CISO Tribune

Vendor comparison · 2 companies

Darktrace vs IRONSCALES

Darktrace sells security for AI systems and agents, for network, cloud and OT environments, and for email and collaboration tools. IRONSCALES sells email security that protects Microsoft 365 and Google Workspace against business email compromise, account takeover, malware and malicious URLs, credential harvesting, generative AI attacks, QR code and image-based phishing, and deepfake impersonation in Microsoft Teams meetings. CISO Tribune files both under Email security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Darktrace
  • IRONSCALES
Darktrace vs IRONSCALES: Products, Customers and Funding Compared
DarktraceDarktrace sells security for AI systems and agents, for network, cloud and OT environments, and for email and collaboration tools.darktrace.comIRONSCALESIRONSCALES sells email security that protects Microsoft 365 and Google Workspace against business email compromise, account takeover, malware and malicious URLs, credential harvesting, generative AI attacks, QR code and image-based phishing, and deepfake impersonation in Microsoft Teams meetings.ironscales.com
What it sells
  • Darktrace / EMAIL[14][15]Email security that catches phishing, business email compromise, executive impersonation and social engineering attacks.
  • Phishing SOC Agent[6][10]Delivers L2-level forensics on suspicious email.
  • Phishing Simulation Agent[6][10]Builds phishing simulations from OSINT gathered on employees.
  • Human Risk Management[11]Phishing simulation, security awareness training, and user risk scoring.
  • Themis[2][9]An agentic AI virtual SOC that classifies, clusters, and remediates threats.
  • Email Incident Management Service (EIMS)[12]IRONSCALES experts handle email threat investigation, remediation, and AI tuning.
Categories
Headquarters
Cambridge, United Kingdom[2]Atlanta, United States[1][13]
Founded
2013[2]2014[1][13]
Ownership and funding
Owned by Thoma Bravo since 2024[3][12][13][17]Privately held[4][8]
Named customers
  • Coca-Cola Beverages Northeast[4]
  • HARMAN International[5]
  • City of Las Vegas[6]
  • Centre Parcs[7]
  • Banco Galicia[8]
Not stated on its pages
Recent news
  • September 24, 2026Darktrace launched Signal Labs, a research unit that tests how AI models and agents misbehave in sandboxed environments, and published its first findings.[9]
  • September 22, 2026Darktrace made its SECURE AI product generally available, giving enterprises tools to discover AI use, monitor people and agents, and act on policy risks.[10]
  • August 4, 2026Darktrace announced an integration that feeds behavioral risk signals about AI agents from its SECURE AI product into the Microsoft Agent 365 portal.[11]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[13]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen October 25, 2026[8]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetFrom its own pages, the company sells mainly to enterprises and to MSPs and MSSPs. One entry point addresses global companies that are transforming their email security to tackle modern threats. The site also presents a comparison of secure email gateways and API-based solutions for enterprises and MSPs.
Last verified
October 10, 2026November 2, 2026

Where they overlap

  • Darktrace and IRONSCALES are both filed under Email security.

Where they differ, field by field

  • Darktrace's primary category is Network detection and response; IRONSCALES's is Email security.
  • Darktrace is also filed under OT and ICS security. IRONSCALES is also filed under AI SOC analysts.
  • Darktrace lists Darktrace / EMAIL. IRONSCALES lists Phishing SOC Agent, Phishing Simulation Agent, Human Risk Management, Themis and Email Incident Management Service (EIMS).
  • Darktrace is headquartered in Cambridge, United Kingdom. IRONSCALES is headquartered in Atlanta, United States.
  • Darktrace was founded in 2013. IRONSCALES was founded in 2014.
  • Darktrace is owned by Thoma Bravo, since 2024. IRONSCALES is privately held.
  • Darktrace publicly names Coca-Cola Beverages Northeast, HARMAN International, City of Las Vegas, Centre Parcs and Banco Galicia.

