Vectra Cognito

Cybercrime driven by malware is projected to cost $6 trillion globally by 2021, and the threat landscape has expanded from fewer than 2,000 known threats in the early 1990s to hundreds of millions today. Malware now spans many categories—ransomware, botnets, fileless attacks, crypto-miners, and multi-stage toolchains—often combining credential theft, privilege escalation, and stealth techniques such as hiding code in “code caves.” Volume and complexity are rising simultaneously, with hundreds of thousands of new variants detected daily and examples like NotPetya demonstrating multiple propagation methods. NotPetya also illustrates a shift toward destructive “wiper” attacks and a broader trend of state-sponsored campaigns that can be more damaging than profit-motivated crime and may achieve very high penetration due to heavy investment.

Attack channels have widened from email to social media, compromised websites, and compromised applications (including browsers and plugins). Fileless techniques and use of legitimate tools such as PowerShell undermine signature-based defenses, making layered security essential—especially capabilities to detect and respond when prevention fails. This has accelerated adoption of Endpoint Detection and Response (EDR) and the newer Network Detection and Response (NDR), which monitors network behaviors, supports forensics, and can automate mitigation while centrally logging activity.

Vectra’s Cognito NDR platform applies AI (supervised/unsupervised ML and deep learning) and behavioral analytics to detect malicious activity across data centers, cloud, mobile, IoT, and OT/SCADA environments. It integrates with common security ecosystems (SIEM, firewalls, NAC, endpoint tools) and supports three options: Stream (enriched metadata to SIEM/data lakes in Zeek format), Recall (cloud-based historical metadata search for investigations), and Detect (real-time adversary detection). Strengths include behavior-focused detection, prioritization via severity/certainty scoring, and usability features that reduce repeated false alerts. Challenges include two-week default metadata retention, lack of decryption/sandboxing, and limited built-in MFA (RADIUS today).

• The cost of cybercrime related to malware alone is expected to reach $6 trillion globally by 2021.
• The number of known threats grew from less than 2,000 in the early 1990s to hundreds of millions today.
• Hundreds of thousands of new malware variants are detected every day.
• NotPetya used several propagation methods to increase the likelihood of success.
• NotPetya is more accurately described as destructive “wiper” malware designed to destroy or overwrite data.
• Fileless attacks can propagate through process or memory injection without being written or transferred as a file.
• PowerShell can be used as a legitimate native tool to assemble and execute a malicious payload.
• Vectra is headquartered in San Jose, California, was founded in 2010, and specializes in AI-driven cyberattack detection and response.
• Vectra Cognito has a throughput rate of 40Gbps and supports 300,000 hosts in a deployment.
• Cognito’s default metadata retention period is 2 weeks.

• “Malware and other cyber criminal attack methods continue to evolve and proliferate at a rapid pace.”
• “Malware also comes in many forms: viruses, worms, rootkits, botnets, fileless malware, ransomware, and crypto-miners…”
• “The most sophisticated malware not only has several propagation/infection methods it can use, but is also increasingly split up into multiple stages…”
• “These attacks represent the rise of data-destroying malware that is part of a growing trend of state-sponsored attacks…”
• “Traditional cyber threat detection systems that rely on signature-based detection are no longer effective…”
• “NDR is the relatively new application of EDR principles to networks and adds another layer of defense…”
• “A key differentiator for NDR technology is the employment of multiple Machine Learning (ML) algorithms in the various analysis phases.”
• “While EDR provides a detailed view of the processes running on a host… NDR provides a detailed and complementary view of the interactions between all devices on the network.”
• “The behavior-based approach is aimed at identifying malicious activity accurately and at helping organizations to respond quickly and effectively…”
• “Cognito captures and stores only network traffic metadata for analysis, it does not decrypt traffic.”