- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Darktrace
AI that learns what is normal for your organisation — and responds on its own to what is not, across network, email, cloud, OT, identity and AI tools— the Darktrace Behavioral Defense Platform, its Real-Time AI Analyst, and how each product is contracted and priced. This hub covers eight Darktrace products.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Eight intel pages. Network, email, cloud, OT, identity, forensics, AI security and MDR.
Darktrace’s line, product by product — every card is a full intel page, from Darktrace Hybrid Network and Darktrace Email to Darktrace Cloud, Darktrace OT, Darktrace Identity, Forensic Acquisition & Investigation, Darktrace Secure AI and Managed Detection & Response. The website now groups these into three products; the contract still licenses eight.
Darktrace Hybrid Network
Learns the network, then contains the unusual.
Probes, vSensors and osSensors read mirrored traffic; Autonomous Response resets connections or acts through your firewall.
Darktrace Email
Behavioural email defence beside your filter.
Runs over API and journaling with no MX change, across Microsoft 365, Google Workspace and Exchange; DMARC is its own SKU.
Darktrace Cloud
Behavioural detection for AWS, Azure and GCP.
Agentless enumeration through cloud APIs and logs, with optional sensors; metered on a count of cloud identities and workloads.
Darktrace OT
One view of IT and OT across the Purdue model.
Passive and active asset identification that surfaces CVEs and end-of-life status, plus OT risk management and attack paths.
Darktrace Identity
Spots account takeover and acts in the session.
Baselines logins, admin activity and access requests, then ends sessions, forces re-authentication or briefly restricts access.
Forensic Acquisition & Investigation
Captures and analyses evidence in the cloud.
Full-volume or triage capture of cloud compute, containers, serverless and storage, run in your own cloud account or as SaaS.
Darktrace Secure AI
Watches AI tools, prompts and agents at work.
Finds shadow AI, analyses prompts in ChatGPT Enterprise, Copilot, Claude and Bedrock, and tracks the actions AI agents take.
Darktrace Managed Detection & Response
Darktrace analysts on your Darktrace alerts.
A follow-the-sun SOC investigates platform alerts and can extend Autonomous Response; follow-up and remediation stay with you.
Darktrace Endpoint
Platform & engineThe osSensor agent plus NEXT (Network Endpoint eXtended Telemetry), which add process-level root cause to network detections. Darktrace positions it as a complement to Microsoft Defender for Endpoint, not an EDR, and it has no product specification of its own, so it is covered on the HYBRID NETWORK page
Proactive Exposure Management and Attack Surface Management
Platform & engineBoth are still referenced “where licensed” in the September 2026 contract specification, but their product pages now return 404. The capability lives on as attack path modelling inside HYBRID NETWORK, and a limited version ships with Darktrace Cloud, so TechBag does not page either on its own
Incident Readiness & Recovery
Platform & engineThe recovery line once sold as HEAL. Its product page returns 404 and the current contract specification carries no product for it, so TechBag treats it as withdrawn rather than as something you can buy today
Mira encrypted-traffic visibility
Platform & engineTechnology from Mira Security, acquired in July 2025, for in-line decryption and next-generation hardware with 100 Gbps interfaces. Mira is not a product name in the price list; it is explained on the HYBRID NETWORK page
Darktrace sells 3 of the products TechBag carries in Security. The Security guide shows how the category splits and which part is yours. →
Also sold in Identity & Access (1 product) · Network Security & SASE (1 product).
Why “learn normal, then act” is the whole story
Most security tools look for what an attack is known to look like. Darktrace modelswhat normal looks like for your own users, devices and traffic, then contains what departs from it — by resetting a connection or acting through your firewall, across network, email, cloud, OT and identity. That makes the traffic feed, where the Master runs and how far response may act the three things to get right.
Adaptive AI
Builds a Unique Behavioral Profile of your own users, devices and traffic instead of relying on attack signatures; custom models can be added on top.
Real-Time AI Analyst
The autonomous layer of the renamed platform, which investigates alerts as they fire; Darktrace’s documentation still calls it Cyber AI Analyst, so expect both names.
360° Insights and Platform Portal
The visibility layer of the renamed platform, with a new Platform Portal launched in August 2026 to sit over network, email, cloud and AI coverage.
Masters, probes and sensors
Physical or Darktrace-hosted Masters, probes, vSensors and osSensors read mirrored traffic and syslog; detection is only as good as that feed.