What it sells: Darktrace

What Darktrace / EMAIL does[14][15]
Darktrace / EMAIL learns from each organization's own activity and users, not a shared cross-customer model. Darktrace says it catches phishing, business email compromise, executive impersonation, and social engineering attacks. Behavioral detection extends across Microsoft Teams, Zoom, and Slack. Each employee's risk score adapts their email controls.

What it sells: IRONSCALES

What Phishing SOC Agent does[6][10]
Phishing SOC Agent delivers L2-level forensics in minutes and runs five analysis tracks in parallel: sender verification, body analysis for social engineering, link inspection through the full redirect chain, attachment detonation across 100+ engines, and relay path tracing. The agent's output is a Security Assessment with a verdict, key evidence, and a full activity log of every step it took.
What Phishing Simulation Agent does[6][10]
Phishing Simulation Agent gathers OSINT on people, including social media profiles, data breach exposure, and recent job changes, and builds simulations that mirror the tactics targeting the organization. Personalized phishing emails are written in each employee's native language, and one sample per employee cluster is approved by the customer.
What Human Risk Management does[11]
The platform incorporates Human Risk Management: phishing simulation, security awareness training, and user risk scoring modules that automatically tailor simulations to each employee's specific threat profile. IRONSCALES offers a GPT-powered spear phishing module for VIPs and frequently targeted employees.
What Themis does[2][9]
Themis is described as an agentic AI virtual SOC that automatically classifies, clusters, and remediates threats detected by machine learning models or user-reported emails. When a threat is detected, Themis takes autonomous action: quarantining, clustering, or escalating based on automation preferences.

Questions about Darktrace and IRONSCALES

What do Darktrace and IRONSCALES sell?
Darktrace sells Darktrace / EMAIL. IRONSCALES sells Phishing SOC Agent, Phishing Simulation Agent, Human Risk Management, Themis and Email Incident Management Service (EIMS).
Are Darktrace and IRONSCALES in the same category?
They share Email security. Darktrace's primary category is Network detection and response and IRONSCALES's is Email security.
Where are Darktrace and IRONSCALES headquartered?
Darktrace is headquartered in Cambridge, United Kingdom. IRONSCALES is headquartered in Atlanta, United States.
When were Darktrace and IRONSCALES founded?
Darktrace was founded in 2013. IRONSCALES was founded in 2014.
Who owns Darktrace and IRONSCALES?
Darktrace is owned by Thoma Bravo, since 2024. IRONSCALES is privately held.
Which customers do Darktrace and IRONSCALES name?
Darktrace publicly names Coca-Cola Beverages Northeast, HARMAN International, City of Las Vegas, Centre Parcs and Banco Galicia.
Who are Darktrace and IRONSCALES sold to?
From its own pages, the company sells mainly to enterprises and to MSPs and MSSPs.
What have Darktrace and IRONSCALES announced recently?
September 24, 2026: Darktrace launched Signal Labs, a research unit that tests how AI models and agents misbehave in sandboxed environments, and published its first findings.

About Darktrace

Darktrace sells security for AI systems and agents, for network, cloud and OT environments, and for email and collaboration tools. Darktrace says it understands behavior across people, networks, applications, cloud, and AI. Darktrace says its Adaptive AI learns an organization's own operational patterns, unlike security tools that rely on static rules or training data from other organizations. Darktrace says its AI learns from each organization's own business data to identify anomalous activity for each asset across domains.[1][14]

Darktrace says a dynamic understanding of every email user in an organization allows Darktrace / EMAIL to take a targeted response to threats that others miss. Darktrace learns from each organization's own activity and users, not a shared cross-customer model. Darktrace says its email security catches phishing, business email compromise, executive impersonation, and social engineering attacks. Darktrace says its behavioral detection extends across Microsoft Teams, Zoom, and Slack. When credentials are compromised, Darktrace responds autonomously by terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud. Darktrace says each employee's risk score adapts their email controls, so protection strengthens for higher-risk users as training progresses. The Darktrace Email Analysis Agent integrates with Microsoft Defender and Security Copilot to streamline investigation and response for SOC teams.[1][15][16]

