Darktrace is an AI-native cybersecurity company headquartered in Cambridge, UK, founded in 2013 and taken private in 2024 by Thoma Bravo for $5.3 billion. Its core product, ActiveAI Security Platform, covers six major domains: network, email, cloud OT, identity, and endpoints. It uses unsupervised machine learning to establish the enterprise's "Pattern of Life" (Pattern of Life), identify abnormal behaviors that deviate from the baseline, and respond autonomously. With 10,000+ enterprise customers, it has been certified as a leader in email security and NDR by Gartner for many consecutive years.

Darktrace

Core parameters and statistics

Darktrace uses unsupervised learning algorithms as its technical chassis, and its product matrix is built around the concept of "learning-detection-response":

Dimensions	Public information
Product form	ActiveAI Security Platform (multi-domain security platform)
Core Technology	Unsupervised Machine Learning (Pattern of Life), Bayesian Network, Graph Theory Analysis
Covering security domains	Network/Mail/Cloud/OT/Identity/Endpoint + Secure AI + Attack Surface Management
Response mode	Autonomous response (Antigena) + artificial assistance (Cyber AI Analyst)
Customer scale	10,000+ enterprise customers
Annual Revenue	$545.4 million (FY2023)
Number of employees	2,269 (2023)
Headquarters/R&D Center	Cambridge (UK), The Hague (Netherlands), London, San Francisco, Singapore
Ownership Structure	Privately held Thoma Bravo (from October 2024)

Efficiency Indicators: According to official customer cases, Cyber AI Analyst can reduce the investigation time of security analysts by 60-80%, and the average response time in typical scenarios is compressed from minutes/hours to 24.1 seconds. These numbers come from customer self-reported data, and actual results depend on context complexity and deployment maturity.

User and market recognition

Darktrace’s market position is iconic in the cybersecurity industry, and its recognition is reflected on three levels.

Enterprise customer scale: Officially announced 10,000+ enterprise customers, covering key industries such as finance, medical care, energy, manufacturing, and government. Representative clients include Coca-Cola Beverages Northeast (3,000 analyst investigative hours/October savings), State of Oklahoma (2,000 investigative hours/month cost reduction), HARMAN International (threat containment time reduced by 80%).

Industry Analyst Recognition: Darktrace has been recognized in multiple Gartner Magic Quadrants - Leader in Email Security Platform (2025), Leader in Network Detection and Response (NDR) (only 2025 Peer Insights Customers' Choice, two years in a row), CPS Protection Platform Visionary (2026, only inductee). Fast Company names Cyber ​​AI Analyst a 2026 World-Changing Idea Award winner.

Capital Market History: Listed on the London Stock Exchange in 2021, with a peak market capitalization of approximately £7 billion. After experiencing the short-selling report crisis in 2023 (Quintessential Capital Management alleged accounting issues), EY's review concluded that there were "a small number of errors and inconsistencies but did not constitute a significant impact." In 2024, Thoma Bravo completed a privatization acquisition for US$5.3 billion. In 2026, Ed Jennings took over after the CEO changed twice.

Cost advantage

Darktrace's pricing model is standard for enterprise-level security software, and is in the same echelon as competing products such as Splunk, CrowdStrike, and Palo Alto Networks.

C-side/Individual: Darktrace does not have a personal version of the product. It is positioned in the pure enterprise market and is not sold to individual users.

Developer/API Tier: No pay-as-you-go public API pricing. When enterprise customers integrate security data through the platform API, the cost is included in the total enterprise contract, and there is no independent developer pricing channel.

Enterprise/Private: Pricing is based on deployment scale and number of coverage domains. Typical billing dimensions include:

• Number of covered domains: Network, Email, Cloud, OT, Identity, Endpoint can be purchased individually or bundled by domain.
• Asset Scale: Billed based on the number of IPs/endpoints/email accounts.
• Module add-on: Cyber ​​AI Analyst, Antigena autonomous response Attack Surface Management, etc. are add-on modules.
• Service Tier: MSSP/Hosting Service Provider, Federal/Government customers have independent pricing channels.

The official real-time quotation shall prevail. The initial deployment of enterprise customers usually starts with a single domain (such as email security), and then expands to multiple domains after verifying the effect. Hidden costs mainly come from the investment in process modification and training required for the internal security operations team to connect the AI ​​analysis results.

Main functions

• Pattern of Life Anomaly Detection: Establish personalized behavioral baselines for each network device, user and entity without relying on signatures or known attack signatures. Ideal for detecting zero-day exploits, insider threats, and long-latency APT attacks.
• Antigena Autonomous Response: Automatically perform suppression actions (such as disconnecting, blocking traffic, and isolating endpoints) after detecting threats without manual intervention. It is suitable for high-speed scenarios such as ransomware outbreaks and lateral movements, and can reduce containment time from hours to seconds.
• Cyber ​​AI Analyst Automated Investigation: Transforms threat investigation from manual operations to AI-driven automated reasoning—automatically gathering context, generating root cause hypotheses, and outputting investigation reports. NOC/SOC teams can make decisions directly based on reports, reducing repetitive investigative work by 60-80%.
• Multi-domain threat correlation: Unified correlation analysis of data from the six security domains of Network, Email, Cloud, OT, Identity and Endpoint to identify cross-domain attack chains. For example, lateral movement after successful email phishing and misuse of cloud resources can be covered by a single detection.
• Secure AI module (new): Monitor the behavior of internal AI applications and AI Agents within the enterprise, and identify abnormal intentions, data leaks, and policy violations in AI interactions. Solve the "shadow AI" security management blind spots caused by the proliferation of AI applications.
• Attack Surface Management: Provides external attack surface visualization and post-mortem forensic investigation capabilities through Cybersprint technology (acquired in 2022) and Cado Security forensic capabilities (acquired in 2025).

