ブログ
/
/
November 16, 2021

The Tech Driving Arrow McLaren SP to the Top

As Arrow McLaren SP looks back on a positive season, the team reflects on key challenges, success, and how AI and automation is leveraged in their work!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
16
Nov 2021

As Arrow McLaren SP looks back on a positive season and prepares to build momentum into next year, Taylor Kiel (Team President) and Craig Hampson (Director of Trackside Engineering) reflect on key challenges and successes. With Pato O’Ward’s No. 5 car in the running to win the championship until the final race of the season, they reveal the formula for success – and how the team leverages AI and automation in every aspect of their work – from driver simulation to cyber security.

Data as the lifeblood for performance

In INDYCAR qualifiying, the difference between P1 and P10 can be as little as half a second, and when margins are that tight, the finer details in preparation make the difference. For us, that preparation is driven by data. Every race weekend and every practice session, over 100 lightweight sensors and several computers on the cars produce masses of data that is stored and analyzed for performance optimization.

This ecosystem includes an engine controller, a gear shift controller computer, and a computer unit that controls the clutch, and these systems all talk to each other across what is called a Controller Area Network (CAN). So the key question for us becomes: how do we get useful insights from that data, securely, and in a short period of time?

If you can think of something that’s happening on the car, the likelihood is our team is doing everything we can to try and measure it. Air speed, acceleration, tyre temperature, and so much more – we currently record over 1,500 data channels on the car itself, and we then process another 838 ‘math channels’ from combinations of this data – giving us, for example, the ride height of and downforce on the car.

This is more data than we can ever process with human beings alone, and a lot of our work now is figuring out how to automate these processes, using AI to look for patterns that humans simply cannot identify.

Pitting: More than just a tyre change

Each of our cars have two cellular-based telemetry systems built into them, but we are still limited on the amount of throughput we can observe real time, which is why we need to offload this data each time we pit during practice. This involves plugging in what we call an ‘umbilical cord’ that has a communication line and also powers the car.

Figure 1: A typical INDYCAR would last only minutes on its own battery without the engine running

Any typical race produces between 2.5GB and 3.3GB of data, in addition to in-car video, and a GPS system recording the car’s position on the track, which not only goes back to us but also to the relevant television broadcasters. So, we need to have a lot of storage available both in the cloud and on hard drives using a server. That data needs to be available not just to us at trackside but virtually to engineers not present at the race. And most importantly, that data needs to be secure, and protected from outside interference.

The cyber side: Turning to AI

All that precious data coming from the car, residing in the cloud or elsewhere in our organization, is susceptible to tampering from insiders and outsiders who may – deliberately or indirectly – compromise our ability to access or use that data reliably. As the cyber-threat landscape evolves – with ransomware bringing organizations of all shapes and sizes to a halt – we need to make sure we’re prepared for whatever attack is around the corner.

Firewalls, email gateways, and other perimeter protections are one part of the puzzle. But while these tools are focussed on keeping an attacker out – we needed another layer of defense that ensures that if these defenses are bypassed, we have an autonomous system that knows our organization inside out and can fight back on our behalf to disrupt emerging threats.

That’s where Darktrace has provided a revolutionary solution – using Self-Learning AI that understands every person and device from the ground up and identifies subtle deviations that point to a cyber-threat. And if ransomware strikes, 24/7 Autonomous Response is there in the form of Darktrace Antigena, taking precise action to contain ransomware and other threats at machine speed.

Double wins at doubleheaders

Using automation and AI throughout our technology stack enables us to extract meaningful insights from large pools of data and take quick, decisive action in the form of changes to the car or on-the-fly changes in race strategy.

The ability to react and react quickly is really put to the test on doubleheader race weekends, where any room for improvement you identify from Saturday’s race can be rectified in the form of overnight changes and implemented on Sunday. We believe it’s no coincidence that both of Pato’s No. 5 car’s wins came on the back end of doubleheader events, at Texas and Detroit Belle Isle. With people working in harmony with technology, our engineering team were able to make significant improvements to the car, react on the fly, and ultimately ensure we ended up ahead of the competition.

Digital fakes: Breaking new ground at Nashville

This year’s INDYCAR season featured a brand new track in Nashville, an exciting but daunting prospect for both the drivers and the team as a whole. Having access to a driver simulator, thanks to our partners at Chevrolet, we were able to run a virtual version of our car to try different setups, different techniques, and in this case have the driver learn his way round a whole new circuit.

