Darktrace / CLOUD & Identity — AI Detection for Cloud and SaaS

① Why cloud & SaaS are hard to secure

Cloud breaks the old security model in three ways. It is dynamic — resources spin up and down by the minute, so a fixed inventory is wrong almost as soon as you write it. It is identity-centric — the real perimeter is no longer an IP range or a firewall, it is an identity (a user or a role) holding a key. And it is ephemeral — containers and functions live for seconds, so there is often nothing to install an agent on.

That is why signatures and static rules don't fit. A signature only matches an attack someone has already seen and described; a static rule ages out the instant the environment changes. The attacks that matter most here use legitimate-looking API calls with valid stolen credentials — there is no malware signature to catch. What you actually need is a learned sense of normal, so that a known-good identity suddenly doing something it never does stands out on its own.

② Darktrace / CLOUD — visibility plus Self-Learning AI

Darktrace / CLOUD brings Self-Learning AI to the public cloud — AWS, Azure and Google Cloud. First it builds architectural visibility: a dynamic, real-time map of your cloud assets and how they connect, kept current as resources change. Then it learns the normal pattern of life for every cloud workload, resource and identity from your own activity — and detects deviations. No signatures, no pre-written rulebook.

Where the data comes from

It feeds on cloud-native, largely agentless inputs: flow logs, cloud provider APIs and lightweight collection, plus container and Kubernetes visibility. Because the detection is behavioural, it does not need to decrypt traffic or match a signature — and because the inputs are agentless, you get coverage across ephemeral, fast-changing cloud estates without an agent on every box.

③ What it detects — and Darktrace / IDENTITY for SaaS

On the deviation from learned normal, Darktrace / CLOUD flags misconfigurations and risky posture, anomalous identity activity (a user or role doing something it never does), impossible-travel logins, privilege escalation, compromised credentials, and lateral movement between cloud resources. These are exactly the steps a credential-based attack walks through — and none of them necessarily change your posture, so they are invisible to a misconfiguration scan.

Darktrace / IDENTITY extends the same idea to SaaS and cloud users — Microsoft 365, Entra ID and the like. It learns each identity's normal behaviour and catches account takeover and SaaS misuse as a deviation from that pattern, rather than by a static rule. An attacker logged in with valid stolen credentials still behaves unlike the real user — and that is what gets flagged.

④ Cross-platform correlation vs CSPM-only — and the pitfalls

The platform advantage is correlation. Cloud, identity, network and email signals are stitched together in Cyber AI Analyst, so a single incident narrative can tie a suspicious cloud login to the phishing email that stole the credential and the network beacon that followed — instead of three disconnected alerts in three tools. That is the interview line: CSPM tells you a door is unlocked; Darktrace tells you someone is walking through it right now.

Pitfalls to avoid

Three mistakes show up again and again: relying on posture/CSPM alone (it misses active, credential-based threats); not ingesting cloud logs or identity (no data in means no behaviour learned); and treating cloud as a separate island from the rest of the platform, which throws away the cross-domain correlation that catches the full attack story.