Darktrace is an AI-powered cybersecurity platform designed to help organizations detect, investigate, and respond to threats by identifying unusual behavior across their digital environments. Unlike traditional security tools that often rely heavily on known threat signatures and predefined rules, it uses behavioral analysis to understand what normal activity looks like and identify suspicious changes. In this guide, we’ll explain what Darktrace does, how its technology works, whether it is considered a SIEM, which products it offers, and what changed after its acquisition by Thoma Bravo in 2024.
What Is Darktrace?
Darktrace is a UK-based cybersecurity company that uses AI to spot and respond to cyberattacks as they’re happening. It started in Cambridge back in 2013, founded by a small group of mathematicians and cybersecurity specialists who wanted a different approach than the usual signature-based method, where a tool only catches an attack if it matches something already on a known list.
Instead, Darktrace’s software watches how every device, app, and person in a company normally behaves, and builds a kind of live picture of that. Once it knows what “normal” looks like, it can pick up on the small, weird stuff a rigid rules-based system would probably miss completely. Darktrace calls this Self-Learning AI, and honestly, it’s the backbone of nearly everything else the company sells.
A lot has happened since the early days. Darktrace went public on the London Stock Exchange in 2021, and then in October 2024 it went private again after being bought out by Thoma Bravo. We’ll get into that part a bit later.
What Does Darktrace Do?
Basically, Darktrace’s job happens in four steps: spot something odd, figure out what it means, shut it down if needed, and help the team clean up afterward. Detection is where it all began, and it’s still the core of the product. The original tool watched network traffic and raised a flag whenever something broke a device’s usual pattern.
Figuring out what an alert actually means is mostly handled by something called Cyber AI Analyst. Instead of dumping raw log files on a tired analyst at 3 a.m., it pulls the related pieces together into one report that’s actually readable. Darktrace says this speeds up investigations by around ten times compared to doing it manually, though that number comes from their own research, not some outside lab, so take it as a vendor claim rather than a verified stat.
Then there’s the response side, which is honestly the part most people get curious about first. Darktrace can act on its own, slowing down a suspicious connection or cutting off a device, without waiting on a human to approve anything. And it doesn’t need to have seen the attack before. A brand-new ransomware variant, a phishing email nobody’s ever spotted, or someone quietly moving files around at 2 a.m., all of it can trigger a response simply because the behavior looks wrong.
How Does Darktrace Work?
The whole thing runs on behavioral modeling. Darktrace pulls in data from a company’s network, cloud setup, email, and devices, then builds a kind of mathematical baseline for what’s typical there. Every employee has habits. Every machine talks to certain systems at certain times, day after day.
The second something breaks that pattern, even a little, the AI notices. Maybe a server suddenly starts reaching out to some address it’s never contacted before. Or an account logs in from two different countries within the same hour. Neither of those needs to look dramatic to get flagged.
From there, Cyber AI Analyst ties the related pieces together and writes up what it thinks actually happened, instead of just spitting out a stack of disconnected alerts. Security teams tend to say this is genuinely one of the more useful parts of the whole platform, since manually stitching together ten separate alerts is exactly the kind of tedious work that burns people out.
Autonomous response is the last piece. Set up right, it can take a very specific action, like blocking one connection instead of shutting the entire network down. That matters a lot to companies that can’t afford downtime just to stop one threat.
Is Darktrace a SIEM Tool?
No, it’s not. This comes up constantly, so let’s clear it up. A SIEM (Security Information and Event Management) is a tool built to collect logs from all over an organization, put them in one place, and let analysts search through it all and generate compliance reports. Splunk and Microsoft Sentinel are two of the well-known examples.
Darktrace does something different. Its whole strength is behavioral anomaly detection powered by that self-learning AI, not log collection and rule matching. A lot of companies actually use Darktrace and a SIEM together rather than picking one over the other. Darktrace can send its findings straight into a SIEM, so the SIEM keeps handling the broad logging and compliance work while Darktrace focuses on catching the subtle stuff nobody’s seen before.
Keep that in mind if you’re already running a SIEM and wondering whether Darktrace fits. It’s more of a teammate than a replacement.
Is Darktrace an NDR or XDR Platform?
At its heart, Darktrace is a Network Detection and Response (NDR) tool, and over time it’s grown into something closer to XDR, Extended Detection and Response. Darktrace / NETWORK has actually been named a Leader in Gartner’s Magic Quadrant for NDR two years running now, including the 2026 report, which says a lot about how strong the network side of the product still is, independent of anything Darktrace says about itself in its own marketing.
