Skip to main content
TrustRadius
Darktrace

Darktrace

Overview

What is Darktrace?

Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for…

Read more

Learn from top reviewers

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing
N/A
Unavailable

What is Darktrace?

Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization.…

Entry-level set up fee?

  • No setup fee

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

190 people also want pricing

Alternatives Pricing

What is OpenNMS Meridian?

OpenNMS Meridian is a scalable open source network management platform with network traffic analysis, network discovery, alerting, and monitoring. It's presented as a solution to monitor enterprise network performance and ensure the availability and performance of critical network services.

Return to navigation

Product Demos

Darktrace - Zero Trust Lab Demo

YouTube

DEMO DARKTRACE Darktrace Cyber AI Platform

YouTube

DEMO DARKTRACE Darktrace Cyber AI Platform

YouTube

Darktrace CSRF exploit (CVE-2019-9596 and CVE-2019-9597)

YouTube

Grove Cybersecurity - Darktrace testimonials

YouTube

Darktrace Respond Network Overview/Darktrace Antigena Demo

YouTube
Return to navigation

Product Details

What is Darktrace?

Darktrace Cyber AI Loop helps users reduce risk and harden security. The Darktrace Cyber AI Loop is built on continuous feedback and an interconnected understanding of the enterprise. Darktrace monitors and protects people and digital assets across the IT ecosystem. Self-Learning AI learns normal patterns of life to identify the malicious behaviors that don't belong.

Darktrace Features

  • Supported: Virtual deployment
  • Supported: Integrations: Darktrace is designed with an open architecture to complement an existing infrastructure.
  • Supported: Self-learning to understand the human, not just the email address

Darktrace Video

Darktrace 6: Loop Ready

Darktrace Technical Details

Operating SystemsUnspecified
Mobile ApplicationNo

Frequently Asked Questions

Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization. This allows it to tackle complex cyber-attacks as they happen and prevent future cyber-attacks from happening.

The most common users of Darktrace are from Mid-sized Companies (51-1,000 employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(68)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

The Threat Visualizer has proven to be an invaluable tool for security operation centers, allowing them to focus on critical issues amidst the complex threat landscape. Users have praised its AI models for effectively detecting abnormal threats and potential security breaches. With its visual representation of network activity and connections, the Threat Visualizer enables users to observe the flow of the network, providing crucial insights into potential vulnerabilities. Darktrace Antigena email, a component of Darktrace's suite of security solutions, has been commended for its real-time threat analysis and blocking capabilities. This feature enhances email security by identifying and mitigating potential threats before they can cause harm. Darktrace's role as an intelligence gatherer for network traffic has been highly appreciated by customers, who value its ability to identify anomalies and potential threats. Organizations have also benefited from Darktrace's capability to track suspicious activity and unauthorized access, enabling them to take prompt action and mitigate any potential risks. The integration of Darktrace with other security and monitoring tools such as Splunk and Solarwinds has further enhanced its effectiveness in comprehensive threat detection and response. With its scalability and robust monitoring capabilities, Darktrace has become a popular choice in the market. By constantly monitoring networks and triggering alerts for abnormal behavior, it provides organizations with thorough system monitoring that is essential in today's digital landscape. With packet captures for analysis and a mobile app for monitoring alerts on the go, Darktrace offers convenience and flexibility to its users. Additionally, Darktrace's provision of a weekly summary of network security issues delivers valuable insights that help organizations stay ahead of potential threats. Customers appreciate how Darktrace's AI and ML capabilities continuously monitor network traffic and user behavior, enhancing overall network visibility. The product integrates seamlessly with Microsoft 365 for email security, successfully identifying phishing emails and blocking malicious attachments and links. One key advantage that users have noted about Darktrace is its ease of installation. It provides organizations with deep insights into network activity, including obsolete protocols and Data Loss Prevention breaches. In addition to meeting security assessment requirements, Darktrace helps organizations proactively identify potential threats in their environment. Overall, the Threat Visualizer and Darktrace's suite of security solutions have been highly regarded for their ability to provide comprehensive threat detection and response, enhancing overall network security.

