TrustRadius Insights
The Threat Visualizer has proven to be an invaluable tool for security operation centers, allowing them to focus on critical issues amidst …
Overview
What is Darktrace?
Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for…
Recent Reviews
Reviewer Pros & Cons
Senior Security Specialist
Consolidated Bank Ghana Limited (Banking, 5001-10,000 employees)
Pricing
N/A
Unavailable
What is Darktrace?
Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization.…
Entry-level set up fee?
- No setup fee
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Would you like us to let the vendor know that you want pricing?
168 people also want pricing
Alternatives Pricing
What is ManageEngine OpManager?
ManageEngine's OpManager is network performance monitoring software.
Product Demos
Darktrace - Zero Trust Lab Demo
YouTube
DEMO DARKTRACE Darktrace Cyber AI Platform
YouTube
DEMO DARKTRACE Darktrace Cyber AI Platform
YouTube
Darktrace CSRF exploit (CVE-2019-9596 and CVE-2019-9597)
YouTube
Grove Cybersecurity - Darktrace testimonials
YouTube
Darktrace Respond Network Overview/Darktrace Antigena Demo
YouTube
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Darktrace?
Darktrace Cyber AI Loop helps users reduce risk and harden security. The Darktrace Cyber AI Loop is built on continuous feedback and an interconnected understanding of the enterprise. Darktrace monitors and protects people and digital assets across the IT ecosystem. Self-Learning AI learns normal patterns of life to identify the malicious behaviors that don't belong.
Darktrace Features
- Supported: Virtual deployment
- Supported: Integrations: Darktrace is designed with an open architecture to complement an existing infrastructure.
- Supported: Self-learning to understand the human, not just the email address
Darktrace Video
Darktrace 6: Loop Ready
Darktrace Competitors
Darktrace Technical Details
| Operating Systems | Unspecified |
|---|---|
| Mobile Application | No |
Frequently Asked Questions
Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization. This allows it to tackle complex cyber-attacks as they happen and prevent future cyber-attacks from happening.
Vectra Threat Detection & Response Platform, ExtraHop Reveal(x), and Sangfor NGAF are common alternatives for Darktrace.
The most common users of Darktrace are from Mid-sized Companies (51-1,000 employees).
Comparisons
Compare with
Reviews and Ratings
(58)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Business Problems Solved
- Pros
- Cons
The Threat Visualizer has proven to be an invaluable tool for security operation centers, allowing them to focus on critical issues amidst the complex threat landscape. Users have praised its AI models for effectively detecting abnormal threats and potential security breaches. With its visual representation of network activity and connections, the Threat Visualizer enables users to observe the flow of the network, providing crucial insights into potential vulnerabilities. Darktrace Antigena email, a component of Darktrace's suite of security solutions, has been commended for its real-time threat analysis and blocking capabilities. This feature enhances email security by identifying and mitigating potential threats before they can cause harm. Darktrace's role as an intelligence gatherer for network traffic has been highly appreciated by customers, who value its ability to identify anomalies and potential threats. Organizations have also benefited from Darktrace's capability to track suspicious activity and unauthorized access, enabling them to take prompt action and mitigate any potential risks. The integration of Darktrace with other security and monitoring tools such as Splunk and Solarwinds has further enhanced its effectiveness in comprehensive threat detection and response. With its scalability and robust monitoring capabilities, Darktrace has become a popular choice in the market. By constantly monitoring networks and triggering alerts for abnormal behavior, it provides organizations with thorough system monitoring that is essential in today's digital landscape. With packet captures for analysis and a mobile app for monitoring alerts on the go, Darktrace offers convenience and flexibility to its users. Additionally, Darktrace's provision of a weekly summary of network security issues delivers valuable insights that help organizations stay ahead of potential threats. Customers appreciate how Darktrace's AI and ML capabilities continuously monitor network traffic and user behavior, enhancing overall network visibility. The product integrates seamlessly with Microsoft 365 for email security, successfully identifying phishing emails and blocking malicious attachments and links. One key advantage that users have noted about Darktrace is its ease of installation. It provides organizations with deep insights into network activity, including obsolete protocols and Data Loss Prevention breaches. In addition to meeting security assessment requirements, Darktrace helps organizations proactively identify potential threats in their environment. Overall, the Threat Visualizer and Darktrace's suite of security solutions have been highly regarded for their ability to provide comprehensive threat detection and response, enhancing overall network security.
