- Verified by BizGlocal
Broad Behavioral AI Security Platform For Mid-Market And Enterprise Security Teams
- 2,300+
- 2013
- Cambridge, UK
- 6+
About Darktrace
Industry leader in connected fleet operations
Market Position
A private-equity-owned cybersecurity vendor competing with CrowdStrike, SentinelOne, Vectra AI, Microsoft and Proofpoint, with published customers that include ESL Federal Credit Union, Banco Galicia, Centre Parcs, HARMAN International and the City of Las Vegas.
Innovation Focus
Adaptive AI that learns each environment instead of using a shared model, autonomous response, AI-driven investigations, attack path modeling and a new Secure AI product for AI agents and shadow AI.
Core Strengths
Coverage across network, email, cloud, identity, endpoint and OT, a Leader placement in Gartner’s 2026 NDR Magic Quadrant, ISO certificates and 24/7 expert services.
Use Cases
Ransomware containment, phishing and business email compromise, account takeover, insider threats, cloud and OT monitoring, and lighter analyst workload.
Core Products & Solutions
Darktrace / HYBRID NETWORK And Cyber AI Analyst
Learns normal activity from encrypted and decrypted traffic across network, cloud and OT, then correlates cross-domain incidents. Cyber AI Analyst investigates alerts, and response runs natively or through firewalls, EDR, SOAR and ITSM tools.
Darktrace / EMAIL
Behavioral detection of phishing, impersonation and business email compromise, with identity response, data loss detection across Teams, Zoom and Slack, and awareness training. Collaboration coverage detects and alerts but does not block.
Darktrace / CLOUD, ENDPOINT And IDENTITY
Cloud detection and response across workloads, APIs, containers and identities, plus automated forensics and attacker timelines. Endpoint and Identity are listed as separate products, covering account takeover and privilege misuse even with valid credentials.
Darktrace / OT
Protects converged IT and OT environments, and Darktrace reports a 2026 Gartner Visionary placement for CPS Protection Platforms. Protocol and asset coverage were not verifiable on the pages we could load.
Proactive Exposure Management, Attack Surface Management And Incident Readiness & Recovery
Attack path modeling tests exposures for reachability and likelihood of exploitation, and Attack Surface Management claims to find 30 to 50% more assets. Incident Readiness & Recovery prepares teams for an attack and a fast recovery.
Darktrace / SECURE AI And Services
Secure AI covers shadow AI detection, prompt analysis, agent identities and AI development risk. Services include MDR, Managed Threat Detection, Security Operations Support and Proactive Health Optimization in Standard and Premium tiers.
Pricing Overview
Core Platform Deployments (Third-Party Estimates)
Teams that want a reference point for network detection and response cost
Custom
Pricing
Median deal of about $55,200 a year, per Vendr data cited by UnderDefense
- UnderDefense cites a 75th percentile deal near $131,000 a year, also from Vendr data
- It models mid-market deployments of 500 to 2,000 devices at $150,000 to $500,000 a year
- Large enterprise contracts are described as $300,000 to $500,000 a year or more
- Treat every figure as a third-party estimate, not a Darktrace quote
Email And Per-Module Add-Ons
Teams adding email, cloud, identity, endpoint or OT coverage
Custom
Pricing
Custom quote, with a third-party email estimate of $3.25 to $8 per mailbox per year
- UnderDefense says email is priced per mailbox, endpoint per agent and OT per asset
- Network pricing is said to depend on monitored devices and bandwidth
- Detect, Respond, Email, Cloud, Identity, OT and Endpoint are described as separate line items
- A Capterra reviewer says prices can be negotiated for broader use
Managed Services, Support And Multi-Year Terms
Lean security teams that want expert monitoring and larger enterprises negotiating multi-year deals
Custom
Pricing
Custom quote, with third-party uplift estimates
- UnderDefense estimates MDR at a 30 to 50% uplift on core spend
- It estimates premium support at about 15% of annual contract value
- It reports renewal escalators of 3 to 7% a year and discounts of 20 to 35% on first quotes
- These are the author’s estimates and Vendr-based data, not Darktrace commitments
Who Is Darktrace Best For?