Comprehensive AI-based NDR solution: Users have found Darktrace to be a comprehensive AI-based network detection and response solution. Several reviewers appreciate its ability to detect anomalies in user behavior as well as network infrastructure like routers, servers, and endpoints.

Effective prevention of malicious traffic: Many users highly appreciate Darktrace's autonomous AI model detection and response capabilities. They applaud its effectiveness in preventing, containing, and quarantining malicious traffic in the corporate network.

Valuable security features: Darktrace's ability to block malicious attachments and phishing emails is regarded as a valuable feature by users. They find it reassuring that Darktrace provides excellent security to corporate email systems, enhancing overall cybersecurity measures.

Confusing User Interface: Some users have found the user interface to be confusing, suggesting a need for improvement in the IU language. Excessive Blocking: Several users experienced excessive blocking, making the software overly restrictive. Difficulty Removing Emails: Users mentioned that removing an email from the inbox took too much time. Inaccurate Device Identification: One user had a poor experience with device identification, stating that a simple nmap scan performed better. Lack of Comprehensive Network Traffic Mapping: The software was criticized for not providing a good way to create a logical map of network traffic between subnets. Limited Threat Detection and Reporting: Some users expressed concerns about inaccurate threat detection and incomplete reporting capabilities when compared to open-source tools.

Reviews

(1-9 of 9)
Companies can't remove reviews or game the system. Here's why

If you want to unleash the Power of AI for Threat Detection, go for Darktrace

Rating: 9 out of 10
May 01, 2024
Verified User
Vetted Review
Verified User
Darktrace
4 years of experience
We have been using Darktrace for Threat Detection, Network Visibility, Antigena features/PREVENT for automated responses and to be in compliance. It's AI and ML capabilities to continuously monitor network traffic and user behavior are exceptional. It gives an in-depth visibility to our network. We have integrated it with Microsoft365 for Emails which helps detect phishing emails, malicious attachment blocking, spam filtering and malicious link blocking.
  • It detects anomalies or deviations from this baseline, it can raise alerts or take automated actions to investigate and mitigate the issue.
  • It's "Antigena" feature can take automated actions in response to detected threats. You can have antigena for both network and emails and the system will do the blocks at it's own
  • It integrates with Microsoft365 to identify and respond to email-based threats, including phishing attempts and malicious attachments.
It's best suited for network anamoly detection and prompt action via antigena for network It's also best suited for Email security and malicious email detections Since, the detections are AI based you may get some false positives from time to time Right after implementation it's difficult to handle due to it's learning behavior Requires some time to learn It not the best for Intrusion prevention scenarios but does a great job for threat detections

Darktrace threat visualizer, leading NDR solution with peace of mind.

Rating: 6 out of 10
November 17, 2023
RO
Vetted Review
Verified User
Darktrace
2 years of experience
The Darktrace's Threat Visualizer leverage an enterprise immune system technology to detect and respond to network activity in a way that is intended for use by security operation centres, threat analysts, and network security experts. Business problems Darktrace helps us address; -
  • The Threat Visualizer employs the underlying AI models to dynamically detect threats that are actually abnormal in the increasingly complex threat landscape, enabling us at the SOC to concentrate attention and expertise where it is needed.

  • The Threat Visualizer gives us a visual representation of all network activity and connections—both internal and external—between all machines and users, allowing us to observe how the network is flowing.
  • It functions on a broad scale, highlighting various hazards and anomalies for the analyst's attention, and on a more specific one, enabling you to drill down.
  • Uses it Al model UEBA to detect anomalies in the behaviour of not only the users in a corporate network but also the routers, servers, and endpoints in that network.
  • Provides a visualisation of both egress and outbound network traffics flowing in and out of the organisation.
  • Darktrace comes with it autonomous AI model detection and responses capabilities.
  • Darktrace as an AI next generation NDR solution, prevents ,contains and quarantines malicious traffics from and into the corporate network.
In network-related attack detection and response, Darktrace threat visualizer is your best solution. Self-containment and quarantine of suspicious network activities with highly detection rate.

