identifying details have been redacted and replaced with fictitious placeholders.

Legitimate messages in the conversation were assigned an Anomaly Score of 0, while the newly inserted malicious emails identified and were flagged with the maximum score of 100.

Key takeaways for defenders

Phishing remains big business, and as the landscape evolves, today’s campaigns often look very different from earlier versions. As with network-based attacks, threat actors are increasingly leveraging legitimate tools and exploiting trusted relationships to carry out their malicious goals, often staying under the radar of security teams and traditional email defenses.

As attackers continue to exploit trusted relationships between organizations and their third-party associates, security teams must remain vigilant to unexpected or suspicious email activity. Protecting the digital estate requires an email solution capable of identifying malicious characteristics, even when they originate from otherwise trusted senders.

Credit to Jennifer Beckett (Cyber Analyst), Patrick Anjos (Senior Cyber Analyst), Ryan Traill (Analyst Content Lead), Kiri Addison (Director of Product)

Appendices

IoC - Type - Description + Confidence  

- http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html#p – fake Microsoft login page

- https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html# - link to domain used in homoglyph attack

MITRE ATT&CK Mapping  

Tactic – Technique – Sub-Technique  

Initial Access - Phishing – (T1566)  

References

1.     https://gitnux.org/third-party-risk-statistics/

2.     https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about

3.     https://www.virustotal.com/gui/url/5df9aae8f78445a590f674d7b64c69630c1473c294ce5337d73732c03ab7fca2/detection

4.     https://www.virustotal.com/gui/url/695d0d173d1bd4755eb79952704e3f2f2b87d1a08e2ec660b98a4cc65f6b2577/details

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content

Continue reading
About the author

Blog

/

OT

/

October 1, 2025

Announcing Unified OT Security with Dedicated OT Workflows, Segmentation-Aware Risk Insights, and Next-Gen Endpoint Visibility for Industrial Teams

Default blog imageDefault blog image

The challenge of convergence without clarity

Convergence is no longer a roadmap idea, it is the daily reality for industrial security teams. As Information Technology (IT) and Operational Technology (OT) environments merge, the line between a cyber incident and an operational disruption grows increasingly hard to define. A misconfigured firewall rule can lead to downtime. A protocol misuse might look like a glitch. And when a pump stalls but nothing appears in the Security Operations Center (SOC) dashboard, teams are left asking: is this operational or is this a threat?

The lack of shared context slows down response, creates friction between SOC analysts and plant engineers, and leaves organizations vulnerable at exactly the points where IT and OT converge. Defenders need more than alerts, they need clarity that both sides can trust.

The breakthrough with Darktrace / OT

This latest Darktrace / OT release was built to deliver exactly that. It introduces shared context between Security, IT, and OT operations, helping reduce friction and close the security gaps at the intersection of these domains.

With a dedicated dashboard built for operations teams, extended visibility into endpoints for new forms of detection and CVE collection, expanded protocol coverage, and smarter risk modeling aligned to segmentation policies, teams can now operate from a shared source of truth. These enhancements are not just incremental upgrades, they are foundational improvements designed to bring clarity, efficiency, and trust to converged environments.

A dashboard built for OT engineers

The new Operational Overview provides OT engineers with a workspace designed for them, not for SOC analysts. It brings asset management, risk insights and operational alerts into one place. Engineers can now see activity like firmware changes, controller reprograms or the sudden appearance of a new workstation on the network, providing a tailored view for critical insights and productivity gains without navigating IT-centric workflows. Each device view is now enriched with cross-linked intelligence, make, model, firmware version and the roles inferred by Self-Learning AI, making it easier to understand how each asset behaves, what function it serves, and where it fits within the broader industrial process. By suppressing IT-centric noise, the dashboard highlights only the anomalies that matter to operations, accelerating triage, enabling smoother IT/OT collaboration, and reducing time to root cause without jumping between tools.

This is usability with purpose, a view that matches OT workflows and accelerates response.

Figure 1: The Operational Overview provides an intuitive dashboard summarizing all OT Assets, Alerts, and Risk.

