Infoblox upgrades DNS defence to counter AI-driven cyberattacks
With a global rise in cyberattacks and new tactics from adversaries leveraging artificial intelligence (AI) to target vulnerabilities, Infoblox's improvements focus on providing protection before threats can cause disruption or damage to users, devices, Internet of Things (IoT)/Operational Technology (OT), and cloud environments.
Pre-emptive defence
The recent upgrades to Infoblox Threat Defence utilise predictive threat intelligence combined with algorithmic and machine learning-based detection capabilities. This preventative approach is designed to stop high-risk and malicious domains on average 68 days earlier than traditional security tools, while maintaining a reported false positive rate of 0.0002 per cent. "The difference between most DNS security tools and our approach is like the difference between law enforcement chasing street-level drug dealers versus taking down the cartel," said Mukesh Gupta, Chief Product Officer at Infoblox. "We target the suppliers behind the cyberattackers - the cartel - so threats can be blocked before they ever reach the network. This preemptive strategy helps security teams reduce risk, eliminate noise and stop threats at the DNS layer before they ever reach the network."
The advancements are designed to provide tighter security through features such as more comprehensive visibility, actionable insights, flexible token-based licensing models, and improved reporting on threats stopped prior to causing impact. Infoblox reports that these tools provide clear, quantifiable metrics that may assist security teams in demonstrating return on investment by highlighting threats intercepted before reaching critical systems.
Cloud integration and proactive threat blocking
In addition to protecting traditional networks, Infoblox's Protective DNS technology is set to power Google Cloud's DNS Armour, a move that will bring native security to cloud workloads. The public preview of Google Cloud's DNS Armour, supported by Infoblox, is expected later this year.
By blocking attacks earlier in the cyber kill chain, the company suggests it can reduce reliance on downstream detection and response systems, such as XDR (Extended Detection and Response) and SIEM (Security Information and Event Management). This shift aligns with recommendations from analysts such as Gartner and guidelines like the NIST SP 800-81, which highlight the value of DNS-layer defences in preventing incidents at an earlier stage.
Industry response and regional focus
Scott Harrell, President and CEO of Infoblox, commented on shifts in the cyber threat landscape, stating, "Traditional 'detect and respond' security simply can't keep pace with today's AI-driven attackers and malware. Cybercrime is evolving faster than ever, costing the world trillions and exploiting gaps in legacy defences. The legacy kill chain approach depends on someone else being 'patient zero' so those legacy systems can learn and react - but attackers today customise malware to target individual businesses or industries, rendering legacy, reactive approaches ineffective against modern AI-enabled attackers. When you're patient zero, the only thing being 'killed' is your business. The future of cybersecurity must be preemptive: stop threats before they ever reach your organisation."
Paul Wilcox, Vice President of Regional Sales, APJ, drew attention to regional trends, saying, "Across APAC, cyberattacks are growing more aggressive and calculated. From exploiting third-party access points to targeting critical systems - attackers are finding the cracks in our digital foundations and are using AI to strike faster and smarter than ever."
He continued, "For businesses in Singapore, where digital services are tightly woven into daily life, any downtime or confidentiality breach can be deeply disruptive. That's why organisations here need to invest in earlier threat detection that starts at the DNS layer. Stopping an attack before it begins is far less costly than dealing with the aftermath."
Reporting and security operations enhancements
The updated Infoblox solution introduces a centralised Security Workspace for deeper visibility, and a Detection Mode that highlights missed threats without necessitating changes to existing DNS configurations, aiming to minimise operational risk for organisations. The Asset Data Integration feature offers additional context for analysts conducting further investigations.
Flexible token-based licensing aligns pricing with usage, simplifying procurement and potentially offering clearer value for cost-conscious enterprises.
