Every category where a model named Darktrace for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant	Since September 2026
Network detection and response	Security operations	4%	8 of 102	34%	44	criticized challenger
AI security platforms	Security operations	0%	45 of 233	23%	13	accepted challenger
Attack surface management	Security operations	0%	89 of 100	25%	4	under 10 labels · led by Intruder at 49%	newNew since September 2026: not ranked then, 0% now.
AI SOC agents	Security operations	0%	47 of 104	0%	2	under 10 labels · led by Dropzone AI at 24%
OT and IoT security	Security operations	0%	40 of 107	0%	2	under 10 labels · led by Microsoft Defender for IoT at 21%
Endpoint detection and response	Security operations	0%	27 of 55	0%	1	under 10 labels · led by Microsoft Defender for Endpoint at 30%	newNew since September 2026: not ranked then, 0% now.
Insider risk management	Security operations	0%	52 of 84	0%	1	under 10 labels · led by Microsoft Purview Insider Risk Management at 22%

Movement

This is the first edition on this tier, so no move can be computed for Darktrace yet. From the next edition this section shows, per buyer segment and per category, whether its share moved by more than the measured noise floor.

By model

How each model treated Darktrace across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.

ShowHide

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	2	0	2	1	5
GPT-5.4 mini	0	1	1	1	3
Gemini 3.5 Flash	1	2	0	2	5
Perplexity Sonar	0	2	3	0	5
Grok 4.20	2	3	2	2	9
Mistral Small	0	2	1	2	5
DeepSeek V4 Flash	0	1	3	4	8
Llama 4 Maverick	0	0	2	0	2
Qwen 3.7 Flash	0	2	2	1	5
Kimi K2	1	1	2	2	6
GLM 4.7 FlashX	1	1	1	1	4
MiniMax M2.5	0	0	2	2	4
GPT-6 Luna	1	0	0	0	1
Muse Glimmer 30B	1	0	3	1	5

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct44 labels4

Paraphrase8 labels2

Comparative56 labels14not counted in share

Budget-constrained35 labels3

Scale-constrained17 labelsNone

Negative41 labels1not counted in share

First choiceAlternativeMentionNegative201 labels in all, every segment counted; 9 of the 24 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Best overall AI‑led detection: Darktrace – strong self‑learning models, autonomous response, and broad industry relevance.” GLM 4.7 FlashX · NDR · direct prompt · first choice

“Prioritize vendors with proven encrypted visibility, low-noise AI (e.g., Leaders in Gartner 2025 like Darktrace/Vectra)” Grok 4.20 · NDR · negative prompt · first choice

“If you have a small team with no dedicated SOC analyst: Darktrace is the easiest to deploy and operationalize” Gemini 3.5 Flash · NDR · comparative prompt · first choice

“Darktrace and Vectra AI headline 2026's NDR field for autonomous detection and attacker-signal clarity” Claude Haiku 4.5 · NDR · comparative prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“What to Avoid for Mid-Market ... Premium pricing ($50K–$500K+/year), designed for large enterprises” Kimi K2 · NDR · direct prompt · hard negative

“Darktrace has accumulated the most consistent negative feedback from practitioners” DeepSeek V4 Flash · AI security · negative prompt · hard negative

“Options to Avoid on a Tight Budget - Darktrace, Vectra AI, ExtraHop” DeepSeek V4 Flash · NDR · budget prompt · hard negative

“avoid full Darktrace if budget-constrained” Grok 4.20 · ASM · direct prompt · hard negative

Named alongside

The products named in the same answers as Darktrace, over the 201 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Darktrace was named but was not.

ShowHide

ProductSame answerTook the first choice insteadHead to head

Vectra AI116 of 20118Compare →

Corelight Open NDR89 of 2015Compare →

ExtraHop RevealX71 of 2016Compare →

Cisco Secure Network Analytics57 of 2012Not among the top eight

SentinelOne Singularity41 of 2016Not among the top eight

ExtraHop Reveal30 of 2013Compare →

Security Onion27 of 20118Not among the top eight

CrowdStrike Falcon25 of 2014Not among the top eight

Trellix NDR24 of 2010Not among the top eight

Trend Vision One24 of 2010Not among the top eight

A head-to-head page exists where both products are among a category's top eight. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Darktrace. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 184 of the 201 answers that named Darktrace and are not a share of its labels.

Domains cited

comparitech.com84

g2.com80

vectra.ai69

gartner.com67

guideflow.com60

cybersecuritynews.com55

ciopages.com50

peerspot.com50

devopsschool.com48

fidelissecurity.com43

606 of the 606 domain citations in answers naming Darktrace came from somebody else's page.

