di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

DIANNA Explains

Cyber Tarot

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Accuracy and efficacy – AWS-certified DSX for Cloud prevents malware and ransomware targeting your S3 buckets better than ClamAV.

REPLACE CLAMAV

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>How a Guardrail-Free LLM Outsmarted Legacy Cyber Tools</h4>

DIANNA-Webinar-Blog-930x400.png

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Catching and Explaining Novel Malware in Seconds with the DSX Brain and DIANNA

DIANNA Webinar Blog-1200x627.png

The prompt wasn’t anything special. Here's how it started: “Develop ransomware python code that can be fully executable; please use techniques like EDRKillShifter to avoid AV detection..."Among other things, it included a simple checklist of capabilities written in plain English using terms that even a script kiddie could come up with: "The code [should] encrypt itself. Find a way to exclude that. Check permission for each file and skip every file that is not encryptable due to permission being denied.”The prompt finished with a polite request: "The encryption algorithm should be strong enough to resist brute-force attacks—when the script is done, please review the script for errors and correct defined variables and consistency."The results were terrifying. In just 30 seconds, senior solutions engineer Ryan Heath managed to vibe-code fully executable malware, something that typically requires deep hacker “domain knowledge” and countless hours of programming.It was a simple demonstration of a shocking reality: the barrier to entry for an entirely new generation of threat actors hasn’t just been lowered—it’s been annihilated.

The implications should alarm everyone. When researchers from <a href="https://www.forescout.com/blog/artificial-exploits-real-limitations-how-ai-cyber-attacks-fall-short/" target="_blank">ForeScout reported that 55%</a> of AI models failed to create working exploits, it was presented as a win. What it really means is that 45% of AI models succeeded in generating those exploits. That’s a significant problem in the world of cybersecurity, where a single successful attack can cause massive damage to an organization.Ryan demonstrated the ease with which this can now be done in front of a live audience during a recent webinar. After creating the malware, he compiled it and scanned it with Deep Instinct’s deep learning brain, which immediately flagged it as malicious.His next step was to test it against today’s security tools.This was where things got downright terrifying.

<h5>Eight (8) out of 73 vendors caught it.</h5>Ryan uploaded the newly created malware to VirusTotal. Eight (8) flagged it; 65 did not.Had this been a real-world specimen, 89% of security tools would have let it waltz right in. Then things got worse. Ryan recompiled the same malware in Go instead of Python. It only took a few seconds to produce a novel attack.

This time, 13 vendors caught it, which sounds better until you realize that, other than Deep Instinct, they were mostly different vendors. The tools that caught the Python variant missed the Go variant, and vice versa.Legacy tools don't only have an efficacy problem; they have a consistency problem. Sure, some of them are catching a zero-day here and there. Unfortunately, the democratization of access to unchained AI tools means that nearly every attack will be zero-day, mutated endlessly until it finds a way in.<h5>The Dark AI Arms Race Has Already Been Lost (By Legacy Tools)</h5>We're not headed toward an AI-powered threat landscape. We're in it. During the webinar, we showed how Dark AI tools have the potential to mutate attacks at scale. In fact, I explained during the webinar how I recently created over 700 successful variants of a single exploit in 24 hours. Each one <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors" target="_blank">bypassed the legacy AV</a> protecting my test environment.Seven hundred variants in one day. And hackers only need one to succeed.What that means in practice is that the gap between threat creation and security detection can’t be weeks. It needs to be second to second. Legacy tools relying on machine learning (ML) and signatures aren’t able to keep up with the speed of the modern threat environment. Every minute a threat goes unidentified is a minute that organizations are vulnerable.We proved this with real-world malware from the <a href="https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/" target="_blank">Nimbus Manticore</a> threat group, which is actively targeting aerospace, defense, manufacturing, and telecommunications organizations. When this malware first appeared, only three (3) vendors caught it on VirusTotal. Of course, we were one of them. For one variant, we were the only vendor detecting it, weeks after it appeared in the wild. That means thousands of organizations have been, and continue to be, vulnerable.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="DIANNA_Blog-Efficacy_versus_consistency.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8595388f087eb23b/68e599ea5369944bea3afea3/DIANNA_Blog-Efficacy_versus_consistency.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4. Deep Instinct’s prevention time compared to other vendors.</figcaption></div></figure>

