As Black Hat USA 2026 approaches, security leaders are once again confronting a familiar problem with a shrinking margin for error: phishing and impersonation attacks that move faster than traditional detection can keep pace with. With roughly 80% of attacks now starting with phishing or social engineering rather than brute-force intrusion, the conversation among CISOs is shifting from “how quickly can we clean up an attack” to “can we stop it before it ever reaches a customer.” That shift is exactly where Netcraft, a next-generation digital risk protection (DRP) provider, has staked its position — not as another AI-native point solution chasing the latest model release, but as a company that has spent more than a decade building the automation, relationships, and evidence-based takedown infrastructure needed to disrupt threats before they go live.
Ahead of the show, VMblog sat down with Dal Billings, vice president of marketing at Netcraft, to unpack what “preemptive” actually means in operational terms, why a 33-minute median takedown time matters less than the trust relationships behind it, and how the company’s Left of Live™ approach and Verified Attack Indicators (V.A.I.™) are closing a gap that has long left security teams reacting instead of preventing. Billings also weighs in on the increasingly crowded “AI-native security” narrative, the blind spot he sees most often among customers, and why he believes trust — not speed or automation alone — is what ultimately separates category leaders from everyone else claiming the same table-stakes features.
++
VMblog: For readers who may not be familiar, give us the elevator pitch. Who are you, what do you do, and what genuinely sets you apart in today’s crowded cybersecurity market?
Dal Billings: Netcraft is a next-gen DRP; said simply, when it comes to an external threat, we find it, prove it, and take it down. Finding it means monitoring internet infrastructure at scale; identifying the phishing sites, fake login pages, social engineering, fraudulent infrastructure, and more than 100 types of external threats. Proving it means building an enforcement-grade evidence packet that allows fast, confident action by infrastructure providers. Taking it down means working right and left of live campaigns. With a 33-minute median takedown time and the most effective preemptive domain disruption, our automation and longstanding relationships with registrars, hosts, and infrastructure providers enable us to offer fast and durable takedowns, even before threat campaigns are live.
Detection and automation are table stakes across the category now. Netcraft performs more than one-third of all phishing takedowns — we set the standard for speed and scale that the rest of the industry is measured against.
VMblog: If a CISO walks away from your booth remembering exactly one thing about your company, what do you want that to be?
Billings: We want CISOs and security leaders to know that the attacks aimed at their customers can be stopped before they arrive. While speed is a critical metric when evaluating successful takedowns of live attacks, we also work to a different standard. When we disrupt the infrastructure during the setup phase, the phishing page a customer would have landed on is gone before the campaign is sent, which is why customers see a 44% reduction in attack volume over five years.
Most of the market measures itself on how fast it cleans up, which concedes the attack already landed. Two things separate us: We find the threats others miss, and we take them down faster than anyone else. For a security leader that means real impact, measurable ROI, and less risk carried by you and your team, because most attacks against your brand never become incidents at all.
VMblog: Which specific threat vectors is your solution most directly built to address?
Billings: Phishing and impersonation, and the widening set of attacks that run on them. The mental model worth updating is that intrusion is no longer the main event. Roughly 80% of attacks now begin with phishing or social engineering, because an attacker would rather log in with a harvested credential than break through a hardened perimeter. So, the vectors we concentrate on are phishing sites and fake login pages, business identity compromise, executive and brand impersonation, social engineering threats, malicious mobile apps and social profiles, and the deepfakes and AI-generated content increasingly used to make those lures convincing.
VMblog: “AI-native security” is quickly becoming the new “cloud-native.” What does that phrase actually mean at your company, and how do you demonstrate real differentiation beyond the marketing language?
Billings: In practice, AI-native usually describes how a company was founded rather than what its product can do. It is also a fragile position, because the general-purpose frontier models any vendor can now call are absorbing much of the capability that AI-native point solutions were built to sell. If your differentiation is that you use AI, it erodes every time the underlying models improve.
Our use of AI is substantial but deliberately additive: It accelerates two decades of rule libraries and automation, threat research, and human insight, connecting the best technology suited to solve the problem.