Model and version evolution

The relevant information has not been made public, please refer to the official real-time page.

Technical advantages

Mechanism -> Effect -> Applicable scenario causal chain:

• Unsupervised Learning vs Supervised Learning: Darktrace does not use labeled attack data for training, but instead builds a proprietary Pattern of Life model for each enterprise. This means it can detect never-before-seen attack patterns (including zero-day vulnerabilities and AI-generated bypass attacks) without being limited by how often its library of known attack signatures is updated. Suitable for scenarios with high customization and rapid iteration of attack methods.
• Bayesian Network + Graph Theory Reasoning: In the detection phase, Darktrace models the relationships between entities as probability graphs and calculates the deviation probability of each entity's behavior. When a single event has a low degree of deviation but multiple events combine to form a suspicious chain, the model can output a composite threat score. The effect is that the false alarm rate is lower than that of the pure threshold scheme, and it can capture low-frequency and high-harm "low-slow" attacks.
• Suppression logic of autonomous response (Antigena): The response module does not directly perform irreversible operations such as "delete/destroy", but blocks attacks through refined suppression actions such as reducing trust, temporary isolation, and dynamic speed limiting, and retains manual review windows. Compared with traditional blocking solutions, this reduces the risk of business interruption caused by false blocking.
• Cross-domain data normalization: Unify different data sources (Netflow, DNS, HTTP, email logs, cloud API call OT protocols) into graph nodes and edges, so that the footprints of the same attack chain in different domains can be correlated. For modern multi-stage attacks (such as email phishing -> credential theft -> lateral movement -> data exfiltration), cross-domain correlation is a key capability threshold.

How to use

Darktrace is delivered to enterprise security teams, and the usage path is divided into three stages:

Phase	Action	Expected Output
Phase 1: Deployment and Baseline	Deploy sensors/probes in the target domain (Network or Email first) and enter learning mode (7-14 days)	Automatically generate enterprise-specific Pattern of Life baseline
Phase 2: Detection Verification	Observe the Threat Visualiser dashboard, verify the quality of abnormal event identification, and adjust the sensitivity threshold	Confirm that the detection coverage and false alarm rate are within the acceptable range
Phase 3: Response activation	Enable Antigena autonomous response, switch from "detection only" to "detection + response" mode, configure response strategy	Achieve automatic threat containment within seconds

Deployment methods: Supports physical devices (Network sensors), virtual devices/cloud (AWS/Azure/GCP images), SaaS (email security) and hybrid deployments. Enterprises need to have at least 1-2 security analysts as platform administrators to complete initial tuning.

Product Pricing

Darktrace does not publish a standardized price list, and the pricing model is a typical "project + renewal" structure in enterprise software.

• Purchase Starting Point: Start with a single domain (e.g. Email Security), subscribe by number of mailboxes or years of protected endpoints.
• Multi-domain discount: There is room for price negotiation when bundling multiple domains, but there is no public discount ratio.
• Add-on modules: Cyber ​​AI Analyst, Antigena autonomous response Attack Surface Management, etc. are priced independently by module.
• Contract Period: Usually 1-3 years, supports annual payment or prepayment discount.
• Free Trial: Demo demonstration and proof-of-concept (PoV) are provided, and there is no self-service free trial.

The official sales quotation shall prevail. Enterprises are advised to check the following points before purchasing: whether existing SIEM/SOAR integration is supported (API availability), data residency and compliance requirements (especially in the EU and regulated industries), and renewal price escalation terms (typical escalation rate).

Application scenarios

• Real-time Ransomware Containment: When Antigena detects file batch encryption behavior (deviating from normal reading and writing patterns), it automatically isolates the affected endpoint and blocks communication with the C2 server, reducing containment time from manual response hours to seconds. Suitable for industries that are extremely sensitive to downtime, such as finance and medical care.
• Zero-day exploit protection: Before the official patch is released, Darktrace detects exploit behavior by detecting abnormal network traffic patterns (such as abnormal DNS outreach in the Log4j era) without waiting for signature updates. Suitable for legacy systems and OT environments that cannot be patched in a timely manner.
• Insider Threat Detection: Identify internal risks such as permission abuse and data leakage by analyzing user behavior baselines (login time, data access VPN usage patterns, etc.). IP protection for high-compliance industries and R&D-intensive businesses.
• AI Application Security Governance (new scenario): The Secure AI module monitors AI applications and AI Agents used within the enterprise, and detects behaviors such as employees submitting sensitive data to AI tools and AI Agent unauthorized operations. Ideal for growing businesses that have deployed AI tools at scale but lack a unified security strategy.