Darktrace Antigena email a good solution to protect corporate email.

Rating: 10 out of 10
October 06, 2023
AR
Vetted Review
Verified User
Darktrace
1 year of experience
We use Darktrace Antigena email to protect our employees from any threat that can arrive by email. Our email provides, does an initial filtering, but not enough to provide a good security solution. Antigena email provides machine speed to analyze and block if necessary, using AI.
  • Block malicious attachments.
  • Block phishing emails.
  • Provide an awesome security to corporate email.
  • Good analytics and metrics about emails.

A flexible and scalable NDR

Rating: 9 out of 10
August 30, 2023
Verified User
Vetted Review
Verified User
Darktrace
2 years of experience
Darktrace is one of the best solutions when it comes to monitor your network with an NDR. Extremely scalable and with a fantastic way of correlating network communications, this is one of the best solutions in the market. We use it not only to monitor our customer's infrastructures, but we also integrate it with several modules, giving the SoC Analysts great room for moving and responding.
  • Network monitoring
  • PCAP Parsing
  • Correlation rules
  • Behavioural rules
Darktrace is a product well suited for the vast majority of infrastructures and helps monitoring and responding to threats based on the network in a very elastic way. This is a product based on on-premise infrastructures that hosts its machines locally, of course it can be technically difficult to monitor an entire On-Cloud infrastructure but even there there's room for sensors and monitoring, not to mention the SaaS and mail integration that completes the product.

Darktrace is good to play but not good to an easy learning

Rating: 9 out of 10
November 03, 2022
FS
Vetted Review
Verified User
Darktrace
1 year of experience
We are using Darktrace to identify possible issues caused by forbidden access and track suspicious activity. As this application is getting the traffic from the source, we're able to identify security issues that before we weren't able to. Also, we are integrating Darktrace with other Security/Monitoring tools like Splunk & Solarwinds.
  • AI Incidents view.
  • Action taken (Antigena).
  • Executive Threat Report.
  • Incidents Patterns.
Very easy to send mirroring traffic, very intuitive layout to configure the sensors, alerts & notifications. Require good experience in the platform in order to find & troubleshoot logs/incidents. There is not much documentation available on the Free Forum/Google searches. Good pre-sales support for the United Kingdom & Ireland clients, many kudos!

DarkTrace is great for small to medium size businesses

Rating: 10 out of 10
February 09, 2021
Verified User
Vetted Review
Verified User
Darktrace
2 years of experience
We needed a better insight into network security threats that might be in our organization. DarkTrace provides an invaluable service of not only giving us the ability to dig deep into possible network intrusions but also has a weekly summary of possible network security issues. One of the main reasons we chose DarkTrace was that they provided the weekly report put together by a security professional. We review this weekly report and take action as needed.
  • Network Security
  • Security Analysis
  • Threat Detection
  • Whole Packet Capture
Recommend: for a company with limited security resources that needs a better look into possible network intrusions. Not suited for: a company that has a full SOC staff that has time and resources to dedicate to network security threats.

Good tool but a LOT of false positives

Rating: 7 out of 10
February 19, 2020
Verified User
Vetted Review
Verified User
Darktrace
2 years of experience
I worked with Darktrace in a couple of organizations (from 300 to 1000+ users). Darktrace is a beneficial product to keep track of lateral network traffic inside of the organization. It augments the firewall, which looks at the traffic moving in and out of the company's LAN. Darktrace utilizes SPAN ports on switches to get the traffic, that's the only configuration needed outside of the Darktrace appliance, making installation relatively easy. If organization has multiple locations, either multiple Darktrace units will be required, or the network must be configured to forward SPAN traffic. Darktrace does provide beneficial insights into network activity inside the network, such as the use of obsolete protocols, DLP breaches, etc.
  • Ease of installation and configuration - Darktrace appliance is very close to plug and play (SPAN port configuration should be easy for any network admin). Darktrace provides comprehensive onboarding for customers as well, so you do not feel lost during the configuration of the device.
  • Identifying and tracking of the devices on the network - Hostname, OS, IP, MAC, previous activity - everything can be seen in the same interface. It is so much easier than tracking device in question across the firewall, DHCP, DNS logs.
If organization has money to spend on Darktrace (licensing is based on the number of endpoints in the network) and has staff to sift through all the alerts the device creates, Darktrace does improve security significantly. You will see what is going on inside the network, in real-time, and in easy to understand manner. The problem is that there are a lot of things going on inside of any corporate network. The AI of the Darktrace appliance has a hard time reducing the number of events to look at to a reasonable level. Whoever is thinking about buying Darktrace must be ready to spend a lot of man-hours working with the product, clearing false positives and tweaking rules.

The best security guard your network could have

Rating: 10 out of 10
January 29, 2020
Verified User
Vetted Review
Verified User
Darktrace
5 years of experience
Darktrace is used across almost all of my organisation. It allows constant monitoring across all of our networks, and because it has the ability to learn "normal" behaviour for your network, it triggers alerts when it sees behaviour outside of this range. It's allowed thorough monitoring of our systems, 24/7. You can download packet captures, which can then be loaded in to wireshark, of traffic from devices on the network, and the data for these captures are held for some time as well - the exact time varies depending on the amount of traffic, but I've normally been able to retrieve traffic data from a few weeks previously when needed. There is also a mobile app that you can configure to allow monitoring of alerts on your phone. On a few occasions in the past, when something alerted that was potentially damaging to the network (such as a malware outbreak at one site), a Darktrace employee contacted me directly to let me know that there was something potentially high priority going on.
  • Monitors your network for unusual behaviour; as it learns what is normal for your network, you don't need to worry too much about things that are normal for your organisation, but might be considered odd in other places, triggering as alarms. It can also detect more subtle changes such as a device accessing a server but at an unusual time.
  • There are a large number of models that are used to create the alerts, which can all be customised, and you can also create your own from scratch, to allow you to tailor it perfectly to your situation.
Darktrace would be well suited to any environment really; the only constraint would be the budget. The cost scales on the number of devices to be monitored by the product, so it can be quite expensive in larger environments. Any company that would benefit from having 24/7 monitoring of their network would find that this product would suit that need perfectly. It can also create a number of reports, which is useful if you have any requirement to present periodic figures and statistics for your network. There are also additional features available and in development such as Antigena, which can be configured to allow potential threats to be automatically mitigated; it can block connections to a certain address, using certain ports, or it can enforce "normal behaviour" where it will only allow a machine to communicate in a way that Darktrace has observed before and considers normal. This has huge benefits particularly for 24/7 organisations where you don't have the ability to have someone monitoring the network personally at all times, as it could stop a malware outbreak in its tracks.

Darktrace offers an excellent AI engine can answer that question "Do I have malicious traffic in my network?"

Rating: 7 out of 10
September 17, 2018
Verified User
Vetted Review
Verified User
Darktrace
1 year of experience
We use Darktrace in our main office. It helps us meet security assessment requirements of our clients that want to know how we know if there are bad actors in our environment.
  • Its very strong in recognizing unusual traffic. It learns what is normal and what is not normal.
  • It helps to show if our users are hitting malicious websites or not. That is a nice bonus to help with our security awareness and know if our training is doing its job.
  • Their weekly reports to us help highlight the most egregious traffic on our network. They are an extra set of eyes for us.
It's excellent at using its AI engine to learn your environment when it first gets set up. Then over time it know what it has seen in the past and what it hasn't, so you can investigate what could be malicious traffic or not. It shouldn't be considered the end all, be all for networking monitoring, but just another tool to use.
Return to navigation