AI and ML have been at the core of Netcraft’s solutions for more than a decade. Years of tradecraft inform more than 600,000 micro-classifiers that help Netcraft find, prove, and take down threats at a speed and scale that is unmatched by any AI-native entrant, a gap that continues to grow as we leverage the latest advances in AI to enhance, inform, and accelerate our next-gen solutions.
VMblog: What’s the most significant cybersecurity blind spot you’re seeing across your customer base right now, and how does your technology address it?
Billings: The most consequential blind spot is the assumption that a threat is not actionable until it’s live. Legacy programs may identify a suspicious domain at or near registration and then wait, because evidence collection has traditionally required content on the page. By the time that content appears, the campaign is likely already reaching victims. The opportunity is in the dormant window between registration and weaponization, often days or weeks, and it is the most impactful moment to intervene. We built preemptive Left of Live™ takedowns for that window, clustering critical data, including shared hosting fingerprints, registration and nameserver patterns, and reused phishing kit. These Verified Attack Indicators (V.A.I.™) are not a model’s guess. Over the last 18 months, we’ve worked with infrastructure providers to define the evidence they need to act ahead of traditional requirements. This enables a new takedown capability, previously inaccessible to defenders, which closes the gap and allows them to finally preempt criminal activity.
VMblog: Security teams are being asked to do more with tighter budgets and leaner headcounts. How does your solution help security leaders justify ROI and actually reduce operational burden rather than add to it?
Billings: We help security leaders by removing work rather than generating or redistributing it. The common pattern in brand and digital risk protection is a tool that produces thousands of probable threats and hands analysts the job of proving each threat, collecting evidence, and taking action themselves. That is relocated labor, not reduced labor. Our system is built to find threats, collect the evidence required, and automate the takedown process — leveraging years of relationships and trust to ensure reports are actioned quickly. Because the evidence is verified rather than probabilistic, the false-positive rate stays near-zero, which is where the hidden cost sits for a fraud or SOC team: Hours spent chasing things that were never real.
The savings compound in structural impacts. A threat disrupted before it goes live never becomes an incident, a support ticket, a chargeback, or a breach notification. Removing an attack during setup is an order of magnitude cheaper than responding once customers are affected, and that saving shows up in headcount and loss figures rather than on a detection-volume dashboard.
VMblog: Speed, AI, and automation are increasingly table stakes in DRP. In a market where every vendor claims them, what actually separates the leaders?
Billings: Trust. It’s a quality that is simple to claim, difficult to earn, and remarkably easy to lose. Leaders can prove the kind of high-value trust that is built through years of effective and credible performance, accuracy, and reporting. Speed, AI, and automation claims become an entry fee; they get you into the category but do not separate anyone within it. What separates the leaders is whether the rest of the ecosystem acts when you say something is malicious. For us, that is concrete and measurable. We maintain working relationships with more than 1,700 registrars, hosts, and platforms; we perform more than two-thirds of takedowns via proprietary connections, most of which are machine-to-machine, allowing for machine-speed disruption. That reliability is the critical element. A fast and effective takedown requires cooperation and collaboration with infrastructure providers; our 33-minute takedown sets a standard in the industry and is ultimately a measure of trust.
VMblog: Most tools detect threats once an attack is already live. Netcraft focuses on disrupting infrastructure before it reaches a target. What does “preemptive” actually mean operationally, and why is timing the differentiator?
Billings: Operationally, preemptive means treating a domain as actionable at the moment we can prove malicious intent, not the moment it can cause harm. Attackers often register infrastructure and let it age before using it, both to evade reputation systems and to stage the campaign. During that window, we identify verified attack indicators: Concrete, clustered signals such as shared hosting or TLS fingerprints, registration and nameserver patterns, or reused phishing kits that connect the domain to activity we have already confirmed as criminal. The word verified is the entire distinction. A prediction is a probability with a confidence interval, and no registrar will suspend a domain based on probabilities. A verified indicator is something we can document and defend, which is why providers take action.
So, the sequence is: Identify the potential threat, confirm the indicators, present the evidence to the controlling provider, and get the infrastructure removed before it serves a single lure. Timing is the differentiator, because while others are trying to shift “left of boom,” we’re moving left of live — stopping threats before the attack window opens. When combined with 33-minute takedowns for threats that have active campaigns associated, we’re reducing attack availability by more than 90% for our customers.
##
