Darktrace (DARK.L), a global leader in cyber security artificial intelligence, delivers complete AI-powered solutions in its mission to free the world of cyber disruption. Breakthrough innovations from the Darktrace Cyber AI Research Centre in Cambridge, UK and its R&D centre in The Hague, The Netherlands have resulted in over 135 patent applications filed and significant research published to contribute to the cyber security community. Darktrace’s technology continuously learns and updates its knowledge of 'you' for an organization and applies that understanding to achieve an optimal state of cyber security. It is delivering the first ever Cyber AI Loop, fuelling a continuous end-to-end security capability that can autonomously prevent, detect, and respond to novel, in-progress threats in real time. Darktrace employs over 2,200 people around the world and protects over 8,400 organizations globally from advanced cyber-threats. It was named one of TIME magazine’s ‘Most Influential Companies’ in 2021.
The product has provided a positive outcome in terms of investment. It has helped us identify weaknesses in our system and has proven its worth in handling security incidents. Although we only tested the solution for a short period, it is clear that it deflects common attacks and safeguards users.
Darktrace is primarily used for network traffic monitoring and analysis. It provides visibility into network traffic and helps improve security ratings. It is used by various organizations, including Managed Security Service Providers (MSSPs), consulting companies, and financial institutions. Darktrace is integrated with firewalls to automatically block URLs from certain countries. It is also used as an anti-phishing tool and for intrusion detection in complete networks. The solution detects anomalous traffic and behavioral anomalies from end users. Darktrace is part of a layered approach to cybersecurity and provides automated security measures. It is utilized for network detection and response, as well as for lateral entry and movement investigations. Darktrace is also used for tracking network activity, analyzing network traffic, and protecting IoT devices. It is an AI-driven ecosystem that generates alerts to Security Operations Centers (SOCs) and helps identify potential threats.
The most valuable features of Darktrace, according to the reviews, are:
- Insights into network traffic
- Network monitoring and email monitoring
- User-friendly dashboards
- Learning capabilities
- Monitoring perspective
- Blocking of new scanning tools
- AI that detects abnormal network activity
- Network protection and flexibility
- AI-based pattern detection in emails
- Detailed interface and graphics
- Automation and AI features
- Complete portfolio
- Cloud protection for cloud services
- Autonomous response and incident visibility
- Reduction of false positives
- Understanding of network environment and traffic tracing
- Easy integration and setup
- Behavioral analytics and monitoring
- Trimming out false positives
- NDR and email monitoring capabilities
- Autonomous learning and identification of abnormal patterns
- Customizable models, triggers, and alerts
- Detection and visibility of network activities
- Active threat dashboard
- Enterprise Immune System and Antigena technology
- Artificial intelligence module for risk detection
- Discovery of vulnerable devices and spam detection
- Large number of threat detection models
- Visibility of rogue traffic
- Comprehensive platform with different modules
- Descriptive graphical user interface
- Antigena feature for autonomous response
- Artificial intelligence and machine learning capabilities
- Library of threat detections and proactive cybersecurity
- Simple tracking capabilities and user-friendly dashboards
- Mobile application for threat monitoring
- Playbook for instructions and notifications
- Professional solution for proactive security.
Improvements needed for Darktrace include:
1. Integration with anti-malware products at the endpoint to enhance information ingestion.
2. Enhancement of the main portal's usability and ease of access, including the addition of EDR and follow-up options.
3. More accessible documentation and portal for customers, along with potential cost reduction.
4. Greater transparency and insight into Darktrace's architecture and inner workings, along with documentation and public research on its security capabilities.
