WillItSurvive
AI companies and labs · subsidiary of Thoma Bravo · United Kingdom

Darktrace

AI-driven cybersecurity platform that detects threats using behavioral network models.

Protection under test
Assessed 21 July 2026 · Evidence as of 21 July 2026
Something worth protecting exists and is being tested right now.
On the recordSince 21 July 2026 · Checkable from 2026 · Every call on the record Checkpoint: Next Gartner Leader cycle renewal for NDR and Email Security
The call

Darktrace's technology looks safe for now, but PE ownership, leadership churn, and silence on financials leave the company's near-term direction unclear.

Darktrace makes software that watches computer networks for unusual activity that might signal a hack or breach, using AI that learns what normal looks like for each customer. It is hard to copy because it has learned from 10,000 customers and knows how to spot attacks others miss, but Microsoft and CrowdStrike are large enough to build similar tools and bundle them into packages they already sell to big businesses, which could slowly drain Darktrace's customers. The biggest question is whether Microsoft can take enough of the market through bundling before Darktrace either grows faster or gets bought by someone else, plus whether the company can keep a steady leader in charge (it has cycled through three CEOs in less than two years, which is a warning sign).

Why
01
AI pressure: None apparent. Frontier models are joining Darktrace's ecosystem, like OpenAI's Daybreak program, rather than cold-starting a replacement for its per-customer behavioral baselines. Could AI do the core job? Unlikely.
02
Bigger players: Microsoft (Defender XDR) and CrowdStrike. Both are bundling network detection into their existing platforms, aiming at the same mid-market customers Darktrace depends on. Could a giant copy it? Yes, easily.
03
What protects it. Years of per-customer behavioral data and deployment history that a bundled or cold-start competitor cannot copy overnight.
What would change this call
Darktrace discloses ARR growth rate publicly again. Shows whether growth has held near prior 20%+ pace or slowed under PE ownership.
Another CEO change at Darktrace within 12 months of Ed Jennings' March 2026 start. Would confirm ongoing leadership instability beyond the three-CEO pattern already seen.
Gartner's next Leader-cycle placement for NDR names Vectra AI or Microsoft ahead of Darktrace. Would show Darktrace losing analyst-recognized technical leadership in its core category.
Key numbers
  • $5.3B Thoma Bravo buyout price (2024-06)
  • $782.2M ARR, last disclosed, +22.7% YoY (2024-07)
  • Three CEOs in 18 months (2026-03)
Named risks
  • Three CEOs in under 18 months signals execution instability under PE ownership. Severity: high
  • No public financial disclosure since October 2024 delisting leaves a two-year verification gap on growth and profitability. Severity: high
  • No structural barrier stops Microsoft or CrowdStrike from bundling comparable detection into existing enterprise licenses. Severity: medium
  • Thoma Bravo could pursue a resale or recapitalization exit, creating uncertainty for employees and customers. Severity: medium
  • Vectra AI and other AI-native rivals actively marketing against Darktrace could erode differentiation over time. Severity: medium
Rivals, as read in July 2026
RivalDirectionEvidence
Microsoft (Defender XDR)contestingBundles Defender XDR into E5 licenses, a pricing channel that pressures standalone NDR vendors, as of 2026
CrowdStrikecontestingExpanding platform into NDR adjacencies, competing for the same security budget as of 2026
Vectra AIcontestingExplicit head-to-head marketing claiming better AI and fewer false positives than Darktrace, published March 11, 2026
Palo Alto Networks (Cortex XDR)contestingAdjacent XDR platform expansion competing for overlapping enterprise security spend as of 2026
Questions people ask
Is Darktrace still publicly traded on the London Stock Exchange?
No. Darktrace delisted from the LSE on October 1, 2024 after Thoma Bravo completed its $5.3 billion take-private acquisition at $7.75 per share cash. It is now a fully private, PE-owned portfolio company with no scheduled public earnings disclosures since.
Who owns Darktrace now?
Private equity firm Thoma Bravo, which closed its acquisition of Darktrace on October 1, 2024 for approximately $5.3 billion. Darktrace has raised no new external funding since the take-private and no longer publishes detailed financials.
Has Darktrace had CEO turnover recently?
Yes, significant churn. Poppy Gustafsson departed September 2024, successor Jill Popelka was removed after only about 16 months on January 27, 2026, and Ed Jennings was named President and CEO in March 2026, marking three CEOs in under 18 months.
Is Darktrace's revenue growing or shrinking?
Unclear post-2024. The last public figures showed FY2024 ARR of $782.2 million (+22.7% YoY constant currency) as of July 2024, but Darktrace stopped disclosing financials after going private in October 2024, leaving a verification gap.
Could AI replace Darktrace's product?
Unlikely to replace it outright. Darktrace's core moat is proprietary self-learning behavioral models trained on each customer's unique network history, which cold-start frontier models cannot replicate. Darktrace joined OpenAI's Daybreak Cyber Partner Program in June 2026 as a collaborator, not a target.
Who is Darktrace's biggest competitor?
Vectra AI markets directly against Darktrace, claiming better AI and fewer false positives as of March 2026. Bigger structural threats come from Microsoft Defender XDR bundling into E5 licenses and CrowdStrike expanding into network detection and response.
Timeline
  • 2026-06-22Darktrace joins OpenAI Daybreak Cyber Partner Program
  • 2026-05-20Named Gartner NDR Leader for second consecutive year
  • 2026-04Launches Darktrace / Adaptive Human Defense; hires CLO David Morris
  • 2026-03Ed Jennings named President and CEO; expands MSSP email security
  • 2026-02Launches Darktrace / SECURE AI governance product
  • 2026-01-27CEO Jill Popelka removed after roughly 16 months in role
  • 2025-07-22Acquires Mira Security for encrypted traffic visibility
  • 2025-01Acquires Cado Security for cloud forensics
  • 2024-10-01Thoma Bravo closes $5.3 billion acquisition; delists from LSE
  • 2024-09CEO Poppy Gustafsson departs ahead of take-private close
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources