Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Jenny Moshea
Chief Information Officer, Sellen Construction
Share
09
Sep 2021
At Sellen Construction, safety is our top priority. We are one of the largest general contractors in the Pacific Northwest — we’ve changed tourist maps and helped grow the Seattle skyline. We are proud of our contribution to community structures, from high-rises and hospitals to campuses and high-tech facilities.
The Darktrace-Microsoft dynamic
All of our cloud applications that help us do our job – help us build great – are center to our digital strategy. We are true partners with Microsoft, not only are we a Microsoft 365 customer, but we have worked with them on their construction projects, even building one of the original sections of the Microsoft Campus.
Our digital ecosystem is centered around Microsoft: it’s our knowledge base, document management system, automation and analytics platform – it powers our day-to-day work and helps us deliver to our clients.
Darktrace is a critical component of our security stack because it protects our digital ecosystem and keeps us safe. When we first implemented Darktrace, we put in place the Enterprise Immune System to protect our infrastructure, and we’ve since added Darktrace for SaaS for total coverage. So not only do we have eyes across our digital estate detecting threats immediately, we also have the power of Autonomous Response. Darktrace for SaaS works with Microsoft seamlessly – the technology takes targeted action to contain in-progress threats in real time. It brings a sense of calm, knowing we have Darktrace and Microsoft in concert keeping our landscape safe.
When Autonomous Response stops a bad behavior, shutting down something that could be dangerous, it buys us time. It keeps everyone safe by automatically shutting down the behavior so we can really evaluate what happened. We wouldn’t have that without a 24-hour SOC. And it stairsteps our users back to where it is safe to go without stopping their whole work day.
AI threat analysis
We do all of this with a small but mighty technology team. So it has been critical that we are supported with the augmenting power of AI. We have a Security Operations SWAT Team and Darktrace has been a key extension of our team efforts. We rely on the Cyber AI Analyst like another team member.
The Darktrace Cyber AI Analyst is an AI-powered threat analyst. It’s like an extension of Darktrace’s analysts but supercharged with the speed and scale of AI. It has greatly influenced our workflow — supporting our staff by helping them more immediately triage what happens on our infrastructure.
The AI Analyst is another application of Darktrace’s unique machine learning. It can serve up a prioritized list of suspicious behavior that we can tackle and we can also be alerted to major events, even through our phones via the Mobile App. We keep Darktrace close at all times.
Protecting remote workers
Extending Darktrace’s Self-Learning AI to the endpoint gave us the chance to adjust to our remote network, because even now, not everyone is back in the office. As we untether from the corporate VPN, and move more and more into our SharePoint and Microsoft world, our day-to-day continues to shift. Darktrace has been profound in highlighting interesting behavior on our endpoint devices. For example, we know there has been a surge in crypto-mining activity on our infrastructure. We wouldn’t have caught that without Darktrace. We have eyes like never before.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Security After Signatures: Operating in a World of Pre‑CVE Disclosure Exploitation, Collapsed Trust Boundaries, and Autonomous Systems
Three shifts have reshaped what it means to defend an enterprise securely.
First, exploitation often begins before defenders have a Common Vulnerabilities and Exposures (CVE) identifier, a security advisory, or an entry in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Secondly, the trust boundary has moved beyond the network edge into identities, tokens, APIs, and Software-as-a-Service (SaaS) workflows.
Third, an increasing share of business activity is executed through automation, integrations, and AI agent-like systems that can act faster than teams can verify intent.
If your security model still relies on detecting known bad artefacts, triaging isolated alerts, and waiting for confirmation before acting, you are already behind the threat.
This is not a failure of security teams; it’s a failure of the operating model to keep pace with how the environment has changed.
A SOC built around alerts and signatures assumes that malicious activity will eventually surface as an event. In real incidents, however, the decisive evidence is rarely a single event. Instead, it is a chain of individually explainable actions that only appears malicious once you connect the dots across identity, non-human identity, cloud, email, SaaS, operational technology (OT), and network telemetry.
The defenders succeeding today observe behaviors, link them into sequences, understand what those sequences mean, and contain impact before the full story unfolds. That is the operating model the current threat environment demands.
In one example, Darktrace observed a sequence of subtle but strategically significant anomalies within a customer environment that later aligned with exploitation of CVE‑2025‑0994 in Trimble Cityworks by likely Chinese-nexus threat actors. Behavioral indicators were visible at least 18 days before public disclosure, with related anomalies emerging 40 to 50 days earlier during the intrusion window.
This case illustrates a familiar pattern: clusters of weak‑signal anomalies combing to form an actionable picture of intrusion long before a CVE is published. Such activity reflects long‑horizon, option‑preserving operator models often associated with mature state‑linked activity.
Figure 1: Darktrace’s detection of malicious exploitation of CVE 2025-0994, later tied to Chinese-nexus threat actors targeting critical national infrastructure (CNI) in the US, weeks before public disclosure.
Throughout 2025 and 2026, Darktrace has continued to observe the value of anomaly-based detections across a range of incidents.
CVE
CVE public disclosure date
Darktrace detection date
Days between detection of exploitation and CVE public disclosure
CVE-2025-0994Trimble Cityworks
2025-02-06
2025-01-19
18 days
CVE-2025-24183Apache
2025-03-10
2025-02-18
20 days
CVE-2025-10035Fortra GoAnywhere
2025-09-18
2025-09-11
7 days
CVE-2026-0257PAN-OS
2026-05-13
—
—
Identity is the real control plane
The second shift is that identity has replaced perimeter as the primary control plane. As Darktrace’s Annual Threat Report 2026 illustrated, identity remains the main challenge in defending against modern intrusions. A clear example is the Adversary-in-the-Middle (AiTM) case published by Darktrace in December 2025. A phishing email led to the compromise of an Office 365 account. Session hijacking bypassed multi-factor authentication (MFA), and the compromised account was used for follow-on phishing and persistence activities including the creation of malicious email rules.
Every step in that sequence mattered. A successful login alone does not prove legitimacy. An inbox rule, on its own, may not appear catastrophic. Mail activity, viewed in isolation, may seem operationally normal. But the behavioral chain tells a different story: credential theft, token abuse, persistence, and onward compromise through a trusted identity.
This is why the question is no longer “Did the user authenticate successfully”. The more important question is, “Does this identity action make sense right now, in this context, given what came before it?” The AiTM case shows how identity can be compromised. In practice, however, attacks rarely remained confined to identity alone.
In another Darktrace case, a compromised SaaS account triggered activity across the email, SaaS, and network layers, including inbox rule changes, phishing propagation, and connections to suspicious infrastructure. Viewed in isolation, none of these events were decisive. Together, however, they formed a behavioral sequence that revealed the intrusion, with the full attack story automatically correlated and surfaced to defenders by Darktrace’s Cyber AI Analyst.
Figure 2: Cyber AI Analyst correlated and appended additional events to the incident, including other users who connected to the suspicious redirect link after outbound phishing emails were sent.
AI accelerates the threat
The third shift is the one many teams still underestimate: trusted tooling, integrations, and AI agent-like systems can create actions that appear legitimate but are strategically dangerous.
The shift becomes clearer when examining how governments are now framing AI risk. In 2026, guidance published by CISA, UK’s National Cyber Security Centre (NCSC) and Five Eyes partners warned that agentic systems expand attack surfaces, accumulate privilege, and can behave in ways that are difficult to predict or explain [1]. The advice is simple: assume unexpected behavior and design controls around it.
The real risk is not AI usage. It is unknown autonomy: systems with credentials, data access, and action paths that can execute workflow steps without sufficient behavioral validation, traceability, or human oversight. Darktrace’s Model Context Protocol (MCP) risk analysis provides a useful framework for understanding this challenge. Over-privileged agents, content injection, and tool abuse become high-consequence risks when connected systems can dynamically retrieve data, execute actions, and communicate externally.
