Darktrace

Darktrace is an enterprise AI cybersecurity platform in the Network Detection and Response (NDR) category, with custom pricing typically ranging from $150,000 to $500,000+ per year depending on deployment scope and modules selected. Founded in 2013 by mathematicians from the University of Cambridge, Darktrace pioneered the application of unsupervised machine learning to cybersecurity, creating what it calls the Enterprise Immune System — a self-learning AI that models the normal 'pattern of life' for every user, device, and workload in an organization without requiring signatures, rules, or prior threat intelligence.

The platform's core differentiator is its ability to detect novel and zero-day threats that signature-based tools miss entirely. Rather than matching known attack patterns, Darktrace's AI identifies subtle behavioral deviations that indicate compromise — whether from external attackers, insider threats, or AI-driven attacks like deepfake phishing. This approach has earned recognition as a Leader in the 2025 Gartner Magic Quadrant for Network Detection and Response.

Darktrace's ActiveAI Security Platform spans seven security domains through dedicated modules: /NETWORK for traffic analysis and NDR, /EMAIL for anti-phishing and business email compromise prevention, /CLOUD for AWS, Azure, and GCP runtime protection, /OT for industrial control systems and SCADA monitoring, /IDENTITY for credential misuse and account takeover detection, /ENDPOINT for device-level behavioral analysis, and /SECURE AI for monitoring internal AI agents and LLM applications. This unified coverage allows the platform to correlate a phishing email to a cloud account takeover and lateral network movement as a single campaign rather than generating three separate alert streams.

Autonomous Response, branded Antigena, takes surgical containment actions at machine speed — blocking specific malicious connections, enforcing a device's normal communication pattern, or quarantining compromised assets — without disrupting legitimate business operations. The Cyber AI Analyst automates Tier-1 triage by correlating related alerts, conducting automated investigations, and producing natural-language forensic reports, reportedly accelerating investigation workflows by 10x.

Darktrace is trusted by over 10,000 organizations across 110+ countries, including Fortune 500 companies and critical infrastructure operators in financial services, healthcare, energy, and manufacturing. Deployment requires network sensors or mirror ports with a 1-4 week behavioral learning period before detection accuracy stabilizes. The platform integrates with major SIEM platforms, SOAR tools, and cloud environments via REST API, and supports both on-premises and cloud-based sensor architectures with SOC 2 Type II certification and GDPR compliance.