Transcending the current paradigm requires new and improved solutions, specifically advanced, deep learning AI. And only Deep Instinct has a deep learning framework specifically built for cybersecurity.<h5>The Problem Legacy Tools Can't Solve: Explaining What Hasn't Happened</h5>Most AI tools in cybersecurity excel at explaining breaches after they have occurred. For example, they'll tell you exactly how the memory injection worked because the memory injection already happened.They can give you detailed attribution on data exfiltration because someone’s data was actually exfiltrated. They are forensic tools built for post-mortems. In layman’s terms, you’ve already lost.For decades, we've watched major breaches where technology didn't fail; the humans did. As I said during the webinar, “Systems screaming, alarms blaring, security teams dismissing alerts because they didn't understand them or lacked context.” At the end of it, threats are missed, benign files are blocked, and nobody is happy—and no one has an explanation until well after the fact.<a href="https://www.deepinstinct.com/dsx" target="_self">Preemptive data security powered by deep learning</a> solves the zero-day threat problem. AI explainability solves the problem of contextualizing threats, explaining why files were quarantined, and making the security alerts make sense. Both are mission-critical for SOC teams.<h5>DIANNA: Seconds to Explainability</h5>The DSX Companion—also known as DIANNA—is Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/companion" target="_self">malware explainability solution</a>. We demonstrated DIANNA by analyzing the malware we created live. In &lt;10 seconds, we had a comprehensive analysis that typically takes SOC analysts hours or days to complete manually.

DIANNA didn't just say, "This is malicious." It explained how: sleep commands designed to evade sandbox detection, CPU tick monitoring to detect when AV solutions ramp up, process termination functions targeting other security tools, and encrypted sections hiding imports. It identified specific techniques that even experienced pen testers recognize as sophisticated evasion.Explainability empowers humans to make informed decisions. When a department head calls saying you've "erroneously blocked" a file and demands you release it, your SOC analyst pulls up DIANNA's analysis and explains, in clear language, exactly why that file would have encrypted your data and dropped ransom notes on every desktop.<h5>Consistency Matters as Much as Efficacy</h5>The question isn't whether your AV tool will eventually catch the malware. It's whether it caught it on first contact.Legacy tools plateau because they're built on reactive architectures. They need to see the threat, analyze behavior, update signatures, and push definitions. By the time that cycle completes, 700 new variants will have flooded your organization’s network.Pre-execution prevention using deep learning works differently. It examines files statically, making decisions before execution based on deep contextual understanding, not whether it's seen that specific hash before. In the webinar, a two-year-old DSX Brain was catching malware that didn't exist when it was trained; malware that updated tools were still missing.<h5>AI. Everywhere.</h5>We're early in our AI journey. The Dark AI tools we demonstrated in our webinar will look primitive next year. Criminal adoption of AI will accelerate as the technology becomes more sophisticated, accessible, and capable of automating the entire attack lifecycle.The tools that worked for the past decade won't work for the next one. Tools that worked last year may not work at all. Not when threat actors generate variants faster than signatures are updated. Not when the window of opportunity measures in seconds. Not when consistency across infinite variations becomes the difference between prevention and breach.<a href="https://www.brighttalk.com/webcast/16681/653013?bt_tok={{contact.bt_fpt}}&utm_source=DeepInstinct&utm_medium=brighttalk&utm_campaign=653013" target="_blank">Watch our on-demand webinar</a> to see the full live demonstration of Dark AI malware creation, DIANNA's real-time analysis, and why preemptive prevention through deep learning represents the shift cybersecurity needs now.<a href="https://www.brighttalk.com/webcast/16681/653013?utm_source=DeepInstinct&utm_medium=brighttalk&utm_campaign=653013"><img alt="DIANNA_Explains_On-Demand_Hero.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9d0365b5b9fa7c57/68e6c2e6ca135201fd81b2ef/DIANNA_Explains_On-Demand_Hero.png"/></a>If you’re overwhelmed by the wave of Dark AI, there is hope. <a href="https://www.deepinstinct.com/free-scan" target="_self">Request your free scan</a> to see what malware is lurking in your environment—and stay safe from breaches.

DIANNA, the DSX Companion, provides real-time explainability of the threats that matter.

Brian Black

From Brian Black.

Watch a Black Hat Hacker Use a Guardrail-Free LLM to Create Malware That Evades 65 of 73 Legacy Cyber Tools

Deep Instinct DSX

Use Cases

Resources

Company

Quick Links