Full-spectrum coverage across endpoints, sensors and protocols

The release also extends visibility into areas that have traditionally been blind spots. Engineering workstations, Human-Machine Interfaces (HMIs), contractor laptops and field devices are often the entry points for attackers, yet the hardest to monitor.

Darktrace introduces Network Endpoint eXtended Telemetry (NEXT) for OT, a lightweight collector built for segmented and resource-constrained environments. NEXT for OT uses Endpoint sensors to capture localized network, and now process-level telemetry, placing it in context alongside other network and asset data to:

  1. Identify vulnerabilities and OS data, which is leveraged by OT Risk Management for risk scoring and patching prioritization, removing the need for third-party CVE collection.
  1. Surface novel threats using Self-Learning AI that standalone Endpoint Detection and Response (EDR) would miss.
  1. Extend Cyber AI Analyst investigations through to the endpoint root cause.

NEXT is part of our existing cSensor endpoint agent, can be deployed standalone or alongside existing EDR tools, and allows capabilities to be enabled or disabled depending on factors such as security or OT team objectives and resource utilization.

Figure 2: Darktrace / OT delivers CVE patch priority insights by combining threat intelligence with extended network and endpoint telemetry

The family of Darktrace Endpoint sensors also receive a boost in deployment flexibility, with on-prem server-based setups, as well as a Windows driver tailored for zero-trust and high-security environments.

Protocol coverage has been extended where it matters most. Darktrace now performs protocol analysis of a wider range of GE and Mitsubishi protocols, giving operators real-time visibility into commands and state changes on Programmable Logic Controllers (PLCs), robots and controllers. Backed by Self-Learning AI, this inspection does more than parse traffic, it understands what normal looks like and flags deviations that signal risk.

Integrated risk and governance workflows

Security data is only valuable when it drives action. Darktrace / OT delivers risk insights that go beyond patching, helping teams take meaningful steps even when remediation isn't possible. Risk is assessed not just by CVE presence, but by how network segmentation, firewall policies, and attack path logic neutralize or contain real-world exposure. This approach empowers defenders to deprioritize low-impact vulnerabilities and focus effort where risk truly exists. Building on the foundation introduced in release 6.3, such as KEV enrichment, endpoint OS data, and exploit mapping, this release introduces new integrations that bring Darktrace / OT intelligence directly into governance workflows.

Fortinet FortiGate firewall ingestion feeds segmentation rules into attack path modeling, revealing real exposure when policies fail and closing feeds into patching prioritization based on a policy to CVE exposure assessment.

  • ServiceNow Configuration Management Database (CMDB) sync ensures asset intelligence stays current across governance platforms, eliminating manual inventory work.

Risk modeling has also been made more operationally relevant. Scores are now contextualized by exploitability, asset criticality, firewall policy, and segmentation posture. Patch recommendations are modeled in terms of safety, uptime and compliance rather than just Common Vulnerability Scoring System (CVSS) numbers. And importantly, risk is prioritized across the Purdue Model, giving defenders visibility into whether vulnerabilities remain isolated to IT or extend into OT-critical layers.

Figure 3: Attack Path Modeling based on NetFlow and network topology reveals high risk points of IT/OT convergence.

The real-world impact for defenders

In today’s environments, attackers move fluidly between IT and OT. Without unified visibility and shared context, incidents cascade faster than teams can respond.

With this release, Darktrace / OT changes that reality. The Operational Overview gives Engineers a dashboard they can use daily, tailored to their workflows. SOC analysts can seamlessly investigate telemetry across endpoints, sensors and protocols that were once blind spots. Operators gain transparency into PLCs and controllers. Governance teams benefit from automated integrations with platforms like Fortinet and ServiceNow. And all stakeholders work from risk models that reflect what truly matters: safety, uptime and compliance.

This release is not about creating more alerts. It is about providing more clarity. By unifying context across IT and OT, Darktrace / OT enables defenders to see more, understand more and act faster.

Because in environments where safety and uptime are non-negotiable, clarity is what matters most.

Join us for our live event where we will discuss these product innovations in greater detail

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance
Your data. Our AI.
Elevate your network security with Darktrace AI