Global Tool Radar

Security & Privacy / Email Security Software

Darktrace / EMAIL Review, Pricing, Pros & Cons

Darktrace / EMAIL is Darktrace's current cloud-native email security product. It uses Self-Learning AI across inbound, outbound, and lateral communications to detect known and novel threats, provides investigation and autonomous email actions, and supports API-only or API-plus-journaling deployment without rerouting mail flow.

Research by Global Tool Radar Research SystemEvidence checked: Sep 23, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You need behavioral protection against targeted phishing, BEC, impersonation, and novel social engineering: Darktrace / EMAIL learns organization-specific communication patterns and evaluates behavioral, relationship, content, tone, and risk signals rather than depending only on static rules or known attack patterns.
  • You want email security that can support autonomous containment of account-compromise risk: The product page states that Darktrace responds autonomously to compromised credentials, including session termination, re-authentication, and access restriction.
More buying conditions
  • Your organization uses Microsoft 365/Exchange or Google Workspace and needs email-security integrations: Darktrace's integration catalog identifies Google Workspace and Microsoft 365 as integrating with Darktrace/Email.
  • You want to combine technical controls with adaptive, incident-relevant user guidance: The product page describes adaptive training, just-in-time banners, and phishing simulations that adjust to employee behavior and feed outcomes back into the detection model.
Not for
  • Buyers requiring the core email-security purchase to include the separately described DLP add-on automatically: The official DLP solution brief identifies DLP as an add-on module, so core-product entitlement cannot be assumed.
Pricing
  • Sales-assisted product discovery through a demo request. The reviewed exact-product page does not publish purchasable plan terms, public prices, priced units, minimum quantities, billing schedules, or commitment terms.
Free or trial access
  • No permanent free plan or time-limited free trial is stated on the reviewed Darktrace / EMAIL product page. The public entry point presents a demo request.

Product scope

Product functionality and purchase scope

This profile evaluates the current Darktrace / EMAIL email-security product for behavioral email-threat detection, account-compromise response, user-facing risk guidance, and documented email-security integrations. It keeps separately positioned DLP functionality and broader Darktrace platform products outside the core reviewed offer.

Product checked: Sep 23, 2026

Functionality reviewed
  • Behavioral and multi-layered AI analysis of email communication patterns, context, relationships, content, and intent
  • Detection of phishing, business email compromise, executive impersonation, spear-phishing, and novel social-engineering threats
  • Autonomous response for compromised credentials and suspicious email-related risk
  • Adaptive user training, just-in-time banners, and phishing simulations
  • Google Workspace/Gmail and Microsoft 365/Exchange integration
  • Security-operations integrations including Azure Sentinel, Elastic Security, ReliaQuest, and Splunk
Non-target functionality excluded from scoring
  • Darktrace / EMAIL - DLP add-on module
  • Microsoft Teams DLP and collaboration-security functionality where sold or packaged separately
  • Darktrace / IDENTITY and broader SaaS, cloud, endpoint, network, OT, and Secure AI products
  • Managed security services and other Darktrace professional or managed-service offerings

Buying attributes

Comparable purchase facts

Structured facts selected for this software category and supported by the linked public evidence.

Email platforms and deployment
Microsoft 365, Google workspace

Microsoft 365 and Google Workspace are documented as integrating with Darktrace/Email. The reviewed sources do not establish hybrid, on-premises, API-only, mail-flow, or secure-email-gateway deployment as a general current core entitlement.

View source
Threat coverage
Phishing, Impersonation, Business email compromise, Account takeover

Data-loss prevention is excluded from this core-product attribute because Darktrace documents DLP as an add-on module.

View source
Detection techniques
Adaptive multi signal threat detection

The published methodology includes behavioral, contextual, relationship, content, tone, spoofing, exposure, and risk analysis.

View source
Identity and domain security
Account and supplier identity context

This value covers organization-specific relationship and account-behavior context; it does not establish that DMARC is part of the core offer.

View source
Incident response
Automated investigation and remediation

Published autonomous response is described for compromised credentials and account risk; plan-specific response entitlement is not publicly disclosed.

View source
User reporting and training
Adaptive incident linked coaching

The source establishes adaptive training, banners, and phishing simulations, but does not publish commercial package availability.

View source
Integrations and compliance
Security and identity integrations

The reviewed catalog establishes named security-operations and email-platform integrations, not a general API, SOAR, archiving, or compliance-reporting entitlement.

