What I like most is that Darktrace / EMAIL catches threats our previous Secure Email Gateway consistently missed. Because the AI doesn’t rely on known signatures or reputation lists, it learns what normal communication looks like for each individual user and flags deviations. As a result, it can catch novel phishing attempts and business email compromise attacks that rule-based tools simply can’t detect.
AI/Intelligence is where it genuinely stands out. The self-learning AI builds a behavioral baseline per user and per relationship, so it can identify when an email is impersonating a known supplier even if the domain looks clean and the content passes traditional filters. The Cyber AI Analyst also automatically triages and explains detections in plain language, which has reduced our SOC investigation time considerably. With AI-generated threat summaries, analysts spend more time acting on threats instead of piecing together what happened.
UI/UX is clean and well organized. The email threat dashboard provides a clear view of what was detected, why it was flagged, and what action was taken, without requiring deep technical knowledge to interpret. When you drill into individual email detections, you get a clear visual breakdown of the signals that triggered the alert, which makes it easier to explain decisions to non-technical stakeholders.
Integrations with Microsoft 365 and Google Workspace are native and straightforward to set up. Deployment via API doesn’t require MX record changes, which meant zero disruption to mail flow during onboarding, and that alone made the rollout politically much easier internally.
Performance has been consistent, with detections happening in real time and autonomous response actions—like holding or rewriting suspicious emails—executing quickly without noticeable latency for end users.
Support and onboarding were well structured. The deployment process was guided and fast, and the Darktrace team provided meaningful tuning support in the early weeks to reduce noise without sacrificing coverage.
Pricing and ROI become clear quickly when you consider the cost of a single successful BEC incident versus the annual subscription. Since it catches threats that SEGs miss, the business case is straightforward. Review collected by and hosted on G2.com.
My biggest frustration is the initial noise during the learning period. In the first few weeks, while the AI is building behavioral baselines, the alert volume is high and it takes real tuning effort to get the signal-to-noise ratio to an acceptable level. For smaller security teams without dedicated bandwidth, this onboarding phase can feel overwhelming.
The autonomous response actions are powerful, but they need careful configuration. Out of the box, the sensitivity can be overly aggressive, and I’ve seen cases where legitimate emails were held or modified. That created friction with business users and eroded confidence in the system early on. Finding the right balance between catching threats and avoiding false positives takes longer than expected.
UI/UX also has room to improve, especially around reporting. The threat dashboard is solid for day-to-day operations, but generating customized reports for executive or compliance audiences isn’t as flexible as it should be. Exporting meaningful metrics and setting up scheduled reports still requires more manual effort than it should.
Pricing is on the higher end of the market, which makes it a tougher sell for mid-sized organizations comparing it with more established SEG vendors. The value can be there, but justifying the premium requires a clear understanding of the risk gap it fills—and that isn’t always easy to quantify upfront. Review collected by and hosted on G2.com.
