Darktrace

Darktrace is a British artificial intelligence (AI) cybersecurity company that uses self-learning algorithms to detect and respond to cyberattacks across a network, cloud, email and operational technology systems in real time. Founded in Cambridge, England in 2013, the company built its reputation on technology that learns the normal pattern of activity for every device and user on a network, then flags anything that deviates from it, rather than relying on a database of known attack signatures. Darktrace went public on the London Stock Exchange in 2021 and was acquired by the private equity firm Thoma Bravo for about $5.3 billion in 2024.

History of Darktrace

Darktrace was founded in 2013 with backing from Invoke Capital, an investment firm run by the British entrepreneur Mike Lynch. Several of the company’s early leaders, including co-founder and first chief executive Poppy Gustafsson, had previously worked at Autonomy, a software company Lynch built and later sold to Hewlett-Packard. The company’s name refers to the dark, unmonitored corners of a network where threats can hide undetected. Through the 2010s it expanded quickly, opening offices in London, San Francisco and Singapore alongside its Cambridge headquarters, and later adding a second research and development center in The Hague, Netherlands, next to its original Cambridge AI Research Centre.

How Darktrace’s technology works

Rather than matching network traffic against a database of known malware, the way traditional antivirus software does, Darktrace uses unsupervised machine learning, a form of artificial intelligence that finds patterns in data without being given labeled examples in advance, to build a live behavioral baseline for every device, user and connection on a network. Security analysts monitor this baseline through an interface the company calls the Threat Visualizer. When activity deviates sharply from the established pattern, such as a device suddenly sending large volumes of data to an unfamiliar server, the system can flag it automatically. Darktrace’s autonomous response technology, called Antigena, can also take proportionate action on its own, such as slowing or blocking a suspicious connection, without waiting for a human analyst. Because this approach does not depend on recognizing a known attack signature, the company markets it as effective against zero-day threats, the kind of newly discovered software flaws exploited during the Log4j vulnerability disclosures.

Darktrace’s product platform

Darktrace’s current offering, marketed as the ActiveAI Security Platform, bundles modules covering network, cloud, email, identity, endpoint and operational technology security under one system. The company has filed more than 200 patent applications tied to its detection and response technology and says it protects nearly 10,000 customers across major industries worldwide. Darktrace has also used sports sponsorship to showcase its technology, partnering with the McLaren Racing Formula One team starting in 2020 and extending the relationship to McLaren’s IndyCar team in 2021.

Growth, IPO and the Thoma Bravo acquisition

Darktrace listed on the London Stock Exchange in April 2021 at a market value of about xc2xa32.5 billion, with shares reportedly jumping 32 percent on their debut; the company’s valuation peaked near xc2xa37 billion later that year. By its 2023 fiscal year Darktrace reported revenue of roughly $545 million and a workforce of more than 2,200 employees. In April 2024 the American private equity firm Thoma Bravo agreed to acquire Darktrace in an all-cash deal valuing the company at about $5.3 billion, or $7.75 a share. The deal closed on October 1, 2024, delisting Darktrace from the London Stock Exchange’s FTSE 100 index and returning it to private ownership for the first time since its IPO.

Criticism and controversies

In January 2023 the New York short seller Quintessential Capital Management published a report alleging possible accounting irregularities in some of Darktrace’s reseller and customer contracts, most of which predated its 2021 listing. The stock fell sharply after the report. Darktrace disputed the allegations and commissioned an independent review from the accounting firm EY, which concluded in July 2023 that it had found a small number of errors and inconsistencies in certain contracts but that none were material to the company’s financial statements; shares recovered on the news. The company’s origins have also drawn scrutiny because of its ties to Mike Lynch, whose earlier sale of Autonomy to Hewlett-Packard became the subject of a long-running American fraud case; Lynch died in August 2024, shortly before the Thoma Bravo deal closed. Darktrace’s leadership has changed often in recent years: Gustafsson stepped down as chief executive in September 2024, her successor Jill Popelka was replaced in January 2026, and Ed Jennings became chief executive in March 2026.

Darktrace vs. traditional cybersecurity tools

Traditional antivirus software and security information and event management platforms generally work by matching activity against known threat signatures or by centralizing log data for analysts to review, often after an incident has already happened. Darktrace’s technology instead builds a continuously updated behavioral baseline and can flag, and sometimes autonomously respond to, anomalies it has never encountered before. In practice, most large organizations run cybersecurity technology like Darktrace alongside these traditional tools as one layer of a broader defense, rather than as a full replacement for them.

FAQs

What does Darktrace do? Darktrace sells AI-powered cybersecurity software that monitors networks, cloud systems, email and devices in real time, learns what normal activity looks like for each customer, and can automatically respond to anomalies that suggest a cyberattack.

Who owns Darktrace? Darktrace has been owned by the American private equity firm Thoma Bravo since October 2024, when it completed a $5.3 billion all-cash acquisition and delisted the company from the London Stock Exchange.

Is Darktrace still a public company? No. Darktrace traded on the London Stock Exchange from April 2021 until October 2024, when Thoma Bravo’s acquisition closed and the shares stopped trading.

What is Darktrace’s main product called? As of the Thoma Bravo era, Darktrace markets its software as the ActiveAI Security Platform, covering network, cloud, email, identity, endpoint and operational technology security.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 9, 2026Researched and drafted with AI assistanceReport an issue