Pages cited

comparitech.com/net-admin/network-detection-response-software79

cybersecuritynews.com/best-ndr-solutions49

ciopages.com/buyer-guides/network-detection-response48

gartner.com/reviews/market/network-detection-and-response43

guideflow.com/blog/network-detection-and-response-software40

g2.com/categories/network-detection-and-response-ndr38

zenarmor.com/docs/network-security-tutorials/best-10-network-detection-and-response-ndr-to37

dupple.com/blog/network-security-monitoring-tools31

Pages are listed as the models cited them.

Search and answers

darktrace.com is not in Google's top ten for any of the category's searches. In the answers, Darktrace takes 4% of first choices and ManageEngine NetFlow Analyzer takes 21%.

ShowHide

In search

Google, US estimates

Position for “ndr platform”

–

not in the top ten

Position for “ndr platforms”

–

not in the top ten

Searches for its name, Google: 8,100 a month (“darktrace”)
AI search demand for its name, est.: 447 a month
Organic visits to its site: about 65,093 a month
Searches its site ranks for: 5,508 · 666 in the top three
Sites linking to it: 12,561
Paid Google search: No ads found in the estimate; that does not mean it runs none

Ads on GoogleDetailLess

119+ ads · 96 text, 23 video · 29 shown in the last 30 days

First shown September 2023, as DARKTRACE HOLDINGS LIMITED, verified. Ads started 2025-11 to 2026-10: 65 in the year, 54 before. 1 more by other advertisers linking to it.

On Google's pages: 1 2 3 4

In answers

This edition

Share of first choices

rank 8 of 102 in NDR

Segment leader

21%

ManageEngine NetFlow Analyzer

First choices: 9 across its categories
Named in: 201 answers
Its own site cited: in 184 of the answers that named it

Search figures are US estimates from DataForSEO, read October 5, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.

What it publishes

ShowHide

Addresses on darktrace.com

10,042

subdomains included

Content

1,792

counted in the table below

Documentation

Product · Integration

27 · 1

Kind	Pages	Last 90 days	Categories named
News or press	1,103	undated	Email security, ASM
Blog	441	undated	Email security, ASM
Case study	116	undated
Webinar or virtual event	77	undated
Report or ebook	28	undated
Conference or event	8	undated
Comparison	8	undated
Glossary or explainer	4	undated
Podcast or video	4	undated
Template or tool	3	undated	Email security

How it is countedHide how it is counted

Every page darktrace.com exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. Of its titles that name a category, most name email security (26); 10 name its categories the models place it in. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.

Names read as Darktrace

What the judge wrote, as written, with how often. The vendor table decides that these count as Darktrace; a claim can dispute any of them.

Darktrace / NETWORK 3Darktrace / ActiveAI Security Platform 1Darktrace Enterprise 1

Follow Darktrace

An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.

Already following? Everything you follow, with a stop for each.

The company

Darktrace is its own company.

ShowHide

In its own words

Stated by the vendor, not checked

Positioning: The Essential AI Cybersecurity Platform
darktrace.com
For: Everything you need to complete your security review is here.
trust.darktrace.com
Free plan or trial: Start free trial darktrace.com
Certifications: ISO 27001:2022ISO 27018:2019ISO 42001IRAPCyber EssentialsGDPRICO Registered
Hosting: United StatesCanadaUnited KingdomIrelandNetherlandsAustraliaSingaporeKorea
Customers named: TechnologentVulcan Steel LimitedBanco GaliciaNCGBiomericsMerced CollegeLake Macquarie City CouncilCoca-Cola Beverages Northeast (CCBN)
Not stated on the pages read: Price, starting price, integrations

What Darktrace's own pages state, read October 5, 2026: darktrace.com, trust.darktrace.com, darktrace.com/platform, darktrace.com/customers, darktrace.com/partners. A claimed page can correct any of them.

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Darktrace's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Darktrace, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

What a new claim receivesHide what a new claim receives

A new claim receives the current edition's vendor brief for Darktrace by email, built from the raw record of the edition. It shows:

where Darktrace is named, by buyer and by framing, and which cells hold its first choices;
the claims the models make when they name it, ranked, with the strongest and the weakest quoted;
its vocabulary against the segment leader's, and the pages the models cited;
who was chosen in the answers that did not name Darktrace, and every reason the record gives;
a battlecard for each top rival: the head-to-head split, why they win, and the reservation quoted against them;
one page of published figures cleared to show a buyer.