Start with the blind spot — inside the network, the inbox, the cloud or the plant — then pick the product that covers it.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader, NDR Magic Quadrant 2026
announced on 21 May 2026 as its second year running; Vectra AI and ExtraHop each announce a 2026 Leader placement too
Leader, NDR Magic Quadrant 2025
the first of the two consecutive Leader placements Darktrace now cites for network detection and response
Leader, Email Security Platforms MQ 2025
announced on 3 December 2025, for the behavioural email product that works beside the mail filter
Challenger, Email Security Platforms MQ 2024
in the first edition of that Magic Quadrant, a year before the move up to Leader
Customers’ Choice, NDR and email, 2025
review awards from Gartner Peer Insights, not Magic Quadrant placements; Darktrace says it was the only Customers’ Choice for NDR
Representative Vendor, MDR Market Guide
a listing in a Market Guide, not a ranking, and Darktrace’s page gives no year; Gartner runs no MDR Magic Quadrant
Taken private by Thoma Bravo
a deal valued at about $5.3 billion, completed on 1 October 2024, that made Darktrace a privately owned company
CVE-2024-22854 in Threat Visualizer
an HTML-injection and open-redirect flaw (CVSS 6.1) in 6.1.27 and earlier; NVD lists no Darktrace CVE for 2025 or 2026
The company in six figures
See the platform, hear the pitch
Not all AI in cybersecurity is the same. Discover the Darktrace difference.
A 2025 explainer of how Darktrace’s behavioural AI differs from other AI in security, made before the platform was renamed in August 2026.
The World Needs Defenders. Defenders Need Darktrace
A 2025 brand film about the people who defend networks; it sets the tone rather than demonstrating a product.
Defenders detect novel threats faster with the leading AI-native platform
A 2026 thirty-second spot on detecting novel threats; the speed claim in it is Darktrace’s own.
Where Darktrace sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Darktrace Across Its Solution Areas
Each dot is a Darktrace solution area: competitive position vs category momentum.
The flagship and the only line with a public price: a Gartner NDR Leader in 2025 and 2026, sold as AWS Marketplace tiers from $30,000 a year.
Coverage Breadth × Native Response
How many domains one vendor’s behavioural model covers vs how far it can respond without another vendor’s product.
One behavioural model spans network, email, cloud, OT, identity and AI tools, and Autonomous Response acts without another vendor’s product, though only on mirrored traffic it can see.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Darktrace?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What problem is forcing the decision?
2. Where must it run?
3. Who will own it?
Eight contracts, three on the website
Darktrace’s site now shows three products plus services, but the contract still licenses eight. Each card here maps to one of them.
Read →Where should the Master run?
On your own appliance in your data centre, or hosted by Darktrace in the EU, US, Canada, Singapore or Australia. Only the first stays in India.
Read →Old names in old quotes
Antigena is now Autonomous Response, and the Enterprise and Industrial Immune Systems are now Darktrace Network and Darktrace OT. Older quotes use the former names.
Read →The one public price
The network product has AWS Marketplace tiers at $30,000, $60,000 and $100,000 a year, set by bandwidth and hosts. Everything else is quoted.
Read →Email without moving MX
Darktrace Email reads mail over API and journaling, so your existing filter stays in place. It adds behavioural checks for impersonation and takeover.
Read →Where Darktrace fits in Security
The Security category page sets out six buying routes; Darktrace sells into three of them with its email, cloud and MDR products.
Read →The acronym decoder
Every term on these pages, in one place- NDR
- Network detection and response: spotting threats in traffic already inside the perimeter.
- Autonomous Response
- Darktrace’s containment, formerly Antigena: connection resets or firewall-driven blocks.
- Adaptive AI
- Darktrace’s current term for the self-learning model trained on one customer’s data.
- Real-Time AI Analyst
- The platform layer that investigates alerts by itself; previously Cyber AI Analyst.
- Master
- The Darktrace appliance or hosted instance that analyses what the sensors collect.
- vSensor
- A virtual sensor that ingests mirrored traffic from virtual and cloud networks.
- osSensor
- A lightweight host agent for Windows, Linux or Docker that feeds traffic to a vSensor.
- Traffic mirroring
- Copying packets to a sensor through SPAN or a cloud mirror; gaps in it blind detection.
- ITDR
- Identity threat detection and response: catching misuse of accounts that already exist.
- CDR
- Cloud detection and response: finding and containing live attacks in cloud accounts.
- BEC
- Business email compromise: fraud by impersonating an executive, supplier or colleague.
- Shadow AI
- AI tools and agents staff use without approval, and the data that flows into them.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Map the eight contracts to your gaps
The website shows three products, but network, email, cloud, OT, identity, forensics, AI security and MDR are contracted one by one. Buy only the lines you will deploy.