Darktrace says one solution detects, investigates, and contains threats across network, cloud, OT, endpoint, and identity, and learns the environment from the ground up. Darktrace / HYBRID NETWORK passively ingests traffic from on-premises and virtual networks, multi-cloud environments, OT, endpoints, and identities. Darktrace analyzes encrypted and decrypted traffic across network, cloud, and OT to surface activity that does not fit the environment. Darktrace then contains that activity with response actions taken natively or through firewalls, EDR, SOAR, and ITSM tools. Darktrace says it can flag account takeover, privilege escalation, and insider misuse when an identity stops matching how that identity normally behaves. When a threat is identified, Darktrace automatically acquires host and workload artifacts across endpoints, cloud, containers, and SaaS environments. Darktrace says its approach detects zero-day threats an average of 8 days before public CVE disclosure.

For cloud, Darktrace says its Adaptive AI continuously monitors activity across cloud assets, workloads, APIs, containers, and identities. Darktrace says Cyber AI Analyst automatically investigates alerts and connects related cloud and infrastructure activity. Darktrace's coverage extends across Compute, Serverless, Containers, IAM, Storage Services, and beyond. Darktrace draws data from lightweight host-based server agents or a combination of traffic mirroring and API logs. Darktrace supports security investigations by combining its detection and response capabilities with Amazon Security Lake.[18][19]

For operational technology, Darktrace maintains a live asset inventory, obtained through passive and active scanning, and immediately reveals CVEs and End-Of-Life status. Darktrace says it identifies and contains threats across converged IT and OT environments with Adaptive AI. Darktrace says Cyber AI Analyst automatically investigates alerts and correlates related activity across OT and IT environments. Darktrace says it automatically maps its models to the MITRE for ICS attacks/techniques, and says it helps organizations meet NIST and other regulations and standards.[20]

Darktrace calls its endpoint functionality Network Endpoint eXtended Telemetry (NEXT), which shows the endpoint process root cause for network threats. Darktrace says Cyber AI Analyst autonomously investigates alerts, gathers evidence, tests hypotheses, and delivers incident context. Darktrace responds autonomously with targeted actions that contain threats and avoid business disruption. Darktrace lets customers set response policies with configurable actions based on device types, user groups, locations, business hours, and operational requirements. Darktrace complements Microsoft Defender for Endpoint by connecting endpoint signals with behavioral understanding across a wider infrastructure.[15][21]

Darktrace says action can be taken independently or via integrations with native security controls, and that alerts are sent wherever the customer wants them. Darktrace extends its autonomous response to Check Point firewalls and to Palo Alto firewalls. Darktrace incidents and model breach alerts can be analyzed in CIM compatible Splunk dashboards. Darktrace enriches its AI decision-making with alerts from the Crowdstrike Falcon platform. Darktrace's Cyber AI Analyst integrates with Microsoft Copilot for Security.[14][15][22][23]

HARMAN International uses Darktrace coverage for email, network, and OT systems. Centre Parcs turned to Darktrace to protect its network, email, and cloud environments with a single AI security platform. Darktrace says organizations across all sizes and industries rely on it to get proactive about cyber security.[14][16][20]