Figure 2: The Chevrolet simulator projects a digital twin of the Nashville circuit

The track is recreated down to the nearest millimetre using a laser scanner, and then there is a lot of digital rendering involved, making it as realistic as possible with stands, fencing, and sponsor banners. Using this ‘digital fake’ representation was super helpful to the drivers in determining the correct approaches to corners, and for our engineers, enabling them to use the outputs to characterize the track.

The setup of the car in the simulator is effectively the same as the setup of the car in the real world: you set the spring rate and the ride height, it has the aerodynamic map, it knows the inertias and the masses of the car. It’s an incredibly complicated and powerful physics engine, but it gives us the ability to test things out in a controlled environment, and contributed toward one of Felix Rosenqvist’s strongest races of the season in the No. 7 car.

Simulations like these are the way of the future – not just for new circuits but in general. Rather than going through tyres and engines, we can replicate practice sessions in digital form, and the software gets closer to reality every day.

Looking ahead

What is next for Arrow McLaren SP? As we are now a part of the McLaren Racing family, new efficiencies and synergies are realized every month. We’ll certainly continue to leverage that valuable partnership, as well as our technology partnership with Darktrace, continuing to roll out their technology across our digital estate, including our email and cloud services.

In the INDYCAR Series, if you stay still, you go backwards, and the competition hots up every year. We know that now more than ever, the answer lies in using cutting-edge technologies across every aspect of the business to make our lives easier and ultimately propel us to the very top.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Taylor Kiel
Team President, Arrow McLaren SP
Written by
Craig Hampson
Director of Trackside Engineering, Arrow McLaren SP

More in this series

No items found.

Blog

/

Network

/

April 17, 2026

中国系サイバー作戦の進化 - それはサイバーリスクおよびレジリエンスにとって何を意味するか

Default blog imageDefault blog image

サイバーセキュリティにおいては、これまではインシデント、侵害、キャンペーン、そして脅威グループを中心にリスクを整理してきました。これらの要素は現在も重要です -しかし個別のインシデントにとらわれていては、エコシステム全体の形成を見逃してしまう危険があります。国家が支援する攻撃者グループは、個別の攻撃を実行したり短期的な目標を達成したりするためだけではなく、サイバー作戦を長期的な戦略上の影響力を構築するために使用するようになっています。  

当社の最新の調査レポート、Crimson Echoにおいてもこうした状況にあわせて視点を変えています。キャンペーンやマルウェアファミリー、あるいはアクターのラベルを個別のイベントとして分類するのではなく、ダークトレースの脅威調査チームは中国系グループのアクティビティを長期的に連続した行動として分析しました。このように視野を拡大することで、これらの攻撃者がさまざまな環境内でどのように存在しているか、すなわち、静かに、辛抱強く、持続的に、そして多くのケースにおいて識別可能な「インシデント」が発生するかなり前から下準備をしている様子が明らかになりました。  

中国系サイバー脅威のこれまでの変化

中国系サイバーアクティビティは過去20年間において4つのフェーズで進化してきたと言えます。初期の、ボリュームを重視したオペレーションは1990年代にから2000年代初めに見られ、それが2010年代にはより構造化された、戦略に沿った活動となり、そして現在の高度な適応性を備えた、アイデンティティを中心とした侵入へと進化しています。  

現在のフェーズの特徴は、大規模、攻撃の自制、そして永続化です。攻撃者はアクセスを確立し、その戦略的価値を評価し、維持します。これはより全体的な変化を反映したものです。つまりサイバー作戦は長期的な経済的および地政学的戦略に組み込まれる傾向が強まっているということです。デジタル環境へのアクセス、特に国家の重要インフラやサプライチェーン、先端テクノロジーにつながるものは、ある種の長期的な戦略的影響力と見られるようになりました。  

複雑な問題に対するダークトレースのビヘイビア分析アプローチ

国家が支援するサイバーアクティビティを分析する際、難しい問題の1つはアトリビューションです。従来のアプローチは多くの場合、特定の脅威グループ、マルウェアファミリー、あるいはインフラに判定を依存していました。しかしこれらは絶えず変化するものであり、さらに中国系オペレーションの場合、しばしば重複が見られます。

Crimson Echo は2022年7月から2025年9月の間の3年間にDarktrace運用環境で観測された異常なアクティビティを回顧的に分析した結果です。ビヘイビア検知、脅威ハンティング、オープンソースインテリジェンス、および構造化されたアトリビューションフレームワーク(Darktrace Cybersecurity Attribution Framework)を用いて、数十件の中~高確度の事例を特定し、繰り返し発生しているオペレーションのパターンを分析しました。  