Prove the traffic feed first
Detection depends on complete SPAN or cloud mirroring. Confirm which segments, clouds and sites can be mirrored before you size any band or run the free Proof of Value.
Choose where the Master runs
Darktrace-hosted Masters run in the EU, US, Canada, Singapore or Australia. An appliance in your own data centre is the only route that keeps network metadata in India.
Decide how response will act
Autonomous Response resets connections from a probe or sensor, but cannot cross stateful boundaries alone. Plan the firewall integration and the approval rules up front.
Settle who watches it at night
MDR covers Darktrace telemetry only and leaves remediation with you. Lighter services exist: Managed Threat Detection triages and notifies, and Security Operations Support adds on-demand analysts.
Get it priced in rupees
Apart from the AWS network tiers, Darktrace publishes no price and no INR list. TechBag scopes bandwidth, hosts and workloads and quotes the total in INR with GST.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| HYBRID NETWORK | Usage-metric bands in the order form · AWS Marketplace tiers by average bandwidth and host count | $30,000/yr AWS Marketplace public offer | Behavioural NDR |
| Quoted per estate · DMARC is a separate SKU, self-service on Azure Marketplace | Quote | BEC and impersonation | |
| CLOUD | Identity Workload count: cloud identities plus weighted workloads | Quote | Cloud detection and response |
| OT | Own product specification, on the network architecture | Quote | Plants and utilities |
| IDENTITY | Usage-metric bands in the order form | Quote | Account takeover response |
| Forensic Acquisition & Investigation | Customer-hosted in your cloud account, or SaaS in Darktrace’s AWS | Quote | Cloud incident evidence |
| SECURE AI | Own product specification · multi-tenant, EMEA and US hosting | Quote | Shadow AI and agents |
| Managed Detection & Response | Service bundle on top of your Darktrace licence, scoped per estate | Quote per scope | 24/7 cover for Darktrace |
Darktrace publishes one real price: an AWS Marketplace public offer for the network product at $30,000, $60,000 or $100,000 a year, set by average bandwidth and host count, with a free 30-day Proof of Value. Every other product and service is quote-only and there is no INR list. TechBag gets the quote itemised in INR with GST.
Five pitfalls that cost buyers quarters
Reading a $1 listing as a price
The MDR and forensics listings on AWS Marketplace carry token figures for custom offers. They are placeholders, not prices; only the network tiers are real.
Mirroring only part of the network
Darktrace’s own specification warns that analysis is severely impacted when the traffic feed is incomplete. Unmirrored segments are simply invisible to it.
Expecting resets to cross every boundary
Autonomous Response sends TCP resets that cannot cross stateful boundaries, and hosted Masters cannot send them at all. Plan a probe or firewall integration.
Treating ENDPOINT as an EDR
osSensor and NEXT feed network context from hosts. Darktrace sells them beside an EDR such as Defender for Endpoint, so keep your EDR budget intact.
Assuming any India hosting
No Darktrace-hosted component has an India region; Singapore is the nearest. In-country means on-premises appliances or forensics run in your own cloud account.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Four trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**TechBag’s illustrative estimate, not a quoted analyst figure. The takeaway: buyers want detection that works across network, email, cloud and identity from one model — which is why Darktrace now sells all of them on one platform, and added forensics and AI security.
Behaviour over signatures
Darktrace renamed its platform on 3 August 2026 around behavioural security, with Adaptive AI learning each customer’s normal.
What it means for you
Ask how a tool flags an attack it has never seen before.
AI tools as a new attack surface
Darktrace Secure AI reached general availability on 22 September 2026, covering prompts in Copilot, ChatGPT Enterprise, Claude and Bedrock.
What it means for you
List the AI tools and agents in use before you pick a control.
Decryption back on the wire
Darktrace bought Mira Security in July 2025 for in-line decryption and hardware with 100 Gbps interfaces.
What it means for you
Check what share of your traffic any NDR can actually read.
Evidence capture in the cloud
Darktrace acquired Cado Security and now sells its cloud forensics as Forensic Acquisition & Investigation, self-hostable in your cloud.
What it means for you
Decide where forensic evidence will be kept before an incident.
Questions buyers ask about Darktrace
Ready to shortlist Darktrace?
Open any of the eight intel pages for the deep dive, or let a TechBag advisor build the case with you — the traffic to mirror, where the Master runs, how far response may act, and the AWS tier or quote that fits, quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.