5. Clearer communication regarding the need for integration with network infrastructure for automatic blocking.
6. Improved reporting on risk levels and better search tools and integration capabilities.
7. Collaboration with local partners to enhance skills and improve desktop and mobile device protection.
8. Reduction of false positive information, particularly in distinguishing between legitimate and phishing emails.
9. The need for real-world scenarios or incidents during demos to showcase the product's value.
10. Simplification of the interface for easier navigation and time-saving.
11. Adjusting the pricing to make it more affordable.
12. More integrations with other platforms and vendors, such as Sophos.
13. Expansion of cloud coverage and integration with cloud providers like Microsoft.
14. User-friendly AI features and integration with SIEM or SOAR tools.
15. Enhanced threat detection, threat intelligence, and vulnerability scanning capabilities.
16. Improvement in tracking and post-level actions within the network.
17. Reduction of false positives, complexity in reporting, and UI improvements.
18. More user-friendly and intuitive interface.
19. Enhanced MSSP capabilities and additional integrations.
20. Flexibility in licensing model and the inclusion of a Darktrace EDR client.
21. Better integration capabilities with third-party vendor platforms.
22. Further improvement of modules for increased intelligence.
23. Focus on pricing and full utilization of existing features.
24. Simplification of configurations and prevention capabilities.
25. Improved documentation and community support.
26. Accuracy of alerts and reduction of false positives.
27. Customizable playbooks or a library of playbooks for various threat scenarios.
The setup process for Darktrace is generally straightforward and easy. Some users mentioned that it can be done in under five minutes or half an hour. However, there are cases where the complexity of the network, such as cloud or MPLS networks, can make the deployment more challenging and time-consuming. Despite this, most users found the initial setup to be easy and manageable. Some users had professional services or vendors handle the setup for them. The maintenance of Darktrace is generally low, with one person being sufficient for deployment and upkeep. The product is described as simple to set up and integrate, and it can be managed by non-technical personnel. The implementation time varied, ranging from a few hours to several months, depending on the network and customization requirements. However, once deployed, the solution is described as easy to maintain and requires minimal intervention.
The solution of Darktrace is highly scalable and can accommodate a large number of users. It is rated highly for scalability, with some users rating it nine out of ten and others rating it eight out of ten. The solution has been successfully implemented in various organizations, including banks and hospitals, and has proven to handle high levels of traffic. The scalability of Darktrace is considered to be very good, and it can easily expand to meet the needs of different companies. The solution is capable of scaling from a few users to hundreds or even thousands of endpoints. It is also designed to be enterprise-wide and can cover the entire network of an organization. However, some users mention that scaling might require additional devices or appliances depending on the size and range of the deployment.
The customer service and support of Darktrace have received mixed reviews. Some customers have found the technical support team to be slow, but not terrible, rating it eight out of ten. Others have described the support as helpful, but with room for improvement, particularly for complex deployments, giving it a seven out of ten. One customer reported a positive experience, with Darktrace support responding promptly and assigning an account executive for regular communication. Another customer rated the support as good and helpful, giving it an eight out of ten. Some customers have praised the technical support, stating that it is very good and provided on a priority level. Others had interactions with the support team during setup and found them to be fine. The responsiveness of Darktrace's technical support staff was also appreciated by one customer. Another customer described their experience with support as confident and good. On the other hand, there were a few customers who did not have any experience with Darktrace's support or did not require their assistance.
Based on the reviews, users consistently mention that the solution of Darktrace is stable and reliable. They rate it highly in terms of stability, with some giving it a nine out of ten rating. Users also highlight that there are no bugs, glitches, crashes, or freezes, making it a very reliable product. The stability of Darktrace is further reinforced by the fact that it runs smoothly without impacting network traffic or slowing down any operations. It is described as a mature and solid solution that can be trusted for continuous monitoring.
The product has provided a positive outcome in terms of investment. It has helped us identify weaknesses in our system and has proven its worth in handling security incidents. Although we only tested the solution for a short period, it is clear that it deflects common attacks and safeguards users.
Darktrace is primarily used for network traffic monitoring and analysis. It provides visibility into network traffic and helps improve security ratings. It is used by various organizations, including Managed Security Service Providers (MSSPs), consulting companies, and financial institutions. Darktrace is integrated with firewalls to automatically block URLs from certain countries. It is also used as an anti-phishing tool and for intrusion detection in complete networks. The solution detects anomalous traffic and behavioral anomalies from end users. Darktrace is part of a layered approach to cybersecurity and provides automated security measures. It is utilized for network detection and response, as well as for lateral entry and movement investigations. Darktrace is also used for tracking network activity, analyzing network traffic, and protecting IoT devices. It is an AI-driven ecosystem that generates alerts to Security Operations Centers (SOCs) and helps identify potential threats.
