Company breakdown · Aug 2026
A Cambridge-born security company whose self-learning AI watches network, email, cloud, and OT environments, and whose autonomous products investigate incidents and contain threats on their own.
Darktrace sells a security platform built around one idea: learn what normal looks like for every device and user in an environment, and then flag and act on the things that break the pattern. The company calls the approach Self-Learning AI, and it applies the same engine across network traffic, email, cloud accounts, identity systems, and operational technology, which is the equipment side of factories and utilities. Customers buy it to catch the activity that firewalls and endpoint tools miss, such as an attacker moving between servers, a quiet connection to an outside control server, or data leaving the network in small pieces.
The company was founded in Cambridge in 2013, listed on the London Stock Exchange in 2021, and reported about $700 million in revenue in its last year as a public company. Thoma Bravo, a private equity firm, took Darktrace private in 2024 in a deal valued at about $5.3 billion, and the company has continued to acquire and ship since the change of ownership.
Documented from public materials · these are the products the AMS scores
Cyber AI Analyst
Shipping since 2019
Investigates the alerts the platform raises, on its own. It gathers the related events, reconstructs what happened and how far it spread, and writes the incident report an analyst would otherwise write. The 2025 acquisition of Cado Security folded cloud forensics into this product, so the investigations now reach into cloud workloads.
Cyber AI Loop
Shipping since 2016, first as Antigena
Takes containment actions in real time, such as blocking a specific connection or holding a device to its normal pattern of behavior, without a human approving each action. It is the earliest autonomous response product in the category and remains the rarest capability among the vendors on the map.
The module structure
Detect · Respond · Email · Cloud · OT
The platform sells as modules on one engine. Detection is the core, autonomous response and email are add-on modules, and cloud and OT extend coverage into those environments. The two agentic products above ship inside these modules; neither is sold as a product with its own meter.
2024 - 2026 ·gold = a monetization move· grey = product or capital
Thoma Bravo completed its take-private of Darktraceat a value of about $5.3 billion, announced the previous April. The company left the London Stock Exchange after three years as a public company.
Darktrace acquired Cado Security, a cloud forensics company, and folded its capability into Cyber AI Analyst, which extended the autonomous investigation product into cloud workloads.
Procurement data published this year showsDarktrace listing 12 to 22% above Vectra and 8 to 18% above ExtraHopfor the same network-defense scope, with multi-module bundles closing 15 to 30% below list. The same data shows the post-acquisition pattern: smaller discounts on small deals, deeper discounts on large multi-module commitments.
Source:VendorBenchmark,Vendr
Buyer-side reporting documented the contract mechanics:auto-renewal with a 90-day notice window, annual user-count true-ups, and module prices that scale with user count. The fiscal year ends in June, and buyers report that quarter-end timing moves discount depth.
Source:VendorBenchmark
The model is a coverage subscription: a recurring fee sized to the environment being watched, sold as the modules described above. Buyers license the core detection product and add response, email, cloud, and OT as their coverage grows, and the pricing data shows the packaging doing real work in negotiations. Three-year terms run 15 to 25% below annual pricing, and deals that bundle three or more modules close 15 to 30% below list.
Both agentic products live inside this structure. Cyber AI Analyst's investigations and Cyber AI Loop's containment actions are included in the modules that carry them, and neither has a meter of its own. A customer whose agent ran a thousand investigations last quarter and a customer whose agent ran ten pay the same coverage fee if their environments are the same size.
Analyst layer · placement follows the documented capability above
Independence: Large.Both the investigation and the containment run without a human on each case, and they have for years. Cyber AI Analyst closes the investigation loop on its own, and Cyber AI Loop acts on threats without per-action approval. That is the working definition of the Large band, which our methodology sets at under 20% human involvement in the task.
Job width: Medium.The products span network, email, cloud, identity, and OT, which is wide, but the work stays inside one function: security operations. A Medium score covers exactly that shape, an end-to-end workflow within a single function.
Output versus cost: Exponential.The agent performs investigation work that otherwise consumes analyst hours, and it performs it at compute cost. Our methodology places anything above a 100-to-1 ratio of output value to compute cost in the Exponential band, and autonomous incident investigation sits comfortably inside it.
The monetization pattern.Of the three patterns we observe in this category, Darktrace uses two: it bundles agentic capability into the coverage subscription, and it packages the larger agentic steps as modules. The pricing record shows where the value capture happens instead of a new unit: the vendor with the most documented autonomy on the map also carries the highest list prices in the category, and its deepest discounts go to the buyers who commit to the most modules. The agent's work itself has no price. It is the reason to buy the modules that do.
| Edition | AMS score | Metric on record | Change |
|---|---|---|---|
| Aug 2026 | L · M · Exp | Multi-module coverage subscription | Baseline, first edition |
Future editions add a row whenever the score or the metric moves, with the evidence that moved it.
VendorBenchmark, Darktrace pricing analysis(Feb 2026) ·Vendr, Darktrace marketplace data(2026) ·Category review, network defense tools(May 2026) ·Product comparison, autonomous response(Jun 2026) ·Category review, deployment criteria(Aug 2026)
About this data
Everything on this page is a synthesis of public information: published reporting, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.