Small Businesses
1-25 EmployeesGenerally not a fit. Darktrace has no published price or self-serve plan, and third-party estimates start in the tens of thousands of dollars a year. Small teams should compare tools with published prices.
Mid-Market Companies
26-100 EmployeesA possible fit for companies with a small security team, sensitive data and a budget for a premium tool. Reviewers mention tuning effort and false positives.
Enterprise Companies
100+ EmployeesThe core audience. Multi-domain coverage, cross-domain incidents, OT support, ISO certificates and a follow-the-sun SOC suit larger security programs that want one behavioral view of network, email, cloud and identity.
Regulated And Critical Infrastructure Teams
Any SizeDarktrace publishes stories from financial services, manufacturing, energy, construction and legal customers, including a US public interest law firm.
Measurable Impact & Benefits
91%
Of Incidents Investigated Autonomously At Osmoflo
Vendor-reported result for the water treatment and desalination company, with no baseline stated
264
Analyst Hours Saved In One Month At Osmoflo
Time saving reported in the same Osmoflo story
1,104
Hours Of Manual Investigation Saved At Aviso
Estimated savings from the Canadian wealth services firm’s story, which also cites 23 million alerts investigated
8 To 10
Working Hours Saved Weekly At A UK Civil Engineering Firm
Time recovered after adopting Darktrace / EMAIL, with about £220,000 a year in avoided analyst salary reported
Leader
2026 Gartner Magic Quadrant For NDR
Recognition stated on Darktrace’s site, for the second consecutive year
Leader
2025 Gartner Magic Quadrant For Email Security
Vendor-reported placement, alongside a 2026 Gartner Peer Insights Customers’ Choice for email security
Nearly 10,000
Customers In 110 Countries
Vendor-reported scale from Darktrace’s company pages
$55,200
Median Annual Deal
Third-party Vendr figure cited by UnderDefense, not a Darktrace price
Darktrace Real reviews
Our Rating:
4.4
- Verified Users
- Verified Users
Compare Alternatives
See how Darktrace stacks up against competitors
Get Your Free Checklist
Enter your email to download instantly
No spam. Instant access. Unsubscribe anytime.
Download
Spam
Forever
Darktrace’s Pros & Cons
Balanced evaluation to help you make an informed decision
Strengths
- Self-learning behavioral models built from each customer’s own environment
- Network, email, cloud, identity, endpoint and OT in one platform
- Cyber AI Analyst that investigates and correlates alerts across domains
- Autonomous response through native actions or firewall, EDR, SOAR and ITSM tools
- Exposure management, attack path modeling and incident readiness beyond detection
- 24/7 MDR and expert services, plus a Secure AI product for AI agents
- ISO 27001, ISO 27018, ISO 42001, IRAP and Cyber Essentials listed on its Trust Center
Limitations
- No published pricing, and third-party sources describe a premium cost
- Reviewers report false positives, tuning effort and noisy notifications
- Headquartered in Cambridge, UK, with a smaller US office footprint
- Trust Center does not list SOC 2 or FedRAMP, and does not state clearly whether customer data trains models
- Deployment mode for email and protocol coverage for OT were not confirmed on its pages
- Leadership change in 2026 and private-equity ownership since 2024
Our Verdict
Darktrace earns its place in BizGlocal’s Best in Features list for AI security and threat detection because few vendors cover network, email, cloud, identity, endpoint and OT in one platform, and fewer add AI-driven investigation, exposure management, incident recovery, managed services and AI governance. It reports Leader placements in Gartner’s 2026 NDR and 2025 Email Security Platforms Magic Quadrants, and holds ISO 27001, ISO 27018 and ISO 42001 certificates. The trade-offs are cost, tuning and proof. Darktrace publishes no pricing, third-party estimates run well into six figures for larger deployments, and reviewers report false positives that make teams cautious about autonomous response. Its case-study figures are vendor-reported, and the Trust Center lists no SOC 2 report. Buyers should request a quote, pilot on their own traffic, confirm US support and data residency, and compare CrowdStrike and SentinelOne before committing.
