Darktrace is the UK-founded AI-driven cybersecurity pure-play best known for the Enterprise Immune System approach to network detection and response (NDR), now consolidated into the broader ActiveAI Security Platform covering Network, Email, Cloud, Endpoint, OT, and Identity threat surfaces. Acquired by Thoma Bravo in October 2024 for $5.3B, Darktrace in 2026 operates as a Thoma Bravo portfolio company with accelerated product expansion and more aggressive commercial motion around multi-module platform deals. Darktrace serves approximately 10,000 enterprise customers globally, with particular strength in financial services, critical infrastructure, manufacturing, and government sectors. For category context, see the Cybersecurity category benchmark.
Darktrace Pricing Model Explained
Darktrace prices ActiveAI Security Platform on a per-user subscription model layered by deployed module. Each module (DETECT, RESPOND, PREVENT, HEAL) is licensed separately per user count, with coverage area overlays (Network, Email, Cloud, Endpoint, OT, Identity) dictating which modules apply to which threat surfaces. The commercial architecture is intentionally layered to enable upsell from initial single-module deployment (typically Email or Network) to multi-module platform deployment over a 2-3 year horizon. Procurement teams that understand the module economics can negotiate multi-year multi-module bundle deals that lock in favorable module-level pricing before Darktrace drives usage-based expansion.
The four module tiers in 2026: DETECT is the foundation module providing AI-driven anomaly detection across the selected coverage area; Darktrace generally requires DETECT as the foundation for any other module. RESPOND adds autonomous response (Darktrace's Antigena technology) that can automatically contain threats without human intervention. PREVENT adds proactive attack surface management, attack path modeling, and external attack surface discovery. HEAL (announced in 2024, expanded in 2026) adds AI-driven incident recovery and response playbook automation.
Coverage areas overlay the modules. Network Coverage (the legacy Darktrace NDR use case) is priced per user count across the monitored network perimeter. Email Coverage is priced per email mailbox count. Cloud Coverage covers AWS, Azure, and GCP with pricing per cloud resource unit. Endpoint Coverage (launched 2023) is priced per endpoint. OT Coverage is priced per OT asset. Identity Coverage (launched 2024) is priced per identity. Each coverage area carries its own per-unit pricing, with material discount available when 3+ coverage areas are purchased together.
User Count Scaling and True-Up Mechanisms
Darktrace subscription pricing scales non-linearly with user count. The per-user rate at 1,000 users is materially higher than the per-user rate at 25,000 users or 100,000 users. Volume discount tiers typically trigger at 2,500, 10,000, 25,000, and 50,000 users. Annual true-up mechanisms apply if actual user counts exceed subscribed counts, typically at list price for the overage user count plus retroactive true-up to the contract start date. Conversely, downward adjustment rights on shrinking user counts are typically not included absent negotiation — a key asymmetry that procurement teams must negotiate.
What Enterprises Actually Pay for Darktrace
These 2026 figures reflect negotiated annual Darktrace spend across 68+ benchmarked enterprise deployments. "Typical" reflects median deal economics with modest competitive pressure; "Strong Leverage" assumes written Vectra AI, ExtraHop Reveal(x), Cisco Secure Network Analytics, and Microsoft Sentinel competitive bids, fiscal year-end timing, and multi-module bundle consolidation.
| Deployment Profile | Primary Modules | Typical Annual Spend (Negotiated) | With Strong Leverage |
|---|---|---|---|
| Single-module small enterprise (2,500 users) | Network DETECT only | $85K–$180K | $68K–$145K |
| Email security standalone (10,000 mailboxes) | Email DETECT + RESPOND | $120K–$285K | $92K–$220K |
| Mid-enterprise NDR (10,000 users) | Network DETECT + RESPOND | $250K–$485K | $195K–$380K |
| Multi-module enterprise (15,000-25,000 users) | Network + Email + Cloud | $485K–$1.1M | $380K–$850K |
| Strategic full-platform (50,000+ users) | All modules, all coverage areas | $1.8M–$4.8M | $1.35M–$3.6M |
| PREVENT module add-on | Attack surface management | +$85K–$220K | +$65K–$170K |
| HEAL module add-on | Incident recovery automation | +$120K–$380K | +$95K–$295K |
Median Fortune 1000 Darktrace subscription is approximately $485,000 annually across 2-3 modules with 10,000-25,000 user coverage. The primary driver of variance is module breadth (single-module versus multi-module platform) and coverage area count. For comparative context within cybersecurity, see our CrowdStrike Falcon pricing guide, Palo Alto Networks pricing guide, and Microsoft Sentinel pricing guide.
Submit your Darktrace contract for a free benchmark
Upload your Darktrace ActiveAI Security Platform proposal or current contract and get a 24-hour benchmark. See exactly where you stand on per-user pricing, module depth, and renewal terms versus 68+ comparable deployments.
Submit Your Contract →Darktrace Discount Benchmarks — What Is Achievable?