この長期的視野を持ったビヘイビア中心型アプローチにより、ダークトレースは侵入がどのように展開していくかについての一定のパターンを特定することができ、動作のパターンが重要であることがあらためて確認されました。  

データが示していること

分析からいくつかの明確な傾向が浮かび上がりました:

  • 標的は戦略的に重要なセクターに集中していたのです。データセット全体で、侵入の88%は重要インフラと分類される、輸送、重要製造業、政府、医療、ITサービスを含む組織で発生しています。   
  • 戦略的に重要な西側経済圏が主な焦点です。米国だけで、観測されたケースの22.5%を占めており、ドイツ、イタリア、スペイン、および英国を含めた主要なヨーロッパの経済圏と合わせると侵入の半数以上(55%)がこれらの地域に集中しています。  
  • 侵入の63%近くがインターネットに接続されたシステムのエクスプロイトから始まっており、外部に露出したインフラの持続的リスクがあらためて浮き彫りになりました。  

サイバー作戦の2つのモデル

データセット全体で、中国系のアクティビティは2つの作戦モデルに従っていることが確認されました。  

1つ目は“スマッシュアンドグラブ”(強奪)型と表現することができます。これらはスピードのために最適化された短期型の侵入です。攻撃者はすばやく動き  – しばしば48時間以内にデータを抜き出し  – ステルス性よりも規模を重視します。これらの侵害の期間の中央値は10日ほどです。検知の危険を冒しても短期的利益を得ようとしていることが明らかです。  

2つ目は“ローアンドスロー”(低速)型です。これらのオペレーションはデータセット内ではあまり多くありませんでしたが、潜在的影響はより重大です。ここでは攻撃者は持続性を重視し、アイデンティティシステムや正規の管理ツールを通じて永続的なアクセスを確立し、数か月間、場合によっては数年にわたって検知されないままアクセスを維持しようとします。1つの注目すべきケースでは、脅威アクターは環境に完全に侵入して永続性を確立し、600日以上経ってからようやく再浮上した例もありました。このようなオペレーションの一時停止は侵入の深さと脅威アクターの長期的な戦略的意図の両方を表しています。このことはサイバーアクセスが長期にわたって保有し活用するべき戦略的資産であることを示しており、これは最も戦略的に重要なセクターにおいて最もよく見られたパターンです。  

同じ作戦エコシステムにおいて両方のモデルを並行して利用し、標的の価値、緊急性、意図するアクセスに基づいて適切なモデルを選択することも可能だという点に注意することも重要です。“スマッシュアンドグラブ” モデルが見られたからといって諜報活動が失敗したとのみ解釈すべきではなく、むしろ目標に沿った作戦上の選択かもしれないと見るべきでしょう。“ローアンドスロー” 型は粘り強い活動のために最適化され、“スマッシュアンドグラブ” 型はスピードのために最適化されています。どちらも意図的な作戦上の選択と見られ、必ずしも能力を表していません。  

サイバーリスクを再考する

多くの組織にとって、サイバーリスクはいまだに一連の個別のイベントとして位置づけられています。何かが発生し、検知され、封じ込められ、組織はそれを乗り越えて前に進みます。しかし永続的アクセスは、特にクラウド、アイデンティティベースのSaaSやエージェント型システム、そして複雑なサプライチェーンネットワークが相互接続された環境では、重大な持続的露出リスクを作り出します。システムの中断やデータの流出が発生していなくても、そのアクセスによって業務や依存関係、そして戦略的意思決定についての情報を得られるかもしれません。サイバーリスクはますます長期的な競合情報収集に似てきています。

その影響はSOCだけの問題ではありません。組織はガバナンス、可視性、レジリエンスについての考え方を見直し、サイバー露出をインシデント対応の問題ではなく構造的なビジネスリスクとして扱う必要があります。  

次の目標

この調査の目的は、これらの脅威の仕組みについてより明確な理解を提供することにより、防御者がより早期にこれらを識別しより効果的に対応できるようにすることです。これには、インジケーターの追跡からビヘイビアの理解にシフトすること、アイデンティティプロバイダーを重要インフラリスクとして扱うこと、サプライヤーの監視を拡大すること、迅速な封じ込めのための能力に投資すること、などが含まれます。  

ダークトレースの最新調査、”Crimson Echo: ビヘイビア分析を通じて中国系サイバー諜報技術を理解する” についてより詳しく知るには、ビジネスリーダー、CISO、SOCアナリストに向けたCrimson Echoレポートのエグゼクティブサマリーを ここからダウンロードしてください。 

Continue reading
About the author
Nathaniel Jones
VP, Security & AI Strategy, Field CISO

Blog

/

AI

/

April 17, 2026

Why Behavioral AI Is the Answer to Mythos

Default blog imageDefault blog image

How AI is breaking the patch-and-prevent security model

The business world was upended last week by the news that Anthropic has developed a powerful new AI model, Claude Mythos, which poses unprecedented risk because of its ability to expose flaws in IT systems.  

