Blog

Thought Leadership

Piloting Airline Cyber Security with AI

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Oct 2022
09
Oct 2022
The airline industry has long operated with thin profit margins and high security and safety standards. With cyber threats threatening downtime that many of these organizations cannot afford, Darktrace's Tony Jarvis suggests that they turn to preventative AI-driven technologies which can harden defenses before attackers make the first move.

A Thin Margin for Error

The airline industry has long been known for its thin profit margins, and the high costs of unexpected downtime. 2010’s Eyjafjallajökull eruption in Iceland and the resulting six-day airspace ban across Europe cost airlines $1.7 billion, just a taste of the impact that would come ten years later as a result of the pandemic. The industry collectively amassed more than $180 billion in debt in 2020, and some predictions suggest that by 2024 the industry's debt could exceed its revenue.

Given the impact that further sustained downtime could have on an already ailing industry, airlines are having to take cyber security seriously. Last year’s Colonial Pipeline ransomware attack in the US led to a six-day shutdown of pipeline operations – the same length of time that flights were grounded by the Eyjafjallajökull eruption. But while the industry hasn’t seen a volcanic eruption on that scale in over twelve years, ransomware attacks are striking airlines weekly. Just this year a ransomware attack on SpiceJet left hundreds of passengers stranded at airports across India, despite being contained relatively quickly.  

Fraud, Fines and Safety Risks

It isn’t just ransomware which is concerning many in the industry. Data breaches remain one of the biggest threats to airlines, organizations which are responsible at any one time for the personal and financial information of millions of customers. In 2019, British Airways had the data of 380,000 customers stolen, including addresses, birth dates and credit card information, and was fined £20 million (reduced from £183 million due in part to the impact of the pandemic) by the UK’s Information Commissioner’s Office (ICO), the largest issued fine in the ICO’s history. The European airline EasyJet is currently facing a class-action suit seeking £18 billion in damages after failing to properly disclose the loss of 2,208 customers’ credit-card information in 2020. 

Airlines are also losing out to card and air mile fraud, with thousands of fraudulent loyalty program accounts being sold on the dark web, as well as the usual roster of attacks including phishing and insider threats which affect businesses of every size and industry. The airlines themselves are not being complacent. In a 2021 report by SITA, 100% of airlines surveyed named cyber security as a key investment for the next three years. Making sure that those investments count will be the next challenge.

There are few industries for which safety and security measures are so important, and while no impact on flight safety as a result of a cyber-attack has yet been reported, agencies like Eurocontrol are already urging caution. Airlines and airports should look at smarter ways to proactively protect their digital environments. 

As attacks grow faster and less predictable, organizations are increasingly turning to preventative AI security measures. For airlines, which operate with broad attack surfaces and plenty of valuable data, using tools which can identify and monitor every asset and potential attack path in an organization and take the necessary steps to secure them is the best way to stay ahead of attackers.

Securing Airspace, Securing Cyberspace

As a recreational pilot myself, I understand the extent of the safety measures that go into every flight: the flight plans, pre-flight checks and all of the long-practiced, deep-embedded knowledge. It is this comprehensive and meticulous approach which ought to be reflected in organizations’ cyber security efforts – whether they be airlines, airports or any other type of business. The parallels between the processes of flying and running a digital organization safely give us a helpful way to understand what proper, AI-driven cyber security can do for any organization, airlines included.

Cleared for Takeoff 

For the pilot, safety measures start long before they’re sat in the cockpit. Flight planning, which includes planning heading and bearing, taking things like elevation, terrain, and weather conditions into consideration, must be completed in addition to plenty of pre-flight checks. The checklist the pilot works through when performing a walk around and pre-flight inspection will often be ordered so that they work in a circle around the perimeter of the whole plane. These checks prevent potential threats, covering everything from water having mixed with the fuel to birds making nests inside the engine cowling.

Darktrace PREVENT, released in July 2022, serves a similar purpose. The AI autonomously identifies and tests every single user and asset that makes up a business in order to spot potential vulnerabilities and harden defenses where necessary. Like a walk around, PREVENT/Attack Surface Management examines the full range of external assets for threats. Then, by identifying and testing potential attack pathways and mitigating against weak points and worst-case scenarios, PREVENT/End-to-End takes steps to win the fight before an attack has been launched. 