The XDR label fits because the platform doesn’t stop at the network anymore. That same behavioral model now covers email, cloud, endpoints, identity, and even operational technology. NDR and XDR aren’t really rivals here, they’re just two different scopes of the same basic idea, one zoomed into the network, the other stretched across the whole business.
Attacks rarely stick to just one system these days. That’s a big reason platforms built to connect signals across multiple areas have become more useful than tools that only watch one thing.
Darktrace Products
Everything Darktrace sells sits under what it calls the ActiveAI Security Platform. Each product covers a different corner of a company’s setup, and they all share the same core AI engine, even though what each one actually looks for is pretty different.
| Product | Main Purpose |
|---|---|
| Darktrace / NETWORK | Network-based threat detection and response (NDR) |
| Darktrace / EMAIL | Catches phishing, business email compromise, and account takeover attempts |
| Darktrace / CLOUD | Watches cloud workloads and SaaS apps for anything off |
| Darktrace / ENDPOINT | Threat detection on laptops, desktops, and servers |
| Darktrace / IDENTITY | Flags compromised or misused user accounts |
| Darktrace / OT | Security for industrial control systems and OT environments |
| Darktrace / SECURE AI | Helps secure internal and third-party AI agents |
| Cyber AI Analyst | Handles automated investigation and reporting across every module |
On top of those, the platform also covers Proactive Exposure Management for cutting down internal risk, Attack Surface Management for finding assets exposed to the outside world, plus Forensic Acquisition & Investigation and Incident Readiness & Recovery for companies that want help during and after an actual incident.
Most businesses don’t buy the whole lineup right away. Usually they start with whatever matters most, network, email, or cloud, and add modules later as needs grow. If you’re weighing which modules make sense together, OpenFuture AI’s tool directory is a decent place to compare that kind of thing side by side.
What Is Darktrace Used For?
Companies bring in Darktrace to deal with a pretty consistent list of threats. Ransomware tops it, and a lot of Darktrace’s own marketing leans on stories about the AI stopping encryption mid-attack, before files actually get locked. Phishing and business email compromise come right after, since email is still how most attackers get their foot in the door.
Account takeover and insider threats are another big one, since behavioral detection is genuinely good at noticing when a login looks fine on paper but is acting strange. Beyond that, teams use it to spot lateral movement, which is basically an attacker already inside quietly working their way toward more sensitive systems, and to catch data exfiltration before large chunks of information walk out the door.
Zero-day and never-before-seen attacks are really what this whole approach was built for in the first place. Signature-based tools can only stop what they already recognize. A behavior-based system, in theory, can catch something nobody’s ever documented, simply because it doesn’t look right for that particular environment.
Darktrace vs Traditional Cybersecurity Tools
Compared to a SIEM, Darktrace is better at catching unknown threats through behavior but weaker at centralized logging and compliance reporting, which is exactly why the two often end up paired together. Compared to EDR (endpoint detection and response), Darktrace’s ENDPOINT module goes head to head, though dedicated EDR vendors usually dig deeper into endpoint forensics since that’s all they focus on. Against other NDR tools, Darktrace’s edge is breadth, since the platform reaches well past the network into email, cloud, and identity too.
Against the bigger XDR platforms, it usually comes down to personal preference. Some companies want one vendor handling everything. Others would rather mix and match, picking whichever tool is strongest in each area. Neither approach is wrong exactly, it really depends on what a security team already has in place and how much overlap they’re okay dealing with.
Darktrace Competitors and Alternatives
The AI cybersecurity space has gotten pretty crowded, and Darktrace runs into a handful of familiar names. Microsoft Defender and Sentinel are the go-to for companies already living in the Microsoft world. CrowdStrike dominates in endpoint-heavy setups. Palo Alto Networks competes broadly on network security, Splunk on logging and SIEM, and Vectra and ExtraHop show up often as more direct NDR rivals.
Picking between them usually comes down to what a team is actually missing, not whichever vendor has the flashiest AI pitch. If a company already has solid endpoint coverage but weak visibility into its network, an NDR-focused tool is going to be worth more than another endpoint agent.
Darktrace Stock: Is Darktrace Publicly Traded?
No, Darktrace isn’t publicly traded anymore. It listed on the London Stock Exchange in 2021 under the ticker DARK, but that changed in 2024. Thoma Bravo agreed to buy the company for around 5.3 billion dollars in cash, paying shareholders 7.75 dollars per share. The deal closed on October 1, 2024, and Darktrace’s shares stopped trading and came off the FTSE 100 shortly after.