Applicable people

• Enterprise CISO and Security Team: the core user group. Darktrace provides cross-domain threat visibility and autonomous response capabilities, and is suitable for security operations centers (SOC) that need to upgrade from "passive response" to "active defense". Unsuitable scenario: A mini security team with less than 2 people may face platform operation and maintenance pressure, so it is recommended to use MSSP services.
• Compliance and Risk Management Team: Meet compliance audit requirements (such as data leakage detection under SOX, PCI-DSS, GDPR) through Darktrace's audit logs and automated investigation reports, reducing the manual investment in compliance reviews. Requires platform integration with existing GRC tools.
• IT Operation and Maintenance Team: In an OT/ICS environment, IT operation and maintenance personnel can obtain visual monitoring capabilities of industrial control networks through the Darktrace/OT module without the need for in-depth security analysis knowledge. Prerequisites: The OT network must meet sensor deployment conditions (network reachability, out-of-band management).

Not suitable for the crowd: Individual users, small businesses (<50 people) and light compliance scenarios that do not require 7x24 security monitoring. The deployment cost and operation and maintenance investment of Darktrace are significantly higher than the cost-effectiveness of using MDR (Managed Detection and Response) services.

Summary and Outlook

Darktrace's core competitiveness lies in the thoroughness of its "AI-native" strategy - it is not a traditional security platform plus AI functionality, but uses unsupervised learning as the underlying logic of security detection. This gives it unique advantages in zero-day attack detection, insider threat discovery, and cross-domain threat correlation. 10,000+ enterprise customers and Gartner multi-quadrant leadership status verify the market recognition of its technology route.

Current Limitations:

• Lack of transparent pricing: Enterprises are unable to self-assess their budget before purchasing and compare it with the public price lists of competing products (such as CrowdStrike). They need to go through a complete sales process before purchasing.
• Deploying complex dependencies: Pattern of Life baseline requires a 7-14 day learning period, and there is a window period for initial security coverage of new deployments.
• Frequent CEO changes and strategic consistency after privatization: There will be three CEO changes from 2024 to 2026, and the stability of the long-term product roadmap needs to be observed.

Procurement/Adoption Risk Assessment: Darktrace is suitable for large enterprises that already have a certain degree of security operation maturity and sufficient budget as an "AI detection layer" supplement outside the SIEM/SOAR ecosystem. It is recommended that new customers verify the effect from a single domain (such as Email or Network) POC and confirm that the false positive rate and autonomous response strategy are controllable before expanding to multi-domain deployment. For teams looking for an all-in-one XDR platform that requires a unified console, evaluate how deeply Darktrace integrates with your existing security tool stack. For mid-sized businesses that are budget-conscious or require only basic EDR capabilities, the transparent pricing and lower barriers to entry of CrowdStrike Falcon or SentinelOne may be more cost-effective.

Expert View: Darktrace’s “immune system” concept has been very successful in marketing, but what enterprise security teams really care about is the false positive rate and explainability. If the AI ​​determines an abnormality but cannot give a reason, security analysts still have to investigate one by one.

Darktrace model version evolution

Darktrace’s product evolution focuses on domain coverage expansion and AI capability deepening:

Early core products (2013-2020)

• Enterprise Immune System: A network traffic anomaly detection product with unsupervised ML as the core, laying the foundation for the Pattern of Life technology route.
• Antigena (2017): The industry's first AI-driven autonomous response module, marking the transition from "detection" to "response".

Multi-domain expansion period (2020-2023)

• Darktrace/EMAIL (2020): Email security domain coverage, extending anomaly detection from the network layer to the email layer.
• Darktrace/OT: Industrial control system security coverage, adapting to the IT/OT integration trend.
• Darktrace/Cloud: Cloud workload security.
• Darktrace/IDENTITY: User identity behavior analysis.
• Cybersprint Acquisition (2022): Added attack surface management capabilities.

ActiveAI Platform Integration (2024-2026)

• ActiveAI Security Platform (2024): Unify the product brand and integrate multiple domains into a single platform.
• Proactive Exposure Management & Attack Surface Management (2025): From passive detection to active exposure surface management.
• Cado Security Acquisition (2025): Complementing Digital Forensics and Incident Response (DFIR) capabilities.
• Secure AI Module (2026 Q2): A new incremental market for enterprise AI application security.

Version Info

• ActiveAI Security Platform (2026 Q2 Release) ：Added a new Secure AI module to support visibility monitoring of AI applications and AI Agent behaviors; strengthened the autonomous response engine and cross-domain threat correlation. There is no official precise date yet. （2026-06）
• ActiveAI Security Platform (2026 Q1 Release) ：Integrate Cado Security's forensic capabilities and add Forensic Acquisition & Investigation module. There is no official precise date yet. （2026-03）
• Darktrace Platform (2025 Release) ：Proactive Exposure Management and Attack Surface Management modules are launched to expand the boundaries of attack surface management capabilities. There is no official precise date yet. （2025-06）