The most valuable features of Darktrace, according to the reviews, are:
- Insights into network traffic
- Network monitoring and email monitoring
- User-friendly dashboards
- Learning capabilities
- Monitoring perspective
- Blocking of new scanning tools
- AI that detects abnormal network activity
- Network protection and flexibility
- AI-based pattern detection in emails
- Detailed interface and graphics
- Automation and AI features
- Complete portfolio
- Cloud protection for cloud services
- Autonomous response and incident visibility
- Reduction of false positives
- Understanding of network environment and traffic tracing
- Easy integration and setup
- Behavioral analytics and monitoring
- Trimming out false positives
- NDR and email monitoring capabilities
- Autonomous learning and identification of abnormal patterns
- Customizable models, triggers, and alerts
- Detection and visibility of network activities
- Active threat dashboard
- Enterprise Immune System and Antigena technology
- Artificial intelligence module for risk detection
- Discovery of vulnerable devices and spam detection
- Large number of threat detection models
- Visibility of rogue traffic
- Comprehensive platform with different modules
- Descriptive graphical user interface
- Antigena feature for autonomous response
- Artificial intelligence and machine learning capabilities
- Library of threat detections and proactive cybersecurity
- Simple tracking capabilities and user-friendly dashboards
- Mobile application for threat monitoring
- Playbook for instructions and notifications
- Professional solution for proactive security.
Improvements needed for Darktrace include:
1. Integration with anti-malware products at the endpoint to enhance information ingestion.
2. Enhancement of the main portal's usability and ease of access, including the addition of EDR and follow-up options.
3. More accessible documentation and portal for customers, along with potential cost reduction.
4. Greater transparency and insight into Darktrace's architecture and inner workings, along with documentation and public research on its security capabilities.
5. Clearer communication regarding the need for integration with network infrastructure for automatic blocking.
6. Improved reporting on risk levels and better search tools and integration capabilities.
7. Collaboration with local partners to enhance skills and improve desktop and mobile device protection.
8. Reduction of false positive information, particularly in distinguishing between legitimate and phishing emails.
9. The need for real-world scenarios or incidents during demos to showcase the product's value.
10. Simplification of the interface for easier navigation and time-saving.
11. Adjusting the pricing to make it more affordable.
12. More integrations with other platforms and vendors, such as Sophos.
13. Expansion of cloud coverage and integration with cloud providers like Microsoft.
14. User-friendly AI features and integration with SIEM or SOAR tools.
15. Enhanced threat detection, threat intelligence, and vulnerability scanning capabilities.
16. Improvement in tracking and post-level actions within the network.
17. Reduction of false positives, complexity in reporting, and UI improvements.
18. More user-friendly and intuitive interface.
19. Enhanced MSSP capabilities and additional integrations.
20. Flexibility in licensing model and the inclusion of a Darktrace EDR client.
21. Better integration capabilities with third-party vendor platforms.
22. Further improvement of modules for increased intelligence.
23. Focus on pricing and full utilization of existing features.
24. Simplification of configurations and prevention capabilities.
25. Improved documentation and community support.
26. Accuracy of alerts and reduction of false positives.
27. Customizable playbooks or a library of playbooks for various threat scenarios.
The setup process for Darktrace is generally straightforward and easy. Some users mentioned that it can be done in under five minutes or half an hour. However, there are cases where the complexity of the network, such as cloud or MPLS networks, can make the deployment more challenging and time-consuming. Despite this, most users found the initial setup to be easy and manageable. Some users had professional services or vendors handle the setup for them. The maintenance of Darktrace is generally low, with one person being sufficient for deployment and upkeep. The product is described as simple to set up and integrate, and it can be managed by non-technical personnel. The implementation time varied, ranging from a few hours to several months, depending on the network and customization requirements. However, once deployed, the solution is described as easy to maintain and requires minimal intervention.
The solution of Darktrace is highly scalable and can accommodate a large number of users. It is rated highly for scalability, with some users rating it nine out of ten and others rating it eight out of ten. The solution has been successfully implemented in various organizations, including banks and hospitals, and has proven to handle high levels of traffic. The scalability of Darktrace is considered to be very good, and it can easily expand to meet the needs of different companies. The solution is capable of scaling from a few users to hundreds or even thousands of endpoints. It is also designed to be enterprise-wide and can cover the entire network of an organization. However, some users mention that scaling might require additional devices or appliances depending on the size and range of the deployment.
