Darktrace launched a set of proactive security capabilities, dubbed PREVENT, moving the security artificial intelligence (AI) vendor one step closer to delivering a closed-loop cyber AI platform. Darktrace CTO Jack Stockdale explained PREVENT helps customers move from typical threat reacting to proactively getting into attackers’ minds.

The PREVENT launch “brings us another big step closer to delivering our technology vision of a cyber AI loop,” Darktrace CEO Poppy Gustafsson said, adding the vendor is the first to apply AI to this emerging prevent area.

“A purely reactive approach to security is quickly becoming inadequate. Early data from research into how organizations are mitigating cyber risk and threats shows a shift towards proactive, ‘always-on’ technologies continually running tests on existing systems,” echoed IDC research director Chris Kissel. “Yet a continuous approach is fundamentally impossible to achieve without automation and AI.”

PREVENT is the third product capability from Darktrace's Cyber AI Loop delivery service. The first two were DETECT and RESPOND capabilities, and the last will be HEAL.

The PREVENT product family is based on AI algorithms developed by the Darktrace AI Research Center and capabilities from its recent Cybersprint deal. Darktrace acquired the attack surface management startup for more than $53 million in March.

Darktrace initially launched PREVENT end-to-end (E2E) followed by PREVENT attack surface management (ASM).

Maximilian Heinemeyer, VP of cyber innovation at Darktrace, explained the E2E product is an “outcomes-based approach to managing cyberrisks,” which includes capabilities such as attack path modeling, autonomous penetration testing and AI modeling, breach and attack simulation, security awareness training, and vulnerability prioritization. And the PREVENT ASM uses AI to “perform reconnaissance on a specific target by simply knowing the name of the entity,” he added.

That insight feeds back into the DETECT and RESPOND products to enable product integration and create a feedback loop for continuous threat landscape learning.

“We take all of these market segments and tie them together in a single cohesive workflow, really the first one to synthesize these things, put AI on top, aggressively automate, and go beyond what's currently available on the market,” Heinemeyer said.

Darktrace first introduced its Cyber AI Loop plans during its initial public offering on London Exchange Market in April 2021. 

The vendor started the journey with the DETECT capabilities, which use self-learning AI to spot known and unknown threats and attacks. Then, Darktrace feeds those detection outputs into the second AI engine to enable real-time actions for attack response, Stockdale said.

The latest addition offers prevention capabilities, and the last product family to close the loop will be HEAL, which Gustafsson expects to release mid-2023.

Darktrace is looking to build those capabilities into a single tool for a single security team to use, Stockdale said, adding that this loop can work in any environment including the cloud, endpoint, critical industrial systems, or external attack surfaces. 

“We have systems that take this loop of AI engines very, very close to the data so you can do that real-time detect and respond, and in real time get in the mind of attackers,” he added.