di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Follow along with Deep Instinct on a postmortem of the 2023 MGM attacks. Learn what went wrong, what could have been done to prevent the attack, and what having Deep Instinct would have changed.

MGM_930x400.png

In late 2023, MGM Resorts experienced the beginning of a ransomware cyberattack that would cost them nearly $100M USD. The multi-stage attack was launched by ShatteredSpider, a subgroup of AlphV, and progressed quickly from infiltration to exploitation. By taking advantage of social engineering tactics, injection, and inadequate security practices, ShatteredSpider pulled off one of the highest profile attacks in years. And it didn’t have to happen.&nbsp;<h5>The MGM Attack&nbsp;</h5>In the first phase of the attack, ShatteredSpider (<a href="https://therecord.media/mgm-hack-teenager-arrest-britain">who recently had a 17-year-old member arrested</a> in connection with the MGM hack) used LinkedIn to gather information about an MGM employee and then impersonated that employee on a call to MGM’s IT helpdesk. Using that access, ShatteredSpider was able to convince the helpdesk to grant them access, bypassing every existing security control. The attackers then quickly established persistence, installed sniffers, and exfiltrated key admin credentials for Azure, Windows, and Okta. MGM was, at this point, a very securely stuck fly in ShatteredSpider’s web. Because the credentials had already been exfiltrated, MGM’s subsequent attempt to stop the cyberattack by shutting down critical infrastructure was too little, too late.&nbsp;As soon as services came back online, ShatteredSpider was able to use the exfiltrated credentials and persistence to attack their main objective. They identified critical MGM business services running on VMware with 100 ESXi Hypervisors. Hitting this one target caused massive disruption to their hotel reservation systems, gambling, slot machines, digital key room access, and so much more - achieving their desired outcome. Having established Internet communication to their cloud services, they exfiltrated MGM customer data/PII, and deployed ransomware to 100 ESXi VMware Hypervisors: MGM’s entire Virtual Server and some virtual desktop environments. That, kids, is the ballgame.&nbsp;<h5>Rewriting a Successful Attack&nbsp;</h5>Learning the right lessons after a cyberattack is an important part of both remediation and preparation for the next attack. When a high-profile attack like MGM happens, the entire cybersecurity industry gets the chance to analyze, dissect, and ultimately battle game the attack to see what would have worked and what wouldn’t. Everyone should be admitting the same thing about the first phase of the attack: there is not a policy in place, a training you could give, or a tool available that can remove the human element from an attack. The tools malicious actors use are complex, effective, and malleable. With the rise of AI, they’ve only become more dangerous. AI voice and video impersonations are an excellent example of this danger.&nbsp;Initial infiltration was just step one. The real battle took place in the hours and days following the vishing. The attackers installed sniffers and compromised critical infrastructure. The strategy of ‘detect and respond’ falls short here: how much time does it take to detect an attack and how much more time does it take to adequately respond?&nbsp;It’s during that ‘detect and respond’ period that Deep Instinct could have been a difference maker, not just slowing the attack, but preventing it altogether. ShatteredSpider were smart about their attack. The payload was delivered directly to the hypervisor layer; it wasn’t staged on end points, in storage, or delivered via email, thus avoiding several detection and prevention layers. This leaves two points to prevent the attack: the hypervisor layer and the internet delivery. In our tests, Deep Instinct was able to secure both points.