Whether it’s Mythos or OpenAI’s GPT-5.4-Cyber, which was just announced on Tuesday, supercharged AI models in the hands of hackers will allow them to carry out attacks at machine speed, much faster than most businesses can stop them.  

This news underscores a stark reality for all leaders: Patching holes alone is not a sufficient control against modern cyberattacks. You must assume that your software is already vulnerable right now. And while LLMs are very good at spotting vulnerabilities, they’re pretty bad at reliably patching them.

Project Glasswing members say it could take months or years for patches to be applied. While that work is done, enterprises must be protected against Zero-Day attacks, or security holes that are still undiscovered.  

Most cybersecurity strategies today are built like a daily multivitamin: broad, preventative, and designed to keep the system generally healthy over time. Patch regularly. Update software. Reduce known vulnerabilities. It’s necessary, disciplined, and foundational. But it’s also built for a world where the risks are well known and defined, cycles are predictable, and exposure unfolds at a manageable pace.

What happens when that model no longer holds?

The AI cyber advantage: Behavioral AI

The vulnerabilities exposed by AI systems like Mythos aren’t the well-understood risks your “multivitamin” was designed to address. They are transient, fast-emerging entry points that exist just long enough to be exploited.

In that environment, prevention alone isn’t enough. You don’t need more vitamins—you need a painkiller. The future of cybersecurity won’t be defined by how well you maintain baseline health. It will be defined by how quickly you respond when something breaks and every second counts.

That’s why behavioral AI gives businesses a durable cyber advantage. Rather than trying to figure out what the attacker looks like, it learns what “normal” looks like across the digital ecosystem of each individual business.  

That’s exactly how behavioral AI works. It understands the self, or what's normal for the organization, and then it can spot deviations in from normal that are actually early-stage attacks.

The Darktrace approach to cybersecurity

At Darktrace, we’ve been defending our 10,000 customers using behavioral AI cybersecurity developed in our AI Research Centre in Cambridge, U.K.

Darktrace was built on the understanding that attacks do not arrive neatly labeled, and that the most damaging threats often emerge before signatures, indicators, or public disclosures can catch up.  

Our AI algorithms learn in real time from your personalized business data to learn what’s normal for every person and every asset, and the flows of data within your organization. By continuously understanding “normal” across your entire digital ecosystem, Darktrace identifies and contains threats emerging from unknown vulnerabilities and compromised supply chain dependencies, autonomously curtailing attacks at machine speed.  

Security for novel threats

Darktrace is built for a world where AI is not just accelerating attacks, but fundamentally reshaping how they originate. What makes our AI so unique is that it's proven time and again to identify cyber threats before public vulnerability disclosures, such as critical Ivanti vulnerabilities in 2025 and SAP NetWeaver exploitations tied to nation-state threat actors.  

As AI reshapes how vulnerabilities are found and exploited, cybersecurity must be anchored in something more durable than a list of known flaws. It requires a real-time understanding of the business itself: what belongs, what does not, and what must be stopped immediately.

What leaders should do right now

The leadership priority must shift accordingly.

First, stop treating unknown vulnerabilities as an edge case. AI‑driven discovery makes them the norm. Security programs built primarily around known flaws, signatures, and threat intelligence will always lag behind an attacker that is operating in real time.

Second, insist on an understanding of what is actually normal across the business. When threats are novel, labels are useless. The earliest and most reliable signal of danger is abnormal behavior—systems, users, or data flows that suddenly depart from what is expected. If you cannot see that deviation as it happens, you are effectively blind during the most critical window.

Finally, assume that the next serious incident will occur before remediation guidance is available. Ask what happens in those first minutes and hours. The organizations that maintain resilience are not the ones waiting for disclosure cycles to catch up—they are the ones that can autonomously identify and contain emerging threats as they unfold.

This is the reality of cybersecurity in an AI‑shaped world. Patching and prevention remain important foundations, but the advantage now belongs to those who can respond instantly when the unpredictable occurs.

Behavioral AI is security designed not just for known threats, but for the ones that AI will discover next.

[related-resource]

Continue reading
About the author
Ed Jennings
President and CEO
あなたのデータ × DarktraceのAI
唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