Darktrace

Darktrace is an enterprise cybersecurity AI company founded in 2013 in Cambridge, UK. Its platform uses unsupervised machine learning — trained on each organization's unique network behavior — to detect anomalies that signature-based and rule-based security tools miss.

## What Darktrace Does Well

**Self-learning AI** is Darktrace's foundational concept. Rather than relying on a database of known threats (signatures), Darktrace learns what normal looks like for a specific organization — typical user behavior patterns, standard network traffic, normal access patterns — then flags statistically significant deviations. This approach makes it particularly effective against novel, zero-day attacks and insider threats that don't match known attack signatures.

**Autonomous response (Antigena)** is the active defense component. When Darktrace detects a threat, its Autonomous Response technology can take targeted actions to neutralize it in real time — slowing a connection, blocking a specific action, or isolating a compromised device — without human intervention and without disrupting the wider business. The AI is designed to take the minimum necessary action rather than blunt blocking.

**Coverage breadth** spans network (east-west and north-south traffic), cloud environments (AWS, Azure, GCP), email (detecting spear phishing and business email compromise), endpoints, and OT/ICS systems. Darktrace provides a unified view across these environments.

**AI analyst** synthesizes alerts into high-priority incidents with plain-language explanations, reducing analyst workload. Instead of reviewing thousands of raw alerts, security teams see AI-curated incident narratives.

## Who Darktrace Is For

Darktrace targets mid-market and enterprise organizations with dedicated security teams. Its self-learning approach makes it effective in complex, heterogeneous environments where comprehensive threat modeling is infeasible. Pricing is enterprise (custom, typically significant six-figure annual contracts).