Maintaining Good Visibility

When you’re piloting a plane, first and foremost you need a way to detect key variables. Your fundamental flight instruments in the cockpit are known as the six pack:

1. Airspeed Indicator
2. Attitude Indicator or Artificial Horizon 
3. Altimeter
4. Turn Coordinator 
5. Heading Indicator
6. Vertical Speed Indicator

These six instruments provide the critical information needed by any pilot to safely fly the aircraft. While additional instruments are required to conduct flights In low-visibility or ‘Instrument Meteorological Conditions’ (IMC) conditions, these will be essential when getting out of dangerous situations such as inadvertently flying into cloud.

Understanding an environment and adapting to its changes is also fundamental to Darktrace DETECT: an AI-driven technology which focuses on building a comprehensive knowledge of an organization’s environment in order to spot threats the moment they appear. Because it understands what is ‘normal’ for the organization, Darktrace DETECT is able to correlate multiple subtle anomalies in order to expose emerging attacks – even those which have never been seen before. Like those essential flight instruments, DETECT offers visibility into otherwise obscure regions of the environment, and ensures that any potential problems are spotted as early as possible. 

Mayday, Mayday

In aviation and security, moving quickly once a threat has been detected is critical. When an engine stalls at 3,000 feet above ground level, you don’t have time to get the training books out and start figuring out what to do. Pilots are taught to “always have an out” and be ready to use it.

In aviation, an effective response relies for the most part on the knowledge and quick reactions of the pilot, but in cyber security, AI is making response faster and more effective than ever. Darktrace RESPOND uses DETECT’s contextual understanding in order to take the optimum action to mitigate a threat. Adaptability of this response is crucial: a single cyber-attack can come in any number of configurations, and Darktrace RESPOND is able to tailor its actions appropriately. Attacks today move too fast for human teams to be expected to keep up, but with AI taking actions at machine speed organizations can remain protected. 

Always Learning

One of the best pieces of advice a pilot can take is to always be learning. Every flight is an opportunity to learn something new and become a better and safer pilot.

Darktrace DETECT, RESPOND, and PREVENT are all driven by Self-Learning AI, a technology which not only builds but continuously evolves its understanding of each business. This means that as an organization grows, adding more users, assets, or applications, its Darktrace coverage grows too, using each new data point to enhance its understanding and the accuracy of its actions and detections. Darktrace’s separate technologies also learn from each other. Each of the three product families continuously feeds data into the others, helping to enhance their capabilities and improving their ability to keep organizations secured against threats. 

As cyber-attacks proliferate and increase in sophistication, they will continue to target organizations like airlines, which have large attack surfaces and copious amounts of customer data, and which cannot afford to weather sustained downtime. But with AI offering effective, proactive measures and clear-sky visibility, security teams can be confident in their ability to fight back.

NEWSLETTER

Like this and want more?

Stay up to date on the latest industry news and insights.
You can unsubscribe at any time. Privacy Policy
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
토니 자비스
엔터프라이즈 보안 이사, 아시아 태평양 및 일본

Tony Jarvis is Director of Enterprise Security, Asia Pacific and Japan, at Darktrace. Tony is a seasoned cyber security strategist who has advised Fortune 500 companies around the world on best practice for managing cyber risk. He has counselled governments, major banks and multinational companies, and his comments on cyber security and the rising threat to critical national infrastructure have been reported in local and international media including CNBC, Channel News Asia and The Straits Times. Before joining Darktrace, Tony previously served as CTO at Check Point and held senior advisory positions at FireEye, Standard Chartered Bank and Telstra. Tony holds a BA in Information Systems from the University of Melbourne.

share this article
USE CASES
항목을 찾을 수 없습니다.
PRODUCT SPOTLIGHT
항목을 찾을 수 없습니다.
COre coverage
항목을 찾을 수 없습니다.

More in this series

항목을 찾을 수 없습니다.

Blog

Inside the SOC

Royal Pains: How Darktrace Refused to Bend the Knee to the MyKings Botnet

Default blog imageDefault blog image
06
Dec 2023

Botnets: A persistent cyber threat

Since their appearance in the wild over three decades ago, botnets have consistently been the attack vector of choice for many threat actors. The most prevalent of these attack vectors are distributed denial of service (DDoS) and phishing campaigns. Their persistent nature means that even if a compromised device in identified, attackers can continue to operate by using the additional compromised devices they will likely have on the target network. Similarly, command and control (C2) infrastructure can easily be restructured between infected systems, making it increasingly difficult to remove the infection.  