Whether security teams like it or not, AI is already in the enterprise. It will help drive innovation, but it will also be abused, whether accidentally or maliciously. In each of the cases below, AI either scaled the attacker, built the tooling, or existed within the environment as something to exploit or misuse.
1. AI as an Attack Multiplier
In one campaign targeting Mexican government entities, a single operator used commercial AI platforms to generate exploits, automate reconnaissance, and process large volumes of data, compressing work that would traditionally have required an entire team into a single workflow [2].
Attempted AI exploitation is now appearing within customer environments. In one case involving an automation technology manufacturer, a compromised LLM proxy was seemingly used as a stepping stone to access additional AI services. When that attempt failed, the attacker pivoted to cryptomining.
What is clear is that the AI layer has already become an asset worth probing, exploiting, and pivoting through. It is also clear that defenders benefit from rapidly understanding how these activities connect. In this case, Cyber AI Analyst automatically pieced together the intrusion, while Darktrace’s Managed Threat Detection service alerted to the customer, enabling the activity to be contained before it could progress further.
Figure 3: Cyber AI Analyst's investigation into a compromised LLM proxy that was abused for cryptomining activity.
AI as a trusted but dangerous actor
This does not require a cinematic vision of “rogue AI.” The Salesloft incident provides a more grounded example, where AI and automation operate with legitimate access but served malicious intent. In that case, attackers abused compromised OAuth tokens associated with the Drift AI chat agent to export significant volumes of data from Salesforce environments.
The activity resembled legitimate API usage and relied on trusted SaaS integrations rather than malware or other obvious signs of intrusion. That is precisely the challenge. Traditional security controls are good at detecting forced entry, but far less effective when a trusted application integration behaves in a way that is technically permitted yet operationally harmful.
In these scenarios, the security challenge shifts from validating access to validating behavior.
This is what that looks like in practice: AI-linked identities executing legitimate actions that require behavioral validation rather than access validation.
Figure 4: Darktrace / SECURE AI highlights anomalous activity across AI identities, surfacing critical behavior that requires validation and containment.
Early observations from Darktrace / SECURE AI deployments reinforce this reality. Across Darktrace's observed fleet, AI service connections per deployment increased 13% during the first half of 2026, reaching over 16 million connections overall. The typical organisation now interacts with seven different AI providers, evidence that AI is no longer operating at the edges of the enterprise. It is increasingly woven into day-to-day business activity.
The most common risks are not compromised models or advanced AI attacks. Instead, they stem from employees and business functions exposing sensitive information through entirely legitimate-looking interactions. Darktrace has observed repeated submission of personally identifiable information (PII), tax information, identification documents, and medical data into LLM prompts, alongside widespread use of unsanctioned (shadow) AI services and growing AI activity from mobile devices.
For defenders, the challenge is increasingly one of context: understanding when legitimate business use crosses into material risk, while preserving privacy and user trust.
Conclusion
Across all three shifts, the pattern is the same: behavior precedes understanding. Security teams are not losing because adversaries have become invisible. An increasingly outdated security model assumes that malicious activity will reveal itself cleanly and early. It no longer does.
In 2026 and beyond, defenders win by understanding behavioral sequences, continuously validating trust, and acting before certainty becomes hindsight. That is security after signatures. That is security in the AI era.
Credit to: Daniel Levy, Threat Hunting Data Scientist
2026年6月12日、DarktraceはLiteLLM-Proxyという名前のAmazon Web Service (AWS) EC2インスタンスから暗号通貨マイニング発生中とみられるアクティビティを観測しました。このインスタンスはLiteLLMアクティビティをサポートしており、Amazon Bedrockリソースへのアクセス権を有するインスタンスプロファイルと関連付けられていました。
