Darktrace

Darktrace applies self-learning AI across network, email, cloud, identity, endpoint and operational technology, with Cyber AI Analyst for automated triage, proactive exposure management, attack surface management, forensic acquisition and investigation, and incident readiness and recovery. The vendor reports more than 10,000 customers.

The behavioural approach is the founding idea and it remains the honest way to describe what separates this category from conventional security tooling. Signature-based detection compares activity against known attack patterns, which works well for known attacks and not at all for anything new. Behavioural detection learns what normal looks like for a specific organisation and flags deviation, which means it can surface an attack nobody has seen before.

The trade-off is inherent and worth stating plainly. Behavioural systems generate more findings that turn out to be legitimate but unusual activity, because organisations genuinely do unusual things: a finance team runs an unfamiliar process at quarter end, an engineer tests something at midnight. That is why Cyber AI Analyst matters more than the detection itself. Triage capacity, not detection capacity, is the binding constraint in most security operations centres, and the vendor claims tenfold acceleration in triage.

Covering identity and email alongside network reflects how intrusions actually progress. An attacker rarely stays in one domain: credentials are phished by email, used to authenticate as a legitimate identity, then used to move through the network. Systems watching only one of those see fragments of an incident and cannot connect them.

Operational technology coverage addresses environments where the constraint is different again, since industrial systems cannot tolerate agents or active scanning and passive behavioural observation is frequently the only option available.

Published use cases span ransomware, advanced persistent threats, phishing, data loss, account takeover, insider threats, supply chain attacks and business email compromise, with technical incident write-ups published as Inside the SOC.

Pricing is not published.