MyKings Botnet

One of the most prevalent and sophisticated examples in recent years is the MyKings botnet, also known as Smominru or DarkCloud. Darktrace has observed numerous cases of MyKings botnet compromises across multiple customer environments in several different industries as far back as August 2022. The diverse tactics, techniques, and procedures (TTPs) and sophisticated kill chains employed by MyKings botnet may prove a challenge to traditional rule and signature-based detections.

However, Darktrace’s anomaly-centric approach enabled it to successfully detect a wide-range of indicators of compromise (IoCs) related to the MyKings botnet and bring immediate awareness to customer security teams, as it demonstrated on the network of multiple customers between March and August 2023.

Background on MyKings Botnet

MyKings has been active and spreading steadily since 2016 resulting in over 520,000 infections worldwide.[1] Although verified attribution of the botnet remains elusive, the variety of targets and prevalence of crypto-mining software on affected devices suggests the threat group behind the malware is financially motivated. The operators behind MyKings appear to be highly opportunistic, with attacks lacking an obvious specific target industry. Across Darktrace’s customer base, the organizations affected were representative of multiple industries such as entertainment, mining, education, information technology, health, and transportation.

Given its longevity, the MyKings botnet has unsurprisingly evolved since its first appearance years ago. Initial analyses of the botnet showed that the primary crypto-related activity on infected devices was the installation of Monero-mining software. However, in 2019 researchers discovered a new module within the MyKings malware that enabled clipboard-jacking, whereby the malware replaces a user's copied cryptowallet address with the operator's own wallet address in order to siphon funds.[2]

Similar to other botnets such as the Outlaw crypto-miner, the MyKings botnet can also kill running processes of unrelated malware on the compromised hosts that may have resulted from prior infection.[3] MyKings has also developed a comprehensive set of persistence techniques, including: the deployment of bootkits, initiating the botnet immediately after a system reboot, configuring Registry run keys, and generating multiple Scheduled Tasks and WMI listeners.[4] MyKings have also been observed rotating tools and payloads over time to propagate the botnet. For example, some operators have been observed utilizing PCShare, an open-source remote access trojan (RAT) customized to conduct C2 services, execute commands, and download mining software[5].

Darktrace Coverage

Across observed customer networks between March and August 2023, Darktrace identified the MyKings botnet primarily targeting Windows-based servers that supports services like MySQL, MS-SQL, Telnet, SSH, IPC, WMI, and Remote Desktop (RDP).  In the initial phase of the attack, the botnet would initiate a variety of attacks against a target including brute-forcing and exploitation of unpatched vulnerabilities on exposed servers. The botnet delivers a variety of payloads to the compromised systems including worm downloaders, trojans, executable files and scripts.

This pattern of activity was detected across the network of one particular Darktrace customer in the education sector in early March 2023. Unfortunately, this customer did not have Darktrace RESPOND™ deployed on their network at the time of the attack, meaning the MyKings botnet was able to move through the cyber kill chain ultimately achieving its goal, which in this case was mining cryptocurrency.

Initial Access

On March 6, Darktrace observed an internet-facing SQL server receiving an unusually large number of incoming MySQL connections from the rare external endpoint 171.91.76[.]31 via port 1433. While it is not possible to confirm whether these suspicious connections represented the exact starting point of the infection, such a sudden influx of SQL connection from a rare external endpoint could be indicative of a malicious attempt to exploit vulnerabilities in the server's SQL database or perform password brute-forcing to gain unauthorized access. Given that MyKings typically spreads primarily through such targeting of internet-exposed devices, the pattern of activity is consistent with potential initial access by MyKings.[6]

Initial Command and Control

The device then proceeded to initiate a series of repeated HTTP connections between March 6 and March 10, to the domain www[.]back0314[.]ru (107.148.239[.]111). These connections included HTTP GET requests featuring URIs such as ‘/back.txt',  suggesting potential beaconing and C2 communication. The device continued this connectivity to the external host over the course of four days, primarily utilizing destination ports 80, and 6666. While port 80 is commonly utilized for HTTP connections, port 6666 is a non-standard port for the protocol. Such connectivity over non-standard ports can indicate potential detection evasion and obfuscation tactics by the threat actors.  During this time, the device also initiated repeated connections to additional malicious external endpoints with seemingly algorithmically generated hostnames such as pc.pc0416[.]xyz.