&nbsp;<a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct EPP</a> running on the hypervisor layer detected and quarantined the payload before it could execute. Similarly, <a href="https://www.deepinstinct.com/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications (DPA)</a> integrated into the internet layer via API or ICAP would have also prevented the payload.&nbsp;&nbsp;<h5>Debrief, DIANNA, Do-Over&nbsp;</h5>MGM lost control of their situation the moment the social engineering attack was successful. Their lack of hypervisor partition, secondary credentials, scanning capabilities, and other industry-standard security controls meant that once the attackers had established persistence and exfiltrated admin credentials they would have free run of the place. Having those defenses would have at least hardened MGM as a target but they would not necessarily have prevented the attack completely.&nbsp;Unfortunately, much of the cybersecurity industry’s value-prop isn’t true prevention, it’s disaster mitigation. The biggest success of most tech stack configurations would be that they stopped the bleeding. This cybersecurity philosophy can be cynically distilled into one key question: How much are you willing to lose? At a large enterprise like MGM, even successfully defending against a cyberattack can be costly.&nbsp;Where Deep Instinct makes a difference is the focus on prevention. Barring the human element that allowed access to critical infrastructure, Deep Instinct DPE and DPA would have prevented the actual substantive parts of the MGM attack. The bleeding didn’t have to happen, and the “success” of only a small number of accounts being affected didn’t have to happen. The malicious payload used in the MGM attack could have been immediately caught, quarantined, and deleted pre-execution when scanned by Deep Instinct. Using DIANNA, MGM could have immediately figured out why the payload was caught and deleted.&nbsp;<a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, our generative AI powered cybersecurity companion</a>, was able to tell us nearly instantly (okay, seven seconds) in real language why the Alphv ransomware was malicious, including the markers it used to make that determination. In short order we had both stopped the attack and developed a framework for investigating the attack. In addition to stopping the attack, there are other key benefits for some groups:&nbsp;<ul><li>SOC Teams: In terms of both efficacy and stress, SOC teams are a main beneficiary of effective prevention-first cybersecurity. Given rising rates of burnout among SOC professionals, tools that support their mission are invaluable. Read more about the rates of burnout among SOC professionals in our <a href="https://www.deepinstinct.com/voice-of-secops-reports">2024 Voice of SecOps report</a>.&nbsp;</li></ul><ul><li>MGM: Better cybersecurity reduces organizational risk and increases confidence. A prevention-first approach eliminates the death-by-a-thousand-cuts damage to organizational reputation and budget caused by the current cybersecurity paradigm.&nbsp;</li></ul><ul><li>MGM Customers: Having personal data stolen is incredibly dangerous for consumers and puts them at risk for fraud, identity theft, and other targeted attacks. Not allowing a breach to occur at all increases confidence and mitigates the legal and personal ramifications of allowing personal data to be stolen.&nbsp;</li></ul>Novelty is a weapon. Most of the time it’s a very effective one. The introduction of deepfakes has revolutionized social engineering attacks. Malicious AI has similarly revolutionized cyberattacks. There are more methods than ever for bad actors to gain access to secure systems. AI-powered mutations allow attacks to constantly refresh and renew themselves in novel ways to evade existing cybersecurity. To keep up, defenders need tools that make them equally responsive.<a href="https://info.deepinstinct.com/request-a-demo">Get a demo</a> to see the power of a prevention-first approach for yourself.&nbsp;