Comprehensive AI-based NDR solution: Users have found Darktrace to be a comprehensive AI-based network detection and response solution. Several reviewers appreciate its ability to detect anomalies in user behavior as well as network infrastructure like routers, servers, and endpoints.
Effective prevention of malicious traffic: Many users highly appreciate Darktrace's autonomous AI model detection and response capabilities. They applaud its effectiveness in preventing, containing, and quarantining malicious traffic in the corporate network.
Valuable security features: Darktrace's ability to block malicious attachments and phishing emails is regarded as a valuable feature by users. They find it reassuring that Darktrace provides excellent security to corporate email systems, enhancing overall cybersecurity measures.
Confusing User Interface: Some users have found the user interface to be confusing, suggesting a need for improvement in the IU language. Excessive Blocking: Several users experienced excessive blocking, making the software overly restrictive. Difficulty Removing Emails: Users mentioned that removing an email from the inbox took too much time. Inaccurate Device Identification: One user had a poor experience with device identification, stating that a simple nmap scan performed better. Lack of Comprehensive Network Traffic Mapping: The software was criticized for not providing a good way to create a logical map of network traffic between subnets. Limited Threat Detection and Reporting: Some users expressed concerns about inaccurate threat detection and incomplete reporting capabilities when compared to open-source tools.
Attribute Ratings
Reviews
(1-11 of 11)Companies can't remove reviews or game the system. Here's why
Score 6 out of 10
Vetted Review
Verified User
- Uses it Al model UEBA to detect anomalies in the behaviour of not only the users in a corporate network but also the routers, servers, and endpoints in that network.
- Provides a visualisation of both egress and outbound network traffics flowing in and out of the organisation.
- Darktrace comes with it autonomous AI model detection and responses capabilities.
- Darktrace as an AI next generation NDR solution, prevents ,contains and quarantines malicious traffics from and into the corporate network.
- AI detection Model
- Customisable
- Improves on the User Behaviour Behaviour analytics model
- Consistently improve model self learning.
- Block malicious attachments.
- Block phishing emails.
- Provide an awesome security to corporate email.
- Good analytics and metrics about emails.
- Change IU language.
- Sometimes excessive block (restrictive).
- Sometimes it takes too much time to remove an email from inbox
August 30, 2023
A flexible and scalable NDR
- Network monitoring
- PCAP Parsing
- Correlation rules
- Behavioural rules
- Backup management
- Asset inventory
- Advanced queries scalability
- It detects anomalies or deviations from this baseline, it can raise alerts or take automated actions to investigate and mitigate the issue.
- It's "Antigena" feature can take automated actions in response to detected threats. You can have antigena for both network and emails and the system will do the blocks at it's own
- It integrates with Microsoft365 to identify and respond to email-based threats, including phishing attempts and malicious attachments.
- Whitelisting email or IP are not straight forward
- Although the GUI is great but it's too complex
- If filters can be easier to implements
November 03, 2022
Darktrace is good to play but not good to an easy learning
- AI Incidents view.
- Action taken (Antigena).
- Executive Threat Report.
- Incidents Patterns.
- User/IP Tracking when it is coming from different Darktrace Sensors.
- Dashboard not intuitive for rookie user.
- Lack of Community forum.
November 11, 2021
Darktrace - Some Shortcomings
Score 1 out of 10
Vetted Review
Verified User
- Very Clever Marketing
- Clever use of the AI
- From time to time an email would appear in your inbox and within 5 to 10 seconds the email would be removed before your eyes. sometimes you could click on it if you were reading emails. Other times it would appear in your notifications and then when you looked for it later it was gone. It made you question your sanity. This problem has never been fixed. if you don't get onto it quick enough the system deletes these actions every month. No trace can be found.
