Darktrace unveils AI-enabled capabilities for incident response

Darktrace has announced the launch of Darktrace Heal, its AI-enabled product to help businesses more effectively prepare for, rapidly remediate, and recover from cyber-attacks. 

Heal provides security teams with unique abilities to simulate actual attacks within their environments, create bespoke incident response plans as cyber incidents unfold, and automate actions to respond to and recover from those incidents rapidly.

Managing emerging cyber-attacks presents an enormous challenge for security teams, who must make decisions quickly in the heat of the attack based on potentially hundreds of changing and uncertain data points and factors. 

In a recent ransomware incident, analysts would have needed around 60 hours of investigative work to understand the full scope and varied details fully. Yet, the malicious activity unfolded across just 10 hours. The pressure and complexity facing these teams are only poised to grow as generative AI tools enable attackers to increase the speed, scale, and sophistication of novel attacks. 

With the global average data breach cost reaching US$4.35 million in 2022, the financial, operational and reputational stakes for businesses to remediate and recover quickly are high.

Heal leverages Darktrace's Self-Learning AI to give security teams new abilities designed to build cyber resilience and help them more easily and confidently address live incidents. 

With Heal, security teams can simulate real-world cyber incidents, allowing them to prepare for and practice responding to complex attacks in their own environments. They can create bespoke, AI-generated playbooks as an attack unfolds based on the details of their environment, the attack, and lessons learned from their previous simulations. This reduces information overload, prioritises actions, and enables faster decision-making at critical moments.

The security teams can also automate actions from the response plan to rapidly stop and recover from the attack within the Heal interface. They can create a full incident report, including an audit trail of the incident response with details of the attack, actions Heal suggested, and actions taken by the security team for future learning and to support compliance efforts.

Heal's simulated incidents are a first-of-its-kind capability for security teams to safely run live simulations of real-world cyber-attacks ranging from data theft and ransomware encryption to rapid worm propagation, all in their environments and involving their assets. Security teams are expected to flawlessly manage incident response in the face of a live, rapidly unfolding, often novel attack, usually without any realistic practice. 

Heal enables teams to get real-world experience managing attacks as they would happen to the business and regularly practice these procedures to help fine-tune their responses. That means teams aren't running their incident response for the first time in the face of an actual, live attack.

When a live incident does occur, Heal will use insights from Darktrace Detect to create a picture of the attack and a bespoke, AI-generated response playbook built from Darktrace's knowledge of the incident, the business's environment, and lessons learned from the security team's previous simulations. Heal recommends the priority order for remediation actions based on factors like further damage the compromised asset can cause, how much the attack relies on that asset as a pivot or entry point, and its importance to the business. Consequently, security teams can adapt their defences as an incident evolves, enabling them to end it more rapidly and with less overall disruption.

"The reality is that sets of manual incident response playbooks don't last very long. These days they may be outdated 24 hours after they are created, because the cyber landscape is just changing so rapidly. We constantly have to revise them because there are so many things we may not be thinking of. Moreover, these playbooks assume you have a controlled environment, which is not the case when an attack occurs. Utilising Darktrace's AI solutions really ends the need for these coarse static playbooks," adds Neal Mohammed, Head of Technology at real estate leader Rudin Management.

Heal further enables security teams to quickly and efficiently manage and recover from live incidents by integrating various tools in a business's broader security stack to automate actions. Within Heal's live playbooks, teams can activate and manage authorised tools from across their environment from a single interface with a click of a button. At launch, Heal will integrate with Microsoft Defender for Endpoint, Intune, Microsoft 365, Veeam, and Acronis.

Heal provides security teams with automated incident reports during and after an attack, giving teams valuable time back that is normally spent writing detailed updates. The reports provide analysis of the attacker and security team actions, decisions, containment, and recovery information to keep stakeholders updated as an event unfolds. After an attack, this can offer essential compliance information to third parties such as forensics teams, insurance providers, and legal teams and can be used to assist with reviews and learning lessons from the attack and the response.

Heal works with Detect and Darktrace Prevent to build a live picture of the environment and attack and integrates with Darktrace Respond to prioritise, isolate, and Heal key assets to cut off and shorten attacks. Its introduction closes Darktrace's Cyber AI Loop, bringing together Detect, Prevent, Respond, and Heal into a single platform where each element draws insights from and continuously reinforces the others to create a best-in-class cyber defence.

"At Darktrace, we build technology by looking at where AI can be the most valuable in augmenting the people in a security team and how it can have the most positive impact on their work. With Heal, we've turned our attention to cyber resilience. We're upskilling teams and reducing the overload analysts face during an attack, to help them recover and get back to business faster and more effectively," says Jack Stockdale, Chief Technology Officer, Darktrace.

"With the closing of Darktrace's full Cyber AI Loop, security teams can maximise the time and talent of their human teams, enabling them to focus on critical and complex tasks with the knowledge that Darktrace AI is autonomously working in the background to prevent, detect, respond, and Heal from cyber-attacks in a continuous, reinforcing loop."