Darktrace UI image
Figure 1: Model breach showing details of the malicious domain generation algorithm (DGA) connections.

Tool Transfer

While this beaconing activity was taking place, the affected device also began to receive potential payloads from unusual external endpoints. On April 29, the device made an HTTP GET request for “/power.txt” to the endpoint 192.236.160[.]237, which was later discovered to have multiple open-source intelligence (OSINT) links to malware. Power.txt is a shellcode written in PowerShell which is downloaded and executed with the purpose of disabling Windows Defenders related functions.[7] After the initial script was downloaded (and likely executed), Darktrace went on to detect the device making a series of additional GET requests for several varying compressed and executable files. For example, the device made HTTP requests for '/pld/cmd.txt' to the external endpoint 104.233.224[.]173. In response the external server provided numerous files, including ‘u.exe’, and ‘upsup4.exe’ for download, both of which share file names with previously identified MyKings payloads.

MyKings deploys a diverse array of payloads to expand the botnet and secure a firm position within a compromised system. This multi-faceted approach may render conventional security measures less effective due to the intricacies of and variety of payloads involved in compromises. Darktrace, however, does not rely on static or outdated lists of IoCs in order to detect malicious activity. Instead, DETECT’s Self-Learning AI allows it to identify emerging compromise activity by recognizing the subtle deviations in an affected device’s behavior that could indicate it has fallen into the hands of malicious actors.

Figure 2: External site summary of the endpoint 103.145.106[.]242 showing the rarity of connectivity to the external host.

Achieving Objectives – Crypto-Mining

Several weeks after the initial payloads were delivered and beaconing commenced, Darktrace finally detected the initiation of crypto-mining operations. On May 27, the originally compromised server connected to the rare domain other.xmrpool[.]ru over port 1081. As seen in the domain name, this endpoint appears to be affiliated with pool mining activity and the domain has various OSINT affiliations with the cryptocurrency Monero coin. During this connection, the host was observed passing Monero credentials, activity which parallels similar mining operations observed on other customer networks that had been compromised by the MyKings botnet.

Although mining activity may not pose an immediate or urgent concern for security unauthorized cryptomining on devices can result in detrimental consequences, such as compromised hardware integrity, elevated energy costs, and reduced productivity, and even potential involvement in money laundering.

Figure 3: Event breach log showing details of the connection to the other.xmrpool[.]ru endpoint associated with cryptocurrency mining activity.

Conclusion

Detecting future iterations of the MyKings botnet will likely demand a shift away from an overreliance on traditional rules and signatures and lists of “known bads”, instead requiring organizations to employ AI-driven technology that can identify suspicious activity that represents a deviation from previously established patterns of life.

Despite the diverse range of payloads, malicious endpoints, and intricate activities that constitute a typical MyKing botnet compromise, Darktrace was able successfully detect multiple critical phases within the MyKings kill chain. Given the evolving nature of the MyKings botnet, it is highly probable the botnet will continue to expand and adapt, leveraging new tactics and technologies. By adopting Darktrace’s product of suites, including Darktrace DETECT, organizations are well-positioned to identify these evolving threats as soon as they emerge and, when coupled with the autonomous response technology of Darktrace RESPOND, threats like the MyKings botnet can be stopped in their tracks before they can achieve their ultimate goals.

Credit to: Oluwatosin Aturaka, Analyst Team Lead, Cambridge, Adam Potter, Cyber Analyst

Appendix

IoC Table

IoC - Type - Description + Confidence

162.216.150[.]108- IP - C2 Infrastructure

103.145.106[.]242 - IP - C2 Infrastructure

137.175.56[.]104 - IP - C2 Infrastructure

138.197.152[.]201 - IP - C2 Infrastructure

139.59.74[.]135 - IP - C2 Infrastructure

pc.pc0416[.]xyz - Domain - C2 Infrastructure (DGA)