Darktrace discount depth responds strongly to three levers: fiscal year-end timing (Darktrace FY ends end of June), written competitive bids against Vectra AI, ExtraHop Reveal(x), Cisco Secure Network Analytics, and Microsoft Sentinel, and multi-module bundle consolidation that demonstrates platform commitment. Post-Thoma Bravo acquisition, Darktrace commercial teams have somewhat tighter discount ceilings on small deals but more aggressive depth on strategic multi-module deals.
| Discount Mechanism | Typical Depth | With Strong Leverage | Notes |
|---|---|---|---|
| Single-module standalone (under $150K) | 15–22% | 22–30% | Limited leverage; focus on terms |
| Single-module ($150K–$500K) | 22–30% | 30–38% | Competitive bid unlocks high end |
| Multi-module platform ($500K+) | 28–38% | 38–45% | 3+ modules + competitive pressure |
| Strategic full-platform ($2M+) | 32–42% | 42–52% | Fiscal year-end + strategic |
| 3-year commitment uplift | 6–12% | 12–18% | Over 1-year equivalent |
| Fiscal Q4 (Apr-Jun) timing | 4–8 points | 8–14 points | FY end June |
| Multi-module bundle uplift | 6–12% | 12–18% | Over separate module pricing |
| PREVENT or HEAL module bundle | 12–22% | 22–35% | New modules carry deeper launch pricing |
The credible competitive alternatives Darktrace commercial teams model against: Vectra AI (direct NDR competitor, strong AI positioning, frequently tighter pricing on pure NDR scope), ExtraHop Reveal(x) (Bain-owned NDR platform, strong network analytics), Cisco Secure Network Analytics (embedded in Cisco enterprise accounts, strong bundle pricing with broader Cisco security stack), Microsoft Sentinel + Defender for Cloud (material cost pressure on Darktrace Cloud and Identity modules, particularly for Microsoft E5 customers), and Arista NDR (emerging competitor with strong network fabric integration).
Darktrace Pricing by Module
DETECT Module (Foundation)
Darktrace DETECT is the foundational AI anomaly detection module required for most other module deployments. Pricing scales per user (or mailbox, endpoint, identity, or OT asset depending on coverage area). Typical per-user rates at 10,000 users: $18-$32 per user per year for Network DETECT, $12-$22 per mailbox per year for Email DETECT, $22-$38 per endpoint per year for Endpoint DETECT. Volume discounts scale materially above 25,000 users.
RESPOND Module (Antigena)
RESPOND adds autonomous threat response — Darktrace's original Antigena technology. Typically priced as a 45-75% uplift on DETECT module pricing, materially richer on Network and Email coverage. RESPOND is the module that makes Darktrace genuinely differentiated against traditional NDR vendors; pricing reflects that premium. Negotiate RESPOND depth aggressively on multi-year deals.
PREVENT Module
PREVENT focuses on attack surface management, external attack surface discovery, and attack path modeling. Priced separately from DETECT and RESPOND at $85K-$220K annually depending on deployment scope. Competes against Palo Alto Networks Cortex Xpanse, Rapid7 Surface Command, Tenable Attack Surface Management, and CrowdStrike Falcon Surface. PREVENT pricing is generally more negotiable than DETECT/RESPOND because the attack surface management market is more price-competitive.
HEAL Module
HEAL is Darktrace's newest module, launched 2024 and expanded in 2026, providing AI-driven incident recovery and response playbook automation. Priced as an add-on to RESPOND, typically $120K-$380K annually. HEAL is priced at launch-pricing discount depth (typically 12-22% deeper than legacy modules) as Darktrace builds customer adoption. Negotiate HEAL aggressively on multi-module deals; it is the module where Darktrace has most commercial flexibility.
Cloud Coverage
Cloud coverage extends DETECT and RESPOND across AWS, Azure, and GCP workloads. Priced per cloud resource unit (a composite of compute instances, containers, and cloud-native services). Cloud coverage competes directly with Microsoft Sentinel, Wiz, Lacework, and Orca Security; pricing here is more competitively pressured than Network coverage.
Benchmark Darktrace against Vectra, ExtraHop, and Microsoft Sentinel
See how your Darktrace ActiveAI Security Platform economics compare against Vectra AI, ExtraHop Reveal(x), Cisco Secure Network Analytics, and Microsoft Sentinel at equivalent scope. 24-hour benchmark across 68+ comparable deployments.
Contact Us →Common Darktrace Contract Traps to Watch For
Auto-Renewal With 90-Day Notice Clauses
Default Darktrace contracts include auto-renewal provisions requiring 90-day written notice to cancel. Missing the notice window extends the contract for another full term, typically at 5-9% price escalation. Procurement teams routinely discover the renewal only after receiving invoice. Negotiate 30-day renewal notice or explicit opt-in renewal.