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Explore how Deep Instinct integrated Deep Instinct Prevention for Applications (DPA) with our internal Microsoft SharePoint and OneDrive and strengthened our security. 

PracticeWhatWePreach_900x400_1.png

Deep Instinct is well-versed in the need for speed. The unique pressures of the startup environment necessitate near-constant communication and filesharing between employees and our eco-system of partners to meet the needs of our customers. Those files need to be two things: secure and speedy.&nbsp;&nbsp;
To address our needs, we’ve developed the capability to integrate <a href="https://www.deepinstinct.com/prevention-for-applications">Deep Instinct Prevention for Applications (DPA)</a> with our internal Microsoft SharePoint and OneDrive. Let’s look at what this means for us at Deep Instinct and how you can benefit from the same integration.&nbsp;
Exciting things first: this integration isn’t theoretical — it's already live for Deep Instinct and is delivering four key benefits that help us achieve more as a company:&nbsp;&nbsp;
<ul>
 <li>Real-time threat prevention&nbsp;</li>
 <li>Event-driven actions&nbsp;</li>
 <li>Seamless user experience&nbsp;</li>
 <li>Privacy&nbsp;</li>
</ul>
These benefits accelerate our already fast-paced environment and help safeguard the file sharing capabilities we rely on. Now we can be certain when we send or receive files via SharePoint or OneDrive, they’re not malicious.&nbsp;&nbsp;
<h5>Real-Time Threat Prevention&nbsp;</h5>
By integrating Deep Instinct Prevention for Applications with our SharePoint and OneDrive deployments, we scan and classify every file in the environment, quickly quarantining malicious files and stopping them in their tracks. (Of course, those malicious files are coming from outside our organization; we use <a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct Prevention for Endpoints</a> to ensure we're not the ones spreading malware.)
Because the scan process happens in near real time, users sharing and receiving files won’t notice the it taking place. Instead of waiting for a file to be scanned and returned, interrupting the flow of work, files scanned by DPA are available immediately, when we need them.
Regardless of size, DPA integrated in your organization would function much the same. It would give you the same real-time threat prevention capabilities without disrupting workflows. In addition to the regular benefits of a Deep Instinct deployment, your organization would no longer need to rely on inconsistent, cumbersome, and slow tools or worry about blind spots in the data estate. One of our biggest customers scans billions of files a month across their organization in a “real-time” data/file collaboration use case. Deep Instinct works on a huge scale.&nbsp;
<h5>Decide How You Defend&nbsp;</h5>
We see the efficacy of this integration every day at Deep Instinct. Clarity into file delivery and scanning gives us peace of mind, while automatic deletion and notification streamlines the security process – still letting people know why a file may not have arrived.&nbsp;
Rather than introducing a laborious identification and remediation process, users can choose to allow Deep Instinct to automatically delete malicious files and notify the recipient, or just issue an alert without deleting the file. Instead of waiting for a breach to happen or leaving you in the dark about the status of a file you’ve requested, this method empowers you to choose your next steps to defend against this attack and the next.
Sole reliance on endpoint security solutions should be a last resort. This integration gives us another layer of security before we have to rely on EDR and prevents bad actors from ever reaching the endpoint in the first place. We keep ourselves safe using the same combination of solutions and tools we use to protect our customers.
And when this integration is combined with <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, the industry’s first generative AI cyberassistant to provide malware analysis</a> on known and unknown threats, our security teams can easily examine any quarantined and deleted file to determine in seconds why it was flagged, not hours or days.
<h5>Seamless User Experience</h5>
This integration continues to offer the seamless Deep Instinct user experience that only we can offer. It’s an experience we trust and that we’re happy to integrate into our own environment and security posture. The combination of speed, accuracy, and information makes Deep Instinct an invaluable tool for our own teams and accelerates our business processes and yours.
<h5>Privacy</h5>
Deep Instinct is focused on privacy, which is why users are always in control of their own data. Microsoft allows users to “bring your own keys” meaning only the “keyholder” can see the file content. In this case, users control the encryption of SharePoint and OneDrive, not Microsoft. Deep Instinct doesn’t need users to send their data elsewhere to be effective, meaning the chain of custody, encryption, and privacy isn’t broken by a third party. Unlike legacy scanning tools, file provenance can be safeguarded by keeping it within your environment.
The DPA + SharePoint and OneDrive integration is an excellent example of how Deep Instinct implements our products in our own environment. It also illustrates how we can integrate with the same tools your organization already uses to provide a better, safer experience.
Ready to dive deeper? Effective prevention and cybersecurity relies on speed and accuracy. Deep Instinct uses deep learning to prevent threats with more accuracy and speed than any other solution. <a href="https://www.deepinstinct.com/blog/defeat-AI-cyber-threats-with-deep-learning">Learn why deep learning powered threat prevention is at the forefront of the cybersecurity battle</a>.
Security doesn't end with just one tool. Defense in depth is a strategy to keep your organization safe using multiple tools to build an effective wall against breach and attack. <a href="https://info.deepinstinct.com/file-upload-security?_ga=2.109077509.1025104848.1720546918-1577162200.1714240296&_gac=1.238305844.1718135387.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE" target="_self">Explore how Deep Instinct secures your file uploads</a> to see another step you can take to secure your organization.
And if you're ready to take the next step, <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.215978322.475833869.1717446548-1577162200.1714240296&_gac=1.208487718.1716560633.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE">request a demo</a> with one of our knowledgable team to see what Deep Instinct can do for you.