The customer service and support of Darktrace have received mixed reviews. Some customers have found the technical support team to be slow, but not terrible, rating it eight out of ten. Others have described the support as helpful, but with room for improvement, particularly for complex deployments, giving it a seven out of ten. One customer reported a positive experience, with Darktrace support responding promptly and assigning an account executive for regular communication. Another customer rated the support as good and helpful, giving it an eight out of ten. Some customers have praised the technical support, stating that it is very good and provided on a priority level. Others had interactions with the support team during setup and found them to be fine. The responsiveness of Darktrace's technical support staff was also appreciated by one customer. Another customer described their experience with support as confident and good. On the other hand, there were a few customers who did not have any experience with Darktrace's support or did not require their assistance.
Based on the reviews, users consistently mention that the solution of Darktrace is stable and reliable. They rate it highly in terms of stability, with some giving it a nine out of ten rating. Users also highlight that there are no bugs, glitches, crashes, or freezes, making it a very reliable product. The stability of Darktrace is further reinforced by the fact that it runs smoothly without impacting network traffic or slowing down any operations. It is described as a mature and solid solution that can be trusted for continuous monitoring.
LOOP overview - PREVENT, DETECT & RESPOND, HEAL
Darktrace Cyber AI Loop™
The first-ever, adaptive feedback system with a deep, interconnected understanding of the enterprise. The Darktrace Cyber AI Loop represents a first-mover innovation, creating a virtuous cycle in which each capability interacts to strengthen and harden the entire security ecosystem. It allows organizations to not just prevent, detect, respond, and heal from cyber-attacks – but to do all of these all at once.
● Empowers bespoke and continuously evolving security solutions based on mathematical models unique to each organization, regardless of size or complexity.
● Delivers an end-to-end solution accessing the core Self-Learning AI technology, which provides visibility into the entire, ever-changing digital ecosystem.
● Integrates AI engines in each product family to augment all others as the organization changes. The whole is at all times greater than the sum of the parts.
● Continually learns and updates its knowledge of how an organization operates, enabling it to spot zero days, insider threats, and novel threats that get through most defenses.
● Lifts up security teams by elevating decisions and delivering threat analysis as always-on solutions work autonomously in the background to deliver at the scale of the enterprise.
Darktrace PREVENT™️
Proactive AI engine to predict and pre-empt the highest priority cyber-attacks, working inside the organization
and outside on the attack surface. Part of the Darktrace Cyber AI Loop™.
● Harden defenses proactively
● Identify and prioritize risks
● Conduct continuous around-the-clock testing
● Emulate attacks to test vulnerabilities
● Continuously communicate outcomes to the AI Loop
Darktrace DETECT™ + RESPOND™
Built on patented AI that learns you, using the unique footprints of your everyday operations to identify any unusual behavior that could indicate an attack. Responds instantly to contain any attacks detected. Part of the Darktrace Cyber AI Loop™.
● Works across entire digital ecosystem
● Protect from known and unknown attacks
● Gets stronger as it learns
● Feeds insight into the AI Loop
Darktrace Email™
Darktrace/Email defends the network against malicious emails that evade the email gateway, introducing intelligent autonomous response into the flow of email traffic. Darktrace’s rich understanding of user relationships, communications, and network activity allows Darktrace/Email to quickly contextualize events, and respond only to genuine threats, stopping them before they reach the user.
Darktrace Endpoint™
Darktrace’s endpoint capability extends Darktrace Detect and Respond to those devices which have left the network, protecting them from known and novel attackers as well as mitigating the risk of accidental or intentional data theft, compliance issues, use of non-approved software etc.
Darktrace Apps™
Darktrace/Apps stops insider threats, account takeovers, and critical misconfigurations. As a cloud-native solution powered by AI, it can continuously analyse behaviours and relationships across diverse cloud platforms and services, from AWS and Azure, to Salesforce, Dropbox, and Office 365. This enterprise-wide context enables the system to only act on high-confidence threats as they emerge within ephemeral workloads and diverse multi-cloud environments.
Darktrace Heal™
Coming 2023
Darktrace is the #1 ranked solution in top Intrusion Detection and Prevention Software, Network Traffic Analysis tools, and top Network Detection and Response (NDR) tools. PeerSpot users give Darktrace an average rating of 8.4 out of 10. Darktrace is most commonly compared to CrowdStrike Falcon: Darktrace vs CrowdStrike Falcon. Darktrace is popular among the large enterprise segment, accounting for 52% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 16% of all views.Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.