Resources
Resources & Documentation
Detailed materials for deeper evaluation
Product Overview
Darktrace / HYBRID NETWORK, EMAIL, CLOUD, ENDPOINT, IDENTITY and OT
Services
MDR, Managed Threat Detection, Security Operations Support and Proactive Health Optimization
Trust Center
Certifications, subprocessors, data handling, DPIAs and AI policy
Customer Stories
Osmoflo, Aviso, ESL Federal Credit Union, Banco Galicia and other published stories
Resource Library
White papers, data sheets, third-party reports, videos and glossary
Annual Threat Report 2026
Threat trends with an Americas regional outlook
State Of AI Cybersecurity 2026
Survey of 1,500 cybersecurity professionals on AI risk and priorities
Inside The SOC
Technical deep dives of real incidents and threat trends
What to Know
What to Know Before Buying
-
Map the networks, mailboxes, clouds and identities you want covered before the demo -
Ask how long the learning period lasts and when autonomous response should be switched on
-
Plan time for tuning, since G2 lists a two-month average implementation
-
Plan for sensors or virtual probes on network traffic, mailbox and cloud connections, and links to firewalls, EDR, SOAR, SIEM and ITSM tools for response and ticketing.
-
Darktrace says it serves nearly 10,000 customers of all sizes, but third-party sources tie cost to devices, mailboxes, bandwidth and assets, and one reviewer says extra locations can require extra appliances.
-
Pricing is quote-only, so ask about per-device and per-mailbox bands, Respond and MDR uplifts, premium support, professional services, renewal escalators and SIEM ingestion costs.
-
Moving from another NDR or email tool means rerouting traffic and mail flow, rebuilding playbooks, and allowing a learning period.
-
Darktrace’s site gives no contract terms, so request the order form, term and renewal uplifts, data retention and deletion terms, DPA and security reports in writing.
Alternatives
Compare Alternatives
See how Darktrace stacks up against competitors
CrowdStrike publishes Falcon Go, Pro and Enterprise prices of $59.99, $99.99 and $184.99 per device per year, with a 15-day free trial and Express Support included, while Falcon Complete is quote-based and Darktrace sells all modules by quote.
SentinelOne publishes Singularity Complete at $179.99 and Commercial at $229.99 per endpoint per year for 5 to 100 workstations, with Enterprise by quote, while Darktrace publishes no prices and centers on behavioral detection across network, email and OT.
Get Started
Ready to Get Started?
Get personalized recommendations from top 3 vendors
By submitting, you agree to receive recommendations from verified vendors. No spam, unsubscribe anytime.
Are You a Software Vendor?
List your company and get in front of decision-makers actively searching for solutions.
FAQ’s
Frequently Asked Questions
Common questions about Darktrace
Darktrace publishes no prices and sells by quote. UnderDefense, citing Vendr data, reports a median deal of about $55,200 a year and larger deployments from $150,000 to $500,000 a year. These are third-party estimates, not Darktrace quotes.
Darktrace has no published small business plan, and its pricing suits teams with budget for a premium tool. It says it serves organizations of all sizes, so small teams can ask sales about minimums and compare lighter endpoint tools first.
Its Trust Center lists ISO 27001:2022, ISO 27018, ISO 42001, IRAP and Cyber Essentials, with annual third-party audits and penetration tests. It does not list SOC 2 or FedRAMP, and it does not state clearly whether customer data trains AI models, so ask in writing.
Darktrace is headquartered in Cambridge, UK. Its company page lists a US office in New York and Wikipedia lists San Francisco, and it operates a US federal arm. Confirm US support hours and data residency with sales.
It investigates alerts like a human analyst, connecting related events across network, cloud, identity and email into incidents, so security teams review fewer separate alerts.
Yes. Darktrace lists MDR, Managed Threat Detection and Security Operations Support run from a global follow-the-sun SOC. Third-party estimates put MDR at a 30 to 50% uplift on core spend.
Reviewers on G2, Gartner Peer Insights and TrustRadius report false positives and tuning effort, and one says this makes administrators reluctant to use automated response. Others, including a New Jersey State Bar Association customer quoted by Darktrace, say it reduced noise.
Common alternatives include CrowdStrike, SentinelOne, Vectra AI, Microsoft and Proofpoint, which differ in pricing transparency, detection approach, endpoint depth and company size fit.