View source
Questions to confirm before purchase
  • Administration and scale
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

Behavioral outbound email data-loss preventionAdd-on

The DLP solution brief explicitly describes this as an add-on module. It should not be assumed to be included in the core Darktrace / EMAIL purchase.

Darktrace / EMAIL - DLP
Official source
Adaptive user training, just-in-time banners, and phishing simulationsIncluded capability

The product page presents these awareness capabilities as adapting to each employee's real behavior and feeding outcomes into the detection model.

Official source
Autonomous response for compromised credentials and account-takeover riskIncluded capability

The current product page describes autonomous response actions including session termination, forced re-authentication, and access restriction.

Official source
Behavioral, relationship, content, and intent analysis for email threatsIncluded capability

Darktrace / EMAIL is described as learning an organization's unique communication patterns and evaluating behavioral anomalies, relationships, content, tone, spoofing indicators, exposure, and risk.

Official source
Detection of phishing, BEC, executive impersonation, and novel social engineeringIncluded capability

The exact-product page and solution brief explicitly identify these threat categories.

Official source
Microsoft 365/Exchange and Google Workspace/Gmail integrationNative integration

The current integration catalog explicitly marks both ecosystems as integrating with Darktrace/Email.

Microsoft 365 and Google Workspace
Official source
SIEM and SOC workflow integrations for Darktrace/Email incidentsThird-party integration

The catalog identifies these third-party platforms as integrating with Darktrace/Email; public information does not establish plan-level entitlements.

Azure Sentinel, Elastic Security, ReliaQuest, and Splunk
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
73%
AI claim confidence
85%
Required-field evidence status
82%
Evidence freshness
100%
Field traceability
100%
Model agreement
95%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 7 of 7 weighted claims have evidence links.
  • 0 A1 documentary official sources and 6 A2 official product sources are linked.
  • 2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • No weighted claim is past the review window.
  • No blocking evidence conflict was identified.
Threat protection efficacy20%
88

Multiple AI layers analyze patterns, anomalies, spoofing indicators, tone, exposure, and risk, and the product is positioned for known and novel threats, which supports high threat-protection efficacy.

Detection accuracy17%
85

The product uses layered behavioral and contextual analysis with social graphing, NLP, Bayesian probability, meta-modelling, and computer vision, but the facts do not publish measured accuracy results, so the score is high but not maximal.

BEC and identity protection15%
93

Darktrace builds unique behavioral profiles from relationships, tone, sentiment, content, and link-sharing patterns and explicitly addresses executive impersonation and account compromise, which strongly supports BEC and identity-related detection.

Response operations14%
87

Autonomous response actions that can terminate sessions and restrict access across email, SaaS, and cloud give security operations a built-in containment path once account compromise is detected.

Platform coverage and deployment13%
71

Microsoft 365, Exchange, and Google Workspace are documented integrations, but the reviewed sources do not establish broader deployment modes such as hybrid, on-premises, API-only, or secure-email-gateway entitlement.

Governance and integrations11%
78

The product is documented with email-platform and security-operations integrations, including Microsoft 365, Google Workspace, Splunk, Elastic Security, Azure Sentinel, and ReliaQuest, which supports governance and ecosystem fit.

Support and total cost10%
37

Absence of public prices, package feature matrices, billing units, and support-term details means total cost and ongoing commercial terms can be established only after a sales-assisted proposal, increasing procurement uncertainty.

Public review signals

Strong behavioral detection with recurring tuning and workflow cautions

Exact-product Gartner Peer Insights and G2 aggregates are favorable overall. Review material commonly values behavior-based detection of phishing, spoofing, BEC, and threats missed by prior gateways, together with autonomous actions and relatively straightforward integration. Recurring cautions include occasional false positives, an initial learning or tuning period, interface complexity, report customization, and uneven support experiences.

Public review signals updated: Aug 12, 2026

Commonly reported strengths

  • Behavioral detection catches phishing, impersonation, and BEC missed by traditional filters
  • Autonomous holding, quarantine, and link actions reduce manual response time
  • API and journaling deployment can be straightforward for Microsoft 365 environments