other.xmrpool[.]ru - Domain - Cryptomining Endpoint

xmrpool[.]ru - Domain - Cryptomining Endpoint

103.145.106[.]55 - IP - Cryptomining Endpoint

ntuser[.]rar - Zipped File - Payload

/xmr1025[.]rar - Zipped File - Payload

/20201117[.]rar - Zipped File - Payload

wmi[.]txt - File - Payload

u[.]exe - Executable File - Payload

back[.]txt - File - Payload

upsupx2[.]exe - Executable File - Payload

cmd[.]txt - File - Payload

power[.]txt - File - Payload

ups[.]html - File - Payload

xmr1025.rar - Zipped File - Payload

171.91.76[.]31- IP - Possible Initial Compromise Endpoint

www[.]back0314[.]ru - Domain - Probable C2 Infrastructure

107.148.239[.]111 - IP - Probable C2 Infrastructure

194.67.71[.]99 - IP- Probable C2 Infrastructure

Darktrace DETECT Model Breaches

  • Device / Initial Breach Chain Compromise
  • Anomalous File / Masqueraded File Transfer (x37)
  • Compromise / Large DNS Volume for Suspicious Domain
  • Compromise / Fast Beaconing to DGA
  • Device / Large Number of Model Breaches
  • Anomalous File / Multiple EXE from Rare External Locations (x30)
  • Compromise / Beacon for 4 Days (x2)
  • Anomalous Server Activity / New User Agent from Internet Facing System
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Anomalous Server Activity / New Internet Facing System
  • Anomalous File / EXE from Rare External Location (x37)
  • Device / Large Number of Connections to New Endpoints
  • Anomalous Server Activity / Server Activity on New Non-Standard Port (x3)
  • Device / Threat Indicator (x3)
  • Unusual Activity / Unusual External Activity
  • Compromise / Crypto Currency Mining Activity (x37)
  • Compliance / Internet Facing SQL Server
  • Device / Anomalous Scripts Download Followed By Additional Packages
  • Device / New User Agent

MITRE ATT&CK Mapping

ATT&CK Technique - Technique ID

Reconnaissance – T1595.002 Vulnerability Scanning

Resource Development – T1608 Stage Capabilities

Resource Development – T1588.001 Malware

Initial Access – T1190 Exploit Public-Facing Application

Command and Control – T15568.002 Domain Generated Algorithms

Command and Control – T1571 Non-Standard Port

Execution – T1047 Windows Management Instrumentation

Execution – T1059.001 Command and Scripting Interpreter

Persistence – T1542.003 Pre-OS Boot

Impact – T1496 Resource Hijacking

References

[1] https://www.binarydefense.com/resources/threat-watch/mykings-botnet-is-growing-and-remains-under-the-radar/

[2] https://therecord.media/a-malware-botnet-has-made-more-than-24-7-million-since-2019

[3] https://www.darktrace.com/blog/outlaw-returns-uncovering-returning-features-and-new-tactics

[4] https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-mykings-report.pdf

[5] https://www.antiy.com/response/20190822.html

[6] https://ethicaldebuggers.com/mykings-botnet/

[7] https://ethicaldebuggers.com/mykings-botnet/

Continue reading
About the author
Oluwatosin Aturaka
Analyst Team Lead, Cambridge

Blog

Thought Leadership

The Implications of NIS2 on Cyber Security and AI

Default blog imageDefault blog image
05
Dec 2023

The NIS2 Directive requires member states to adopt laws that will improve the cyber resilience of organizations within the EU. It impacts organizations that are “operators of essential services”. Under NIS 1, EU member states could choose what this meant. In an effort to ensure more consistent application, NIS2 has set out its own definition. It eliminates the distinction between operators of essential services and digital service providers from NIS1, instead defining a new list of sectors:

  • Energy (electricity, district heating and cooling, gas, oil, hydrogen)
  • Transport (air, rail, water, road)
  • Banking (credit institutions)
  • Financial market infrastructures
  • Health (healthcare providers and pharma companies)
  • Drinking water (suppliers and distributors)
  • Digital infrastructure (DNS, TLD registries, telcos, data center providers, etc.)
  • ICT service providers (B2B): MSSPs and managed service providers
  • Public administration (central and regional government institutions, as defined per member state)
  • Space
  • Postal and courier services
  • Waste management
  • Chemicals
  • Food
  • Manufacturing of medical devices
  • Computers and electronics
  • Machinery and equipment
  • Motor vehicles, trailers and semi-trailers and other transport equipment
  • Digital providers (online market places, online search engines, and social networking service platforms) and research organizations.

