Simplifying cross domain investigations

Modern attackers routinely move across identity, network, cloud and email domains, a reality the article argues makes cross-domain investigations essential because no single tool can reveal the whole attack story. In April 2025 the UK experienced a cyberattack on Marks & Spencer, carried out by a group called Scattered Spider, which bypassed identity rather than a technical vulnerability and deployed ransomware across ESXi VMs after exfiltrating the NTDS[.]dit file.

The piece highlights how threat actors exploit multiple domains—Identity, Network, Cloud and Email—to mask their activities, and notes that in the M&S case the intrusion affected several domains before being detected, a pattern emblematic of cross-domain campaigns.

It also cites that 24 countries were impacted by Atomic Stealer activity observed by Darktrace in 2025, with initial cases concentrated in Europe, the Middle East and Africa before distribution broadened, and that cloud environments pose particular challenges with 65% of organisations spending 3–5 extra days investigating cloud incidents. According to CISA, Scattered Spider uses a wide variety of TTPs across domains and frequently changes their techniques to evade detection.

The article argues that automation and AI are becoming indispensable, with Darktrace’s Cyber AI Analyst stitching together cross-domain activity to turn hours of correlation work into minutes of investigation.