Darktrace

Started in Cambridge in 2013 by university mathematicians and people from the British intelligence world, funded by Mike Lynch's investment firm. The pitch, branded the "Enterprise Immune System", is unsupervised machine learning: rather than matching signatures, it builds a model of what every device and user usually does and flags deviations — an account suddenly uploading terabytes to an unknown host, a printer that starts speaking SSH.

Critics have long pointed out that anomalous is not the same as malicious, and that the alerts need people who can interpret them. The company listed in London in 2021 and was acquired by Thoma Bravo in 2024. It competes more with SIEM and NDR tools than with classic EDR.