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

DI-3-Reasons-Blog1.jpg

Job change decisions are always difficult, especially when you've spent over two decades working for the same organization. For me, the challenge was getting out of my comfort zone and embracing a fresh change.So, what inspired me to take the plunge and make Deep Instinct my choice?Having spent most of my career in different roles in what was an ever changing, but still the same organization, I had an itch that I wanted to try something different. At the time I was not able to articulate exactly what would scratch the itch until meeting with some members of Deep Instinct and then it clicked. I realized this is the change that I wanted.<h2>Unparalleled Innovative Technology</h2>I had been a part of Citi for over 25 years, and spent much of this time leading teams responsible for security strategies and engineering aspects, plus day-to-day running of security products/services that protected Citi’s global business units. After more than two decades, I felt like I wanted to do something different in cybersecurity, not just go to another large company and do the same thing again. But how could I utilize my learning and experiences while giving me something of a new fresh perspective and remaining close to technology?This is where Deep Instinct comes in. Moving into the cyber start-up community would enable me to have an impact on many organizations, while being part of something I already knew I enjoyed. I believe that is Deep Instinct and its innovation in deep learning that provides continuous prevention that other approaches cannot match.When Deep Instinct first came across my desk, like most, I felt we had a good solution already. However, the Deep Instinct name kept popping up, so one Saturday morning I reviewed without the distraction of day-to-day activities. It clicked for me what was unique about Deep Instinct, and how I came to believe that deep learning is the next evolution in cybersecurity – just like we leapt from traditional signatures to machine learning. I had such a “ah ha” moment in previous start-up waves; a gem of an idea or approach hidden in a smaller company. Some of those previous moments that I was involved in are now very successful cybersecurity companies today, and myself and the teams I ran had a part to play in their development and strategy that helped them get there. The scratch for my itch had been found!The prevention capabilities of this technology and the ability to constantly expand its knowledge base like the human mind, give deep learning unparalleled potential in our endless fight to protect the enterprise, or now for me, customers and enterprises. History will show Deep Instinct to be the first disruptive company in this next evolutionary wave of preventionThe most exciting aspect of deep learning is that we are yet to explore its full potential. It’s such a scalable technology that can be applied to both devices and non-device specific workloads such as cloud platforms. There’s a massive landscape of security risks and gaps that can be explored with deep learning which I can now explore within the company, expanding our capabilities addressing real problems in cyber. So, who wouldn’t want to be a part of this revolutionary journey?<h2>Great Leadership and Culture</h2>“Blimey! What a passionate group of people” – this was my first impressions when I met the Deep Instinct team – I am British after all. Everyone was genuinely excited, and they really believed in the product. This is not something you see in every cybersecurity company.Due to the stressful nature of the industry, I find that workforces are often unengaged with their organizations and as a leader of large global teams, this was always a priority for me. The Deep Instinct team was very different – they didn’t just talk about their technology stack, we spent time talking about leadership, people, and culture – they really cared. As impressive as the technology is, this feeling is more important to me.<h2>Amazing Reputation</h2>A perk of being in the security industry for so long is that you make a fair share of connections. I asked my friends, ex-colleagues, partners, and former clients about Deep Instinct. None of them had negative feedback about the company or technology, in fact most pushed me into the direction that I really shouldn’t miss the opportunity no matter what else was in my path.Deep Instinct has already achieved a strong foundation, and credibility in the market and with customers all based on the talent and technology with a focus on customer success. The research team continues to excel, combined with the products and technology Deep Instinct is unparalleled today.I am honored and very excited to start a new journey of my life with such an innovative and prospective organization.

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.

Carl Froggett

From Carl Froggett.