Learn from two leaders in their fields about cyber risks in Formula 1 and McLaren's unique approach. Explore cyber risks and strategies that set McLaren apart.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nicole Eagan
Co-founder and Strategic Advisor
Written by
Zak Brown
CEO, McLaren Racing
Share
02
May 2022
Nicole Eagan, Darktrace’s Chief Strategy Officer and AI Officer, catches up with Zak Brown, CEO at McLaren Racing, on innovation, cyber-attacks, and what sets McLaren apart.
Nicole: Thanks for joining us, Zak. I’d like to start this off by speaking about innovation. As you know, the pace of change is very rapid in both cyber security and Formula 1. At Darktrace, our aim is to outpace the attackers, which we do by heavily investing in our R&D and our AI specifically. As the CEO of McLaren Racing, how important is innovation?
Zak: Innovation is our life blood. To give you an idea: if you took the car that qualified first in the first race of the season, and you didn’t touch it throughout the year, it would come last in the final race of the season. We’re developing a new part for our race car about every 15 minutes, 365 days a year. These facts illustrate the pace of development here at McLaren. As we say in motor racing – if you’re sitting still, you’re actually going backwards.
Nicole: Talk about pace of innovation! We’ve observed at Darktrace that in any industry, no two organizations operate the same way. In fact, the closer you get, the more you realize how different they are. This is one of the reasons we think taking a self-learning approach to security is so important. In your view, what sets McLaren apart from other teams?
Zak: Whilst all teams are pushing for a similar outcome – to be the fastest racing team in the world –we go about it in different ways. At McLaren, it’s all about the people, as well as understanding and leaning into our technology and technology partners.
Nicole: As you know, cyber-attacks can trickle over into business disruption – and sometimes even effect physical operations. What impact can a cyber-attack have for McLaren Racing?
Zak: There are so many ways a cyber-attack could disrupt our racing and our business. Wherever we’re racing around the world, it all starts back at our factory in the UK. Everything is real time, and if a cyber-attack were to shut down our technology, we wouldn’t be able to go onto the track. We also need to protect our Intellectual Property and our supply chain, as a lot of critical information is being passed back and forth between us and our suppliers.
A real-life incident I can recall happened in 1998, well before we became partners with Darktrace. Someone tapped into our radio communications as our driver at the time, Mika Häkkinen, was leading the Australian Grand Prix. The attacker told Mika to pit, and he did! It almost cost him the race. These actions have consequences that can cost us on track performance which in turn, can lead to much bigger business implications.
Nicole: That’s an amazing story, and really shows how extreme the disruption can be. As a high-profile target, I’m aware that you also received a personal attack at the Italian Grand Prix last season. Can you share the story of this attack with us?
Zak: I get about 300 emails a day, and I’m constantly on the run. Fortunately, Darktrace stopped the attack before it even hit my desk. When I’m going at 100 miles an hour and receive such a large volume of emails daily, these attacks are extremely well disguised. You have to rely on technology to catch the bad guys.
Nicole: I absolutely agree. And that’s exactly where our Autonomous Response technology comes in. It’s constantly working in the background, not needing human action, and stopping attackers from even hitting your desktop. Which leads us on to my next question: what are some of the cyber security tips you would share with other high-level executives?
Zak: I take security very seriously – I’ve seen it and experienced it. During the course of the pandemic, the digital landscape has expanded and opened up more opportunities for the bad guys to try and get in. In my opinion, it’s only going to get worse, and so I’d say that a priority for me is to make sure other high-level executives are fully aware that we’re staying cutting edge with Darktrace.
Nicole: Well, with the pace of innovation at McLaren, the level of IP you have and the risk of physical disruption a cyber-attack could cause, it’s great to hear how seriously you take cyber security.
So in wrapping up, I know there’s huge excitement building for the race in Miami this weekend. How important will this new race be in garnering excitement about Formula 1 across the US?
Zak: Formula 1 has really taken off now across North America and this weekend is going to be huge: tickets have sold out, the track looks amazing… it’s the hottest ticket in Formula 1 right now. Netflix has worked wonders for Formula 1 around the world, especially in the US, and broadcast numbers are growing rapidly. With all these factors working together, I think Formula 1 has successfully penetrated North America and is going to go from strength to strength.
Nicole: Well, thank you for your time today Zak and best of luck to you and the whole McLaren team this weekend…
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