Asymmetric User-Count True-Up
Standard Darktrace contracts include annual true-up for user count increases at list pricing for the incremental users plus retroactive true-up to contract start. Corresponding downward-adjustment rights on shrinking user counts are typically not included. Negotiate symmetric true-up: either both-directional adjustment or capped user-count bands (for example, 10% bandwidth around subscribed count before true-up triggers).
Module Pricing Non-Proportionality
Module pricing does not scale proportionally with user count. Endpoint and Identity modules particularly scale steeply with user count because they are priced per endpoint or per identity rather than on the same foundation as Network or Email modules. Model multi-module pricing carefully at actual deployment scope rather than assuming proportional scaling from pilot scope.
Professional Services and Managed Service Add-Ons
Darktrace Cyber AI Analyst (the managed detection and response service) and professional services are frequently priced at list without tier-based discount integration into main subscription deals. Negotiate bundled pricing on professional services hours and managed service commitments, or explicit hourly rate disclosure.
Darktrace Renewal Pricing: What Changes and What Does Not
Darktrace renewal behavior is predictable and consistent: per-user and per-module rates escalate 5-9% annually absent negotiation, and renewal often proposes additional module adoption.
What changes at renewal: Per-user rates typically escalate 5-9% annually absent negotiation. Module pricing adjusts to then-current list. Volume discount tier structures may shift as Darktrace repositions volume thresholds. Professional services rates carry forward at then-current list. New modules (HEAL most recently) are proposed as renewal add-ons at modest bundle discount.
What does not change without leverage: Module depth does not improve at renewal absent competitive pressure. Multi-year term benefits carry forward only if renegotiated. Auto-renewal clauses extend unchanged.
What changes with leverage: Written Vectra, ExtraHop, Cisco, and Microsoft Sentinel competitive bids at renewal initiation routinely unlock 8-18% incremental renewal depth. Multi-year renewal commit (3-year vs 1-year) unlocks 8-14% better per-year economics. Module consolidation or rationalization (dropping modules deemed non-essential) provides negotiation leverage. Fiscal Q4 (April-June) timing alignment produces 4-10 points additional discount depth.
Frequently Asked Questions
How much does Darktrace cost for enterprise deployments?
Darktrace ActiveAI Security Platform enterprise annual subscriptions typically range $150,000-$4.8M+ depending on scope. Pricing is driven by user count and modules deployed. Median Fortune 1000 Darktrace subscription is approximately $485,000 annually across 2-3 modules with 10,000-25,000 user coverage.
What discount is achievable on Darktrace?
Darktrace discounts range 18-45% off list depending on deal size, competitive pressure, and fiscal year timing. Typical enterprise discount on strategic deals above $500K list is 28-38%, with 38-45% achievable on multi-module multi-year deals with written Vectra AI, ExtraHop Reveal(x), Cisco Secure Network Analytics, and Microsoft Sentinel competitive bids.
How does Darktrace pricing compare to Vectra AI and ExtraHop?
Darktrace typically prices 12-22% above Vectra AI and 8-18% above ExtraHop Reveal(x) on equivalent NDR scope at list. For pure NDR scope, Vectra and ExtraHop frequently carry tighter pricing; for multi-module platform consolidation, Darktrace pricing becomes competitive when 3+ modules are deployed.
What are common Darktrace contract traps?
Key traps: (1) auto-renewal with 90-day notice clauses, (2) user-count true-up mechanisms that apply annually without corresponding reduction rights, (3) module pricing that scales disproportionately with user count, (4) professional services and managed service add-ons priced at premium. Negotiate 30-day renewal notice, mid-term user-count reduction rights, module-level price caps, and pooled PS hours.
Has Thoma Bravo's acquisition changed Darktrace pricing?
Post-Thoma Bravo acquisition (October 2024), Darktrace commercial motion has modestly tightened on small deals (single-module standalone under $150K) while becoming more aggressive on strategic multi-module platform deals above $500K. Thoma Bravo portfolio playbook typically drives multi-year multi-module consolidation with richer discount depth on platform commitment and tighter discipline on single-module pricing.
Next Steps
Darktrace deals reward fiscal year-end timing (April-June), multi-module bundle consolidation, and written competitive bids from Vectra AI, ExtraHop Reveal(x), Cisco Secure Network Analytics, and Microsoft Sentinel. The worst-priced Darktrace contracts we benchmark share a pattern: mid-fiscal-year execution, single-module standalone deployment without platform view, 90-day auto-renewal clauses unaltered, and no competitive RFP pressure. The best-priced deals do the opposite.
If you are evaluating Darktrace for new purchase, planning a multi-module platform consolidation, or facing a Darktrace renewal within 6-12 months, upload your current proposal or spend summary for a 24-hour benchmark analysis against 68+ comparable enterprise deployments. For comparative context, see our CrowdStrike Falcon pricing guide, Palo Alto Networks pricing guide, Microsoft Sentinel pricing guide, and the Cybersecurity category benchmark.