Commonly reported concerns

  • False positives and the initial learning period can require tuning
  • The console and investigation views can feel complex to new administrators
  • Reporting customization and support responsiveness receive mixed feedback
G24.1/5
Review count
15 reviews
Source context
Darktrace / EMAIL reviews on G2Exact product
View sourceHistory baseline established: Aug 12, 2026
Gartner Peer Insights4.8/5
Rating count
407 ratings
Source context
Darktrace / EMAIL in Email Security on Gartner Peer InsightsExact product
View sourceHistory baseline established: Aug 12, 2026
Score80
Pricing modelSales-assisted product discovery through a demo request. The reviewed exact-product page does not publish purchasable plan terms, public prices, priced units, minimum quantities, billing schedules, or commitment terms.
Use casePhishing and BEC protection
Company sizeEnterprise
Structured tags

Darktrace / EMAIL tag profile

Company size
  • Enterprise
Business function
  • Security operations
Use case
  • Phishing and BEC protection
Integration ecosystem
  • Microsoft 365 and Outlook
  • Google Workspace and Gmail
Key features

Darktrace / EMAIL core capabilities

  • Organization-specific behavioral email analysis
  • Multi-layered AI using social graphing, NLP, Bayesian probability, meta-modelling, computer vision, and autonomous response
  • Phishing, BEC, executive-impersonation, and social-engineering detection
  • Autonomous response to compromised-credential risk
  • Adaptive user training, just-in-time banners, and phishing simulations
  • Microsoft 365, Exchange, Google Workspace, SIEM, and SOC-tool integrations
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • It detects phishing, BEC, executive impersonation, spear-phishing, account compromise, and other social-engineering threats using organization-specific behavioral analysis.
  • It supports autonomous response actions for compromised-credential risk, including terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud.
  • It includes adaptive training, just-in-time banners, and phishing simulations that adjust to employee behavior and feed outcomes back into the detection model.
  • It documents integrations for Microsoft 365, including Exchange, and Google Workspace, along with named security-operations tools such as Splunk, Elastic Security, Azure Sentinel, and ReliaQuest.
Cons

What to confirm before buying

  • The reviewed product page does not publish exact-product pricing, billing cadence, commitment terms, or a purchasable plan matrix, so commercial scope must be confirmed in a demo-led proposal.
  • Darktrace references Core, Advanced, and Complete packaging, but the reviewed resource does not map those package names to specific entitlements or prices.
  • Data-loss prevention is described as an add-on module, so buyers should not assume outbound DLP is included in the base email-security purchase.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 23, 2026

Score comparisonGPTxAIRange
Threat protection efficacy90864
Detection accuracy89809
BEC and identity protection94913
Response operations86871
Platform coverage and deployment68746
Governance and integrations847212
Support and total cost35383
email phishing bec detection95923
email malware url protection704822
email policy quarantine control604218
email incident response workflow88880
email delivery user experience72684
Where models differ
  • email malware url protection: 48–70 (22-point range)
  • email policy quarantine control: 42–60 (18-point range)
  • Governance and integrations: 72–84 (12-point range)
GPTAI-assisted buyer perspective78

Darktrace / EMAIL is a fit for organizations that want cloud email security for Microsoft 365 or Google Workspace with behavioral detection, autonomous account-risk response, and adaptive user coaching, but buyers should confirm exact package entitlements and separate DLP scope in the commercial proposal.

Review confidence
78/100
Model details
Strengths
  • It detects phishing, BEC, executive impersonation, spear-phishing, account compromise, and other social-engineering threats using organization-specific behavioral analysis.
  • It supports autonomous response actions for compromised-credential risk, including terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud.
  • It includes adaptive training, just-in-time banners, and phishing simulations that adjust to employee behavior and feed outcomes back into the detection model.
  • It documents integrations for Microsoft 365, including Exchange, and Google Workspace, along with named security-operations tools such as Splunk, Elastic Security, Azure Sentinel, and ReliaQuest.
Cautions
  • The reviewed product page does not publish exact-product pricing, billing cadence, commitment terms, or a purchasable plan matrix, so commercial scope must be confirmed in a demo-led proposal.
  • Darktrace references Core, Advanced, and Complete packaging, but the reviewed resource does not map those package names to specific entitlements or prices.
  • Data-loss prevention is described as an add-on module, so buyers should not assume outbound DLP is included in the base email-security purchase.
xAIAI-assisted buyer perspective72

Darktrace / EMAIL suits security teams that need behavioral multi-layered AI for phishing, BEC, executive impersonation, and account-compromise response on Microsoft 365 or Google Workspace, provided a sales proposal clarifies package scope and any separate DLP add-on.