The enhancements come as analysts predict global cybercrime costs could reach USD $23 trillion by 2027. The company's approach is designed to stop attacks before impact, rather than waiting for an initial breach to trigger a response, aiming to help organisations remain resilient against the evolving tactics of cyber adversaries.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
3 hours ago
- Techday NZ
Armis surpasses USD $300 million in annual recurring revenue
Armis has reported that it has exceeded USD $300 million in annual recurring revenue after registering an increase from USD $200 million in under twelve months. The company provides cyber exposure management and security for a wide range of global organisations, which include United Airlines, Colgate Palmolive, and Mondelez, as well as more than a third of the Fortune 100 and numerous federal agencies and states. According to Armis, its client base also accounts for 60% of Fortune 10 companies, three of the five largest US retailers, three of the five largest banks, and several other major enterprises. The company's technology protects operational technology (OT), Internet of Things (IoT), information technology (IT), and medical environments, assisting organisations in addressing vulnerabilities from software code to cloud infrastructure. Revenue milestone Armis attributes this rapid increase in annual recurring revenue to a significant demand among global organisations for the Armis Centrix platform and related products. The company states that organisations are increasingly adopting Armis' offerings to gain improved visibility, protection, and management of their entire digital attack surface. "Surpassing another $100m milestone in ARR so quickly proves we have the right platform, the right set of products and our customers are using Armis for complete cyber risk exposure management and security," said Yevgeny Dibrov, CEO and Co-Founder of Armis. "Customers globally are excited about our roadmap and recognise the vital role we play being one of their most important security providers. I want to thank all our customers, partners and the Armis team for their continued delivery as we secure the most critical environments of every major organisation and vertical." Partner focus The company has increased its efforts to expand partner engagement and boost revenue generated by strategic partnerships. With contracts signed with several large Global Systems Integrators, Armis has sought to make its cyber exposure management solution more accessible to organisations around the world. Its partner ecosystem now includes organisations such as AWS, KPMG, Accenture, PWC, Fortinet, Guidepoint, WWT, Google, and numerous others. Armis has also grown its physical presence, recently opening offices in Munich, London, Bucharest and New York. Over the past year, the company expanded its product portfolio by releasing three new products and made several technology acquisitions. These developments have extended its expertise in OT and cyber-physical systems (CPS) security, now enabling support for environments that are airgapped or disconnected from the internet through new hybrid and on-premises offerings. Product development and growth "The investments we've made in organic and inorganic product development and in building the strong go-to-market machine we have built are paying off and driving huge momentum," said Jonathan Carr, Chief Financial Officer of Armis. "Each technology that we develop works together, creating a better together story for our customers and enabling us to address security in ways that just were not possible before. We strive to help organisations move from 'detect and then respond' to a more proactive approach that allows them to protect their organisations before an attack happens. The results we have seen have been a great validation of this approach and we are poised to have our best year yet, growing in excess of top public company benchmarks." Armis reports that its growth and product development are driven by both internal development efforts and acquisitions. The company states that the combined capabilities of its different technologies create a unified offering for its customers. Analyst recognition Industry analysts such as Gartner, Forrester and IDC have ranked Armis in their reports. Most recently, Armis was named a Leader in the Gartner Magic Quadrant for CPS Protection Platforms and as a Leader in The Forrester Wave: Unified Vulnerability Solutions, Q3 2025. Armis' Centrix platform and suite of solutions continue to be demonstrated in partnership with organisations across various cities as part of the Armis Connect roadshow series, highlighting cybersecurity challenges and their approaches to addressing them.
Techday NZ
4 hours ago
- Techday NZ
AI-driven DNS threats & malicious adtech surge worldwide
Infoblox has published its 2025 DNS Threat Landscape Report, revealing increases in artificial intelligence-driven threats and widespread malicious adtech activity impacting organisations worldwide. DNS exploits rising The report draws on real-time analysis of more than 70 billion daily DNS queries across thousands of customer environments, providing data on how adversaries exploit DNS infrastructure to deceive users, evade detection, and undermine brand trust. Infoblox Threat Intel has identified over 660 unique threat actors and more than 204,000 suspicious domain clusters to date, with 10 new actors highlighted in the past year alone. The findings detail how malicious actors are registering unprecedented numbers of domains, using automation to enable large-scale campaigns and circumvent traditional cyber defences. In the past 12 months, 100.8 million newly observed domains were identified, with 25.1% classed as malicious or suspicious by researchers. According to Infoblox, the vast majority of these threat-related domains (95%) were unique to a single customer environment, increasing difficulty for the wider industry to detect and stop these threats. Malicious adtech and evasive tactics The analysis highlights the growing influence of malicious adtech, with 82% of customer environments reportedly querying domains associated with blacklisted advertising services. Malicious adtech schemes frequently rely on traffic distribution systems (TDS) to serve harmful content and mask the true nature of destination sites. Nearly 500,000 TDS domains were recorded within Infoblox networks over the year. Attackers are also harnessing DNS misconfigurations and deploying advanced techniques such as AI-enabled deepfakes and high-speed domain rotation. These tactics allow adversaries to hijack existing domains or impersonate prominent brands for phishing, malware delivery, drive-by downloads, or scams such as fraudulent cryptocurrency investment schemes. TDS enables threats to be redirected or disguised rapidly, hindering detection and response efforts. "This year's findings highlight the many ways in which threat actors are taking advantage of DNS to operate their campaigns, both in terms of registering large volumes of domain names and also leveraging DNS misconfigurations to hijack existing domains and impersonate major brands. The report exposes the widespread use of traffic distribution systems (TDS) to help disguise these crimes, among other trends security teams must look out for to stay ahead of attackers," said Dr. Renée Burton, head of Infoblox Threat Intel. Infoblox notes that traditional forensic-based, post-incident detection - also termed a "patient zero" approach - has proven less effective as attackers increase their use of new infrastructures and frequently rotate domains. As threats emerge and evolve at pace, reactive techniques may leave organisations exposed before threats are fully understood or shared across the security industry. AI, tunnelling and the threat intelligence gap DNS is also being leveraged for tunnelling, data exfiltration, and command and control activities. The report documents daily detections of activity involving tools such as Cobalt Strike, Sliver, and custom-built malware, which typically require machine learning algorithms to identify due to their obfuscation methods. Infoblox Threat Intel's research suggests that domain clusters - groups of interrelated domains operated by the same actor - are a significant trend. During the past year, security teams uncovered new actors and observed the continued growth of domain sets used for malicious activities. Proactive security recommended The report advocates a shift towards preemptive protection and predictive threat intelligence, emphasising the limitations of relying solely on detection after the fact. The data indicates that using Infoblox's protective DNS solution, 82% of threat-related queries were blocked before they could have a harmful impact, suggesting that proactive monitoring and early intervention can help counter adversarial tactics. Infoblox researchers argue that combining protective solutions with continuous monitoring of emerging threats is essential to providing security teams the necessary resources and intelligence to disrupt malicious campaigns before significant damage occurs. The report brings together research insights from the past twelve months to map out attack patterns and equip organisations with up-to-date knowledge on DNS-based threats, with a particular focus on the evolving role of harmful adtech in the modern threat landscape.
