A security platform that models activity in an organization's environment to detect and investigate deviations. Evaluation should measure alert quality and the
Last reviewed: 2026-10-03
Darktrace analyzes behavior in an organization's environment and correlates unusual activity across supported domains. Its platform combines detection, investigation, and response capabilities. A deviation from learned behavior is a signal to assess, not proof that an event is malicious.
Run an evaluation with approved telemetry and known benign and suspicious scenarios. Measure missed detections, false alerts, investigation effort, and coverage gaps. Review the effect of response actions separately, including how an operator can stop or reverse an inappropriate action.
No. Unusual behavior needs investigation in context. Record false positives and validate detections against independent evidence.
Evaluate detection and investigation first, then test any response actions under a separately defined scope with operator controls.