Item: Darktrace
Rating: 10
Author: Verified User

Overall Satisfaction with Darktrace

Use Cases and Deployment Scope

Darktrace is used across almost all of my organisation. It allows constant monitoring across all of our networks, and because it has the ability to learn "normal" behaviour for your network, it triggers alerts when it sees behaviour outside of this range. It's allowed thorough monitoring of our systems, 24/7. You can download packet captures, which can then be loaded in to wireshark, of traffic from devices on the network, and the data for these captures are held for some time as well - the exact time varies depending on the amount of traffic, but I've normally been able to retrieve traffic data from a few weeks previously when needed. There is also a mobile app that you can configure to allow monitoring of alerts on your phone. On a few occasions in the past, when something alerted that was potentially damaging to the network (such as a malware outbreak at one site), a Darktrace employee contacted me directly to let me know that there was something potentially high priority going on.

Pros and Cons

Pros

Monitors your network for unusual behaviour; as it learns what is normal for your network, you don't need to worry too much about things that are normal for your organisation, but might be considered odd in other places, triggering as alarms. It can also detect more subtle changes such as a device accessing a server but at an unusual time.
There are a large number of models that are used to create the alerts, which can all be customised, and you can also create your own from scratch, to allow you to tailor it perfectly to your situation.

Cons

There are few areas that I would say need to be improved; their customer support portal allows you to log tickets with any suggestions or things you feel the product is missing, and they will generally show you how to achieve what you want, or in some cases, introduce it as a feature in a later update.

Return on Investment

Productivity; Darktrace has allowed us to see a large number of occasions where the company network was being mis-used, particularly out of hours. This has allowed team managers to identify issues within their teams, where people have been say streaming movies instead of working. We've also been able to block more sites and services than we might otherwise have been aware of, that people were using to bypass our restrictions.
Network security; we have had a few occasions where a user has had a scam email for example and opened the attachment, which has then attempted to traverse the network. Darktrace has detected this almost instantly on each occasion, and allowed us to stop the infection before it has had a chance to do any damage.

Support Rating

Any time I have had any issue with Darktrace, I've been able to contact an engineer through their support desk, and I have always had a very speedy response. Even when the issue has been caused by something outside of the Darktrace devices, they have still been very keen to try to help and identify what the problem was. The customer portal also has a large number of videos and guides that you can use to educate yourself on the product.

Key Insights

Do you think Darktrace delivers good value for the price?

Yes

Are you happy with Darktrace's feature set?

Yes

Did Darktrace live up to sales and marketing promises?

Yes

Did implementation of Darktrace go as expected?

Yes

Would you buy Darktrace again?

Yes

Other Software Used

ManageEngine ServiceDesk Plus

Likelihood to Recommend

Darktrace would be well suited to any environment really; the only constraint would be the budget. The cost scales on the number of devices to be monitored by the product, so it can be quite expensive in larger environments. Any company that would benefit from having 24/7 monitoring of their network would find that this product would suit that need perfectly. It can also create a number of reports, which is useful if you have any requirement to present periodic figures and statistics for your network. There are also additional features available and in development such as Antigena, which can be configured to allow potential threats to be automatically mitigated; it can block connections to a certain address, using certain ports, or it can enforce "normal behaviour" where it will only allow a machine to communicate in a way that Darktrace has observed before and considers normal. This has huge benefits particularly for 24/7 organisations where you don't have the ability to have someone monitoring the network personally at all times, as it could stop a malware outbreak in its tracks.

Comments

Please log in to join the conversation

The best security guard your network could have