Darktrace on the record

Sources

Darktrace full record

  1. [1]ProductsDarktrace · darktrace.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Darktrace named technology pioneer by world economic forumDarktrace · darktrace.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Darktrace announces formal completion of its acquisition by thoma bravoDarktrace · darktrace.com · published October 1, 2024 · Tier A
  4. [4]Coca cola beverages northeastDarktrace · darktrace.com · undated page, accessed October 10, 2026 · Tier A
  5. [5]Harman internationalDarktrace · darktrace.com · undated page, accessed October 10, 2026 · Tier A
  6. [6]City of las vegasDarktrace · darktrace.com · undated page, accessed October 10, 2026 · Tier A
  7. [7]Center parcs darktraceDarktrace · darktrace.com · undated page, accessed October 10, 2026 · Tier A
  8. [8]Banco galiciaDarktrace · darktrace.com · undated page, accessed October 10, 2026 · Tier A
  9. [9]Darktrace launches signal labs to research emerging risks of enterprise ai agentsDarktrace · darktrace.com · published September 24, 2026 · Tier A
  10. [10]Darktrace extends behavioral security with general availability of darktrace secure aiDarktrace · darktrace.com · published September 22, 2026 · Tier A
  11. [11]Darktrace among first cybersecurity companies selected to integrate risk signals into microsoft agent 365Darktrace · darktrace.com · published August 4, 2026 · Tier A
  12. [12]Darktrace | The Essential AI Cybersecurity PlatformDarktrace · undated page, accessed October 24, 2026 · Tier A
  13. [13]Darktrace / HYBRID NETWORK Reviews & Product Details - G2G2 · undated page, accessed October 24, 2026 · Tier C
  14. [14]AI Cyber Security Solutions | Harden Defenses Inside & OutDarktrace · undated page, accessed November 3, 2026 · Tier A
  15. [15]Microsoft Azure Security & Compliance | Security ServicesDarktrace · undated page, accessed November 3, 2026 · Tier A
  16. [16]AI-Based Email Security Software | Email Threat ProtectionDarktrace · undated page, accessed November 3, 2026 · Tier A
  17. [17]Network Security Management | AI Network Security ProtectionDarktrace · undated page, accessed November 3, 2026 · Tier A
  18. [18]Cloud Security Solutions | AI for Cloud Cyber SecurityDarktrace · undated page, accessed November 3, 2026 · Tier A
  19. [19]AWS Data Loss Prevention, Security Compliance, & ProtectionDarktrace · undated page, accessed November 3, 2026 · Tier A
  20. [20]Operational Technology (OT) Cyber Security SolutionsDarktrace · undated page, accessed November 3, 2026 · Tier A
  21. [21]AI Endpoint Security | Cyber Security Endpoint Protection SuiteDarktrace · undated page, accessed November 3, 2026 · Tier A
  22. [22]Network Security Integrations | Darktrace/NetworkDarktrace · undated page, accessed November 3, 2026 · Tier A
  23. [23]Integrations | Darktrace/EndpointDarktrace · undated page, accessed November 3, 2026 · Tier A

IRONSCALES full record

  1. [1]About usIRONSCALES · ironscales.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Platform | How It WorksIRONSCALES · undated page, accessed September 27, 2026 · Tier A
  3. [3]Ironscales raises series c funding roundIRONSCALES · ironscales.com · published December 7, 2021 · Tier A
  4. [4]Ironscales ipoForge Global · forgeglobal.com · undated page, accessed September 27, 2026 · Tier C
  5. [5]AI Email Security Platform for Phishing & Deepfakes | IronscalesIRONSCALES · undated page, accessed October 25, 2026 · Tier A
  6. [6]Email Security AgentsIRONSCALES · undated page, accessed October 25, 2026 · Tier A
  7. [7]IRONSCALES | Complete Email Security & Training SolutionsIRONSCALES · undated page, accessed October 25, 2026 · Tier A
  8. [8]IRONSCALES Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 25, 2026 · Tier C
  9. [9]SOC Automation SolutionIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  10. [10]Platform | What's NewIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  11. [11]Platform | Human ElementIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  12. [12]Pricing | IronscalesIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  13. [13]IRONSCALES | About Us | Our StoryIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  14. [14]Education Email Security Solutions | IRONSCALESIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  15. [15]Augment your Secure Email Gateway with IRONSCALESIRONSCALES · undated page, accessed November 10, 2026 · Tier A
  16. [16]DMARC Management and MonitoringIRONSCALES · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.