- When the system incorrectly quarantined an email, a false positive, there is no way to train the system not to do the same thing again. You have to contact IT support and get them to whitelist the email behind the scenes.
- The BIG problem. The system is only as smart as the emails you provided for ingestion. Any email received after ingestion may be quarantined as it falls outside the pattern of behavior. Worse still. The system will let through infected emails if it can see the sender is a trusted source. Even if they have had an attack and sent emails out to their entire address book with an infected payload.
- There was no notice of emails being quarantined until recently. When you do get sent a notice now it contains a very poor level of information.
February 09, 2021
DarkTrace is great for small to medium size businesses
- Network Security
- Security Analysis
- Threat Detection
- Whole Packet Capture
- Initial configuration
- Security Analyst timely response to questions
- GUI
February 19, 2020
Good tool but a LOT of false positives
- Ease of installation and configuration - Darktrace appliance is very close to plug and play (SPAN port configuration should be easy for any network admin). Darktrace provides comprehensive onboarding for customers as well, so you do not feel lost during the configuration of the device.
- Identifying and tracking of the devices on the network - Hostname, OS, IP, MAC, previous activity - everything can be seen in the same interface. It is so much easier than tracking device in question across the firewall, DHCP, DNS logs.
- False positives. Darktrace uses "AI" to create its alerts for "unusual" or "malicious" activity. It is very common to see an alert for completely benign and normal device behavior - PC tries to print for the first time in a while, for example.
- Antigena actions. To some extent, this is a continuation of the previous point. Darktrace can break the network connectivity of the suspected device automatically. The excessive number of false positives makes administrators reluctant to use this feature, though. Also, the default Antigena actions are not relevant to real-world problems as I saw them in my experience with Darktrace.
January 29, 2020
The best security guard your network could have
- Monitors your network for unusual behaviour; as it learns what is normal for your network, you don't need to worry too much about things that are normal for your organisation, but might be considered odd in other places, triggering as alarms. It can also detect more subtle changes such as a device accessing a server but at an unusual time.
- There are a large number of models that are used to create the alerts, which can all be customised, and you can also create your own from scratch, to allow you to tailor it perfectly to your situation.
- There are few areas that I would say need to be improved; their customer support portal allows you to log tickets with any suggestions or things you feel the product is missing, and they will generally show you how to achieve what you want, or in some cases, introduce it as a feature in a later update.
September 17, 2018
Darktrace offers an excellent AI engine can answer that question "Do I have malicious traffic in my network?"
- Its very strong in recognizing unusual traffic. It learns what is normal and what is not normal.
- It helps to show if our users are hitting malicious websites or not. That is a nice bonus to help with our security awareness and know if our training is doing its job.
- Their weekly reports to us help highlight the most egregious traffic on our network. They are an extra set of eyes for us.
- You have to have an appliance on each segment of your network. If you are not back hauling your traffic to your central data center, then each location has to have an appliance in order to cover that location.
- They gather so much detailed information that it is hard at time to decipher what I'm looking at.
- The way they name actions is unusual and should be changed. They need to label the parts of network traffic better.
January 12, 2018
Why I didn't pick Darktrace
- It did an ok job of analyzing and collecting data. It used a span (mirrored) port and then using its own algorithm developed flow records.
- It did an ok job of segmenting traffic into networks - not always correctly, but ok.
- It tried to identify devices by type - once again, it did ok, but not that great.
- Really had a poor time of identifying devices and what the device's purpose was - a simple nmap scan did a better job. The problem is they expect you to fine-tune the results - which is exactly what you would expect - but day one it found over 2,000 servers (and I only have 112).
- Really had a hard time separating network traffic into locations - I use distinct subnets for my buildings, but there was no good way to create a logical map of my traffic internally. Did not garner a sense of trust that it was seeing everything.
- Sat through a few "analyst" reports - which showed me possible threats in my environment. I am already using a few open source tools, and they actually found more than the analyst reports. Also, there was no way to get the reports on your own - you had to work through their analysts to get the information.