Techday NZ
4 hours ago
- Techday NZ
AppOmni enhances SaaS platform with new AI security features
AppOmni has unveiled new SaaS and AI security capabilities to address the growing wave of artificial intelligence and SaaS-related risks faced by organisations. The company's latest platform updates include features to help security teams understand their exposure to AI threats and implement controls, with a focus on identifying both sanctioned and unsanctioned, otherwise known as shadow, AI applications - including those embedded in popular SaaS platforms. Complex attack surfaces The increasing adoption of AI in the enterprise landscape has created a more complex attack surface for security professionals. AI tools are now deeply integrated within SaaS environments, either as embedded features in platforms such as M365 or Google Workspace, or operating as independent agents. These tools handle and process sensitive data throughout the SaaS estate, making them both a potential facilitator and target for cyber attacks. According to AppOmni, the convergence of native AI applications and SaaS offerings means AI is quickly becoming a ubiquitous layer within software solutions used by businesses. This transformation highlights the need for organisations to gain visibility into their SaaS and AI landscape, particularly to identify unsanctioned or shadow tool usage, as well as to develop practical strategies for controlling and monitoring these technologies. Expanded application support AppOmni's platform now supports an additional 30 AI and SaaS applications, including widely adopted tools such as ChatGPT Enterprise, Claude, OpenAI, Anthropic, Cisco Umbrella, Cisco Secure Access, and Gong. The company also introduced three new product packages meant to provide a structured path for enterprises at varying stages of their SaaS security maturity journey. Each package includes a free SaaS and AI Attack Surface Assessment and a 90-day trial for the AppOmni Foundations package. Targeted solutions The three packages - Foundations, Advanced, and Enterprise - are each tailored to different organisational needs. The Foundations package serves as an entry-level option designed for companies looking to begin their SaaS security journey. It offers tools to discover shadow SaaS and AI, manage app users and permissions, and detect threats or anomalous activity. AppOmni states that its latest State of SaaS Security 2025 Report found 30% of businesses sought advanced SaaS security capabilities to mitigate risk. The Advanced package builds on this with more comprehensive threat detection and posture management. The Enterprise package, aimed at organisations with the highest security maturity, enables granular control over SaaS security settings and integration with existing security operations. Industry perspectives "Securing AI is now a board-level priority, and that battle must be fought within the SaaS ecosystem," said Brian Soby, Co-founder and CTO of AppOmni. "AI and SaaS security are two sides of the same coin since much of AI is delivered through SaaS. The first step for any organisation is to discover its shadow AI and SaaS usage. AppOmni is leading the charge by first exposing shadow AI, and then securing its use through policy controls for both standalone AI tools and AI embedded within SaaS applications. These innovations empower organisations to embrace AI by taking a comprehensive approach to SaaS security." Mark Butler, CISO (Advisory) at Trace3, offered his perspective on the significance of this integrated approach, stating, "AppOmni's new level of integrated capabilities delivers faster desired outcomes for both organisations and channel partners alike. The ability to discover, analyse, monitor, and secure the expanding landscape of SaaS and AI applications is a game-changer. Strengthening organisations' ability to maintain full visibility, defend against SaaS and AI drift, and ensure the intended use of critical SaaS apps and AI backed software drives increased business revenue and protects data while moving at the velocity of innovation." Recent developments The announcement comes after AppOmni's introduction of AskOmni, an AI-powered SaaS security assistant, and the industry's first SaaS Security Model Context Protocol (MCP) Server. With these advancements, AppOmni aims to support organisations in securing their organisations' AI usage, from the initial discovery of AI applications through to continuous monitoring, risk reduction, and response to emerging threats.