With these updates, it becomes harder to try and find industry segments not included within the scope. NIS2 represents legally binding cyber security requirements for a significant region and economy. Standout features that have garnered the most attention include the tight timelines associated with notification requirements. Under NIS 2, in-scope entities must submit an initial report or “early warning” to the competent national authority or computer security incident response team (CSIRT) within 24 hours from when the entity became aware of a significant incident. This is a new development from the first iteration of the Directive, which used more vague language of the need to notify authorities “without undue delay”.

Another aspect gaining attention is oversight and regulation – regulators are going to be empowered with significant investigation and supervision powers including on-site inspections.

The stakes are now higher, with the prospect of fines that are capped at €10 million or 2% of an offending organization’s annual worldwide turnover – whichever is greater. Added to that, the NIS2 Directive includes an explicit obligation to hold members of management bodies personally responsible for breaches of their duties to ensure compliance with NIS2 obligations – and members can be held personally liable.  

The risk management measures introduced in the Directive are not altogether surprising – they reflect common best practices. Many organizations (especially those that are newly in scope for NIS2) may have to expand their cyber security capabilities, but there’s nothing controversial or alarming in the required measures.  For organizations in this situation, there are various tools, best practices, and frameworks they can leverage.  Darktrace in particular provides capabilities in the areas of visibility, incident handling, and reporting that can help.

NIS2 and Cyber AI

The use of AI is not an outright requirement within NIS2 – which may be down to lack of knowledge and expertise in the area, and/or the immaturity of the sector. The clue to this might be in the timing: the provisional agreement on the NIS2 text was reached in May 2022 – six months before ChatGPT and other open-source Generative AI tools propelled broader AI technology into the forefront of public consciousness. If the language were drafted today, it's not far-fetched to imagine AI being mentioned much more prominently and perhaps even becoming a requirement.

NIS2 does, however, very clearly recommend that “member states should encourage the use of any innovative technology, including artificial intelligence”[1].  Another section speaks directly to essential and important entities, saying that they should “evaluate their own cyber security capabilities, and where appropriate, pursue the integration of cyber security enhancing technologies, such as artificial intelligence or machine learning systems…”[2]

One of the recitals states that “member states should adopt policies on the promotion of active cyber protection”.  Where active cyber protection is defined as “the prevention, detection, monitoring, analysis and mitigation of network security breaches in an active manner.”[3]  

From a Darktrace perspective, our self-learning Cyber AI technology is precisely what enables our technology to deliver active cyber protection – protecting organizations and uplifting security teams at every stage of an incident lifecycle – from proactively hardening defenses before an attack is launched, to real-time threat detection and response, through to recovering quickly back to a state of good health.  

The visibility provided by Darktrace is vital to understanding the effectiveness of policies and ensuring policy compliance. NIS2 also covers incident handling and business continuity, which Darktrace HEAL addresses through AI-enabled incident response, readiness reports, simulations, and secure collaborations.

Reporting is integral to NIS2 and organizations can leverage Darktrace’s incident reporting features to present the necessary technical details of an incident and provide a jump start to compiling a full report with business context and impact.  

What’s Next for NIS2

We don’t yet know the details for how EU member states will transpose NIS2 into national law – they have until 17th October 2024 to work this out. The Commission also commits to reviewing the functioning of the Directive every three years. Given how much our overall understanding and appreciation for not only the dangers of AI but also its power (perhaps even necessity in the realm of cyber security) is changing, we may see many member states will leverage the recitals’ references to AI in order to make a strong push if not a requirement that essential and important organizations within their jurisdiction leverage AI.

Organizations are starting to prepare now to meet the forthcoming legislation related to NIS2. To see how Darktrace can help, talk to your representative or contact us.


[1] (51) on page 11
[2]
(89) on page 17
[3]
(57) on page 12

Continue reading
About the author
John Allen
VP, Cyber Risk & Compliance

귀하의 비즈니스에 좋은 소식입니다.
나쁜 사람들에게 나쁜 소식입니다.

무료 평가판 시작

무료 평가판 시작

유연한 배송
Cloud-based deployment.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
For more information, please see our Privacy Notice.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
YOU MAY FIND INTERESTING
양식을 제출하는 동안 문제가 발생했습니다.

Get a demo

유연한 배송
가상환경에 설치하거나 하드웨어에 설치할 수 있습니다.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
감사합니다! 제출되었습니다!
양식을 제출하는 동안 문제가 발생했습니다.