This wasn’t Thoma Bravo’s first swing at it either. An earlier attempt back in 2022 fell apart over price disagreements. The deal that finally went through two years later ended up being one of the bigger take-privates of a London-listed tech company in recent memory.
For anyone who wants the details straight from the source rather than a summary, Thoma Bravo’s official announcement covers the terms of the deal directly.
Since then, Darktrace has run as a privately held company under Thoma Bravo, and its Cambridge headquarters and day-to-day operations have stayed pretty much the same under the deal terms.
Who Owns Darktrace and How Many Employees Does It Have?
Thoma Bravo has owned Darktrace since October 2024. Before that, the biggest shareholders were KKR and Summit Partners, who’d backed the company through its earlier growth years.
Darktrace says on its own site that it has more than 2,300 employees spread across over 30 offices worldwide, protecting more than 10,000 customers. That’s the number worth going with since it comes straight from the company rather than a third-party guess.
If you want more background on how ownership has shifted over the years, Darktrace’s Wikipedia page has a pretty solid rundown of the company’s financial and ownership history.
Careers at Darktrace span research, security engineering, sales, and customer success, and the company’s often hiring for its Cyber AI Research Centre, the team that keeps building out the models behind the whole platform.
How Much Does Darktrace Cost?
Darktrace doesn’t put a price list on its website, which is pretty normal for enterprise security tools sold through custom quotes rather than flat subscriptions. What you end up paying depends on which products you pick, how big and complicated your environment is, what kind of deployment you need, and how many devices, users, or mailboxes need covering.
Because of that, you’ll need to actually talk to sales and get a quote rather than compare Darktrace to competitors using some advertised sticker price. Expect a conversation that scopes out your setup first, since two companies with similar headcounts can walk away with very different numbers depending on which modules they end up needing.
Darktrace: Strengths and Limitations
Darktrace’s biggest strength is catching stuff that doesn’t match any known threat signature, since it’s actually learning behavior rather than following static rules. Cyber AI Analyst genuinely saves time for security teams that are already stretched thin, and having coverage across network, email, cloud, OT, and identity means fewer blind spots for anyone running several modules at once.
That said, there are real limitations too. It’s built with big enterprises in mind, so a smaller business might find it’s more than they actually need. Since pricing isn’t public, comparison shopping means going through a sales process no matter what. And because a lot of companies already own overlapping tools, like Microsoft Defender or CrowdStrike, there’s a genuine risk of paying for features you already have, so that’s worth checking before signing anything, not after.
Frequently Asked Questions
What is Darktrace?
Darktrace is a British AI cybersecurity company that uses self-learning behavioral models to detect, investigate, and respond to cyber threats across networks, email, cloud, and other environments.
What does Darktrace do?
It spots unusual behavior across a company’s systems, automatically investigates incidents through Cyber AI Analyst, and can take action on its own to contain threats.
Is Darktrace a SIEM tool?
No. It’s a behavioral detection and response platform, not a SIEM, and it’s usually deployed alongside a SIEM rather than instead of one.
Is Darktrace an XDR?
Pretty much, yes. It extends detection and response across network, email, cloud, endpoint, identity, and OT environments, all under one platform.
Is Darktrace an NDR?
Yes, that’s really its core. Darktrace / NETWORK has been named a Leader in Gartner’s Magic Quadrant for NDR two years in a row, including 2026.
What is Darktrace used for?
Mostly ransomware detection, phishing and business email compromise, insider threats, catching lateral movement, and spotting attacks nobody’s ever seen before.
Is Darktrace publicly traded?
No. It delisted from the London Stock Exchange after Thoma Bravo finished acquiring the company in October 2024.
Who owns Darktrace?
Thoma Bravo, since October 2024, after a deal worth about 5.3 billion dollars.
How many employees does Darktrace have?
The company says it has more than 2,300 employees across over 30 offices worldwide.
How much does Darktrace cost?
There’s no fixed pricing. It depends on the modules you pick, how big your environment is, and how it’s deployed, so you’ll need to request a custom quote.
Final Thought
Darktrace made its name by doing security a bit differently, teaching AI to recognize what’s normal for one specific business instead of chasing a never-ending list of known threats that’s always a step behind. That hasn’t made older security tools pointless, but it’s earned Darktrace a real spot in how a lot of security teams operate today, especially as attacks keep getting faster and harder to predict. Whether it’s actually worth adding to your own setup depends on what you’re already running, your budget, and how much of your environment needs covering.