Review confidence
72/100
Model details
Strengths
  • Multi-layered AI evaluates communication patterns, behavioral anomalies, spoofing indicators, tone, exposure, and risk to catch phishing, BEC, executive impersonation, spear-phishing, and novel social-engineering threats across inbound, outbound, and lateral mail.
  • When credentials are compromised the product can respond autonomously by terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud.
  • Adaptive training, just-in-time banners, and phishing simulations adjust to each employee’s real behavior and feed outcomes back into the detection model.
  • Documented integrations cover Microsoft 365 including Exchange, Google Workspace including Gmail, and security-operations tools such as Azure Sentinel, Splunk, Elastic Security, and ReliaQuest.
Cautions
  • No public exact-product price, priced unit, billing cadence, minimum quantity, or commitment term is published, so buyers must obtain a direct commercial proposal.
  • Packaging is described as scaling from Core through Advanced and Complete without a published package-to-feature or package-to-price matrix.
  • Data-loss prevention is documented as an add-on module and should not be assumed inside the core email-security purchase.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
6
Broad product review sources
2
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Sep 23, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free plan or time-limited free trial is stated on the reviewed Darktrace / EMAIL product page. The public entry point presents a demo request.
  • Sales-assisted product discovery through a demo request. The reviewed exact-product page does not publish purchasable plan terms, public prices, priced units, minimum quantities, billing schedules, or commitment terms.
  • Organization-specific behavioral email analysis Multi-layered AI using social graphing, NLP, Bayesian probability, meta-modelling, computer vision, and autonomous response Phishing, BEC, executive-impersonation, and social-engineering detection Autonomous response to compromised-credential risk Adaptive user training, just-in-time banners, and phishing simulations Microsoft 365, Exchange, Google Workspace, SIEM, and SOC-tool integrations
  • Darktrace / EMAIL has no publicly displayed exact-product price or commercial plan matrix on the reviewed product page. Darktrace describes packaging that scales from Core through Advanced and Complete in an exact-product resource, but it does not publicly bind feature coverage, pricing, or purchase terms to those package names.
Verification notes and unresolved itemsThe current exact-product page was publicly accessible and used as the primary scope and commercial-disclosure source.
  • It includes some generic placeholder text, which was not used as evidence.
  • The page does not provide public pricing or a purchasable plan ladder.
  • Although an exact-product resource references Core, Advanced, and Complete packaging, it does not establish that these are separately purchasable current editions with defined features or prices
  • therefore they are not returned as pricing plans.
Sources checked

Sources checked

Darktrace / EMAIL source links

Darktrace / EMAIL - DLP Solution BriefDarktraceLevel A2Linked to 1 scored claimChecked Sep 23, 2026
Data Loss PreventionDarktraceLevel A2Linked to 1 scored claimChecked Sep 23, 2026
Integrations | Darktrace/EmailDarktraceLevel A2Linked to 1 scored claimChecked Sep 23, 2026
At a Glance: Inside Darktrace / EMAIL’s Multi-Layered AIDarktraceLevel A2Linked to 1 scored claimChecked Sep 23, 2026
Darktrace / EMAIL Solution BriefDarktraceLevel A2Linked to 1 scored claimChecked Sep 23, 2026
AI-Based Email Security Software | Email Threat ProtectionDarktraceLevel A2Linked to 4 scored claimsChecked Sep 23, 2026

FAQ

Darktrace / EMAIL FAQ

Does Darktrace / EMAIL publish public pricing?

No public exact-product price, plan card, priced unit, billing cadence, or commitment term is shown on the reviewed product page. The page directs prospective buyers to request a demo.

What threats does the core product describe?

Darktrace / EMAIL describes protection for phishing, BEC, executive impersonation, spear-phishing, account compromise, and novel social-engineering threats.

Which cloud email ecosystems are documented?

The current integration catalog identifies Microsoft 365, including Exchange, and Google Workspace, including Gmail, as integrating with Darktrace/Email.

Is data loss prevention included in the core product?

Do not assume so. Darktrace's DLP solution brief identifies its DLP capability as an add-on module.

Does Darktrace / EMAIL include user-awareness capabilities?

The product page describes adaptive training, just-in-time banners, and phishing simulations that adapt to employee behavior.

Popular comparisons

Common Darktrace / EMAIL comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Darktrace / EMAILvsCisco Secure Email Threat Defense
80Gap 080

Enterprise / Mid-market

VS #2
Darktrace / EMAILvsAbnormal Security
80Gap 383

Enterprise / Mid-market

VS #3
Darktrace / EMAILvsMimecast Advanced Email Security
80Gap 278

Enterprise / Mid-market / Small business