Darktrace uses behavioural AI to investigate unusual activity

Darktrace learns patterns of activity across connected systems, then applies AI investigation and configured response to suspicious changes.

01 / ProductDarktrace centres its AI approach on behaviour in the customer environment

Darktrace applies AI to security detection, investigation and response. Its platform page describes learning the behaviour and relationships of users, devices and applications in an organisation, then using that context to identify suspicious deviations. Cyber AI Analyst connects and prioritises relevant alerts, while response capabilities can act within configured boundaries. This is AI embedded in security operations, rather than a general research assistant.

The offer includes separate products for network, email, cloud, identities, endpoints and operational technology. The current site uses Behavioral Defense Platform wording while retaining ActiveAI Security Platform references. The practical buying unit remains the products and deployment in the order. Thoma Bravo completed its acquisition of Darktrace in October 2024; Darktrace continues to operate as the active product and company identity covered here.

The underlying idea is useful but easy to overstate. An unusual activity pattern can justify investigation without proving malicious intent. Likewise, ordinary-looking activity can still be harmful. Sequenced has reviewed public sources rather than testing Darktrace’s detection quality. Vendor claims about earlier discovery, reduced workload or avoided disruption should be evaluated in the environment where the system would actually operate.

02 / AudienceThe fit is an environment where context changes the meaning of an alert

A distributed business provides a concrete example. A new connection between two systems might reflect an approved rollout, an employee travelling, a service migration or an intrusion. A useful security tool needs enough context to distinguish those situations and show the analyst what changed. Darktrace is worth evaluating where that contextual investigation consumes substantial time.

Network visibility is particularly relevant where security teams cannot rely only on managed endpoint telemetry. However, a platform’s list of supported domains does not mean every device or service is visible automatically. The buyer needs a coverage map showing what the proposed deployment observes, what it infers and which systems sit outside that boundary.

For a team constructing its own searchable operational evidence, Elastic offers a comparison around indexing and analytical control. For managing the service workflow following an approved security decision, ServiceNow addresses a different part of the process. Darktrace’s evaluation should focus on additional detection and investigation value, rather than generic chatbot or ticketing features.

03 / WorkflowProposed workflow: investigate an unusual connection without disrupting a rollout

Select a network segment with a known operational owner and an upcoming approved change. Document the expected devices, service connections and maintenance window. Use the deployment agreed with the security team and vendor. The purpose of this proposed pilot is to see whether behavioural evidence helps distinguish expected change from suspicious activity; it is not a completed product test.

Darktrace’s Network product page describes analysing activity across on-premises, virtual, cloud and hybrid networks, and using Cyber AI Analyst to investigate related alerts. Start by confirming which of those data paths the pilot actually supplies. A diagram of the full estate is insufficient if only one segment is connected or a feed stops during maintenance.

During the initial observation period, have the operational owner label expected changes. Keep the timing and scope of those changes alongside the security case. This helps an analyst judge an unusual event without teaching the team to dismiss every alert that coincides with a rollout. Preserve ambiguous cases; they often reveal where the system needs more business context.

Review an investigation as a chain of evidence. Identify the first unusual observation, the related activity and the inference connecting them. Ask what alternative explanation remains plausible. If the report combines activity from several devices, verify their identities and timestamps. A coherent narrative can still join unrelated events unless those relationships are supported.

If the chosen scope includes email, the Email product page describes context-based analysis and responses ranging from tagging to quarantine. Evaluate email-specific decisions separately from network decisions. Blocking a suspicious connection and quarantining a message affect different business processes, so the same confidence threshold need not justify both actions.

Use the integration catalogue to identify supported paths into existing security and operational tools. For example, it describes AWS monitoring and actions through invoked Lambda functions. In this proposed pilot, route evidence into the existing incident process first, and verify that the destination receives the correct asset and case identifiers before allowing any state-changing integration.

Move from observation to a narrow response policy only after reviewing errors. Select a reversible action with a clear owner, demonstrate the exception path and record how service is restored. Measure useful detections, analyst review effort and business interruption separately. A reduction in visible alerts is not evidence of improvement if the system simply suppresses the cases the team needs to investigate.

04 / PricingA tailored quote follows a scoped evaluation

Darktrace’s demo page offers a free, no-obligation 30-day trial and a tailored quote. It does not publish a universal per-user or per-device tariff for the platform. The sensible commercial starting point is therefore the intended security scope, the deployment design and the conditions of the evaluation.

Before starting the trial, agree how the final proposal will be calculated. The public page does not settle the charging unit for every product, so avoid importing a reseller’s old price into a current estimate. Ask the supplier to identify counted entities, the contract period, included capacity and what happens if the deployment expands beyond the initial scope.

An evaluation also has internal costs. Network teams may need to provide traffic visibility, identity owners may need to approve access, and analysts must review outcomes. Budget that work explicitly. A trial with broad vendor assistance can produce a different operating experience from a production deployment maintained by a small internal team.

05 / DistinctionsBehavioural context offers a different investigative starting point

The meaningful distinction is an emphasis on activity in the organisation itself. That can be valuable when the question is whether a connection or communication fits the expected relationship between systems and people. The resulting evidence should help an analyst explain why the event deserves attention, rather than relying solely on a generic label attached to the alert.

Darktrace’s products also provide a route to relate signals across domains. A suspicious message, an unusual login and a new connection can be more informative together than separately. This is a hypothesis for the pilot to test. Ask whether combining the signals changes the decision correctly, not merely whether the console displays them in one place.

06 / QuestionsTest expected change, visibility gaps and response exceptions

A behaviour-based approach needs to cope with organisational change. New applications, acquisitions, temporary workers and migrations can alter what ordinary activity looks like. Ask the vendor to demonstrate how analysts inspect that transition and correct a mistaken interpretation. The question is not whether a model adapts in principle, but whether the team can understand and manage the adaptation.

Document blind spots. Encrypted traffic, unsupported integrations or incomplete identity context can constrain what any monitoring system knows. Confirm the evidence available in the proposed deployment and how missing or stale feeds are shown. A quiet dashboard needs to be distinguishable from a healthy environment that is being observed correctly.

Response policy requires separate scrutiny. An action that is appropriate for an employee workstation may be unacceptable for an operational technology device or a critical shared service. Define explicit exceptions and an escalation owner. The ability to take automated action should be evaluated against those operational boundaries rather than enabled uniformly because the product permits it.

07 / DecisionChoose Darktrace when additional behavioural evidence improves decisions

Darktrace is a credible evaluation candidate when security teams need more context about unusual activity across their estate. Its value should be demonstrated through a scoped pilot that includes ordinary business change as well as suspicious cases. The decision rests on useful evidence, manageable false interventions and a clear production scope, not on broad claims that AI can recognise every novel threat.