Darktrace has unveiled upgraded features for its patented Cyber AI Analyst, an autonomous system that conducts comprehensive investigations and prioritizes security alerts. The enhancements—driven by newly introduced proprietary machine learning models—boost threat detection, streamline investigations, and improve alert triage, empowering security teams with more detailed insights and quicker response capabilities.
First introduced in 2019, Cyber AI Analyst, is a pioneering agentic AI system that mirrors the human investigative process – it can question data, test hypotheses, and reach conclusions without human intervention. Using a combination of advanced AI techniques including unsupervised machine learning, models trained on expert cyber analysts, and custom security-specific language models, Cyber AI Analyst autonomously investigates and triages alerts at machine speed and scale, mimicking human reasoning to form hypotheses, correlate seemingly unrelated events, and generate transparent and interpretable AI insights with complete incident reports within minutes. By investigating all relevant alerts from Darktrace and third-party security tools, and surfacing only the most impactful threats, Cyber AI Analyst dramatically streamlines the alert triage and prioritization process, giving security teams more time to focus on what matters. Cyber AI Analyst provides SOCs with the equivalent of up to 30 additional full time employees performing Level 2 analysis and written reporting annually.
Introducing Next-Generation AI Models for Cybersecurity
The continued growth of cybercrime-as-a-service models, combined with the rising use of offensive AI, is increasing the speed, scale and sophistication of cyber attacks. Security teams are facing a relentless flood of alerts—leaving incidents uninvestigated, increasing alert fatigue, and heightening the risk of missed threats. With the shortage of skilled cyber professionals continuing to grow, organizations are increasingly turning to AI-powered tools to enhance efficiency in the SOC; 88% of security professionals believe that the use of AI is critical to freeing up time for teams to become more proactive according to Darktrace’s 2025 State of AI Cybersecurity report. To further help uplift security teams, Darktrace is introducing two next-generation AI models for cybersecurity within Cyber AI Analyst, including:
- Darktrace Incident Graph Evaluation for Security Threats (DIGEST): Using graph neural networks, this new model predicts which security incidents are most likely to escalate into major compromises by analyzing the structure and progression of attacks to spot early indicators of high-risk threats. DIGEST enables security teams to detect critical threats sooner and prioritize the incidents that matter most.
- Darktrace Embedding Model for Investigation of Security Threats – Version 2 (DEMIST-2): This third-generation proprietary language model is specifically trained for cybersecurity use cases. It has deeper contextual understanding of security data, and is able to perform multiple, distinct complex tasks like accurately assessing hostnames, understanding the sensitivity of file names, and precise tracking of users and entities across multiple domains. This automates complex security tasks, reduces manual analysis time and improves incident correlation – helping SOC teams respond faster. DEMIST-2 can be deployed anywhere and outperforms comparable models that are much larger in size, delivering resource efficiency with superior performance.
Uplifting teams while improving productivity and cyber resilience
Customers in a variety of industries across the globe rely on Darktrace’s Cyber AI Analyst to scale security operations, taking on time consuming tasks to free team members for more strategic work.
Michael Toland, CISO for the State of Oklahoma said, “Having Cyber AI Analyst has helped the State of Oklahoma triage and prioritize all relevant alerts, even those from third party security tools, empowering the lean IT team to ‘clear the table’ of critical alerts every day.” Over a 30-day period, Cyber AI Analyst analyzed 3,142 alerts into162 incidents, identifying only 18 as critical and providing a potential 2,561 hours in investigation time.
The security team at South Coast Water District, a critical infrastructure organization in California, reports that while it would previously have taken three hours to figure out the severity of an alert, Cyber AI Analyst has decreased that time to merely 20 minutes. With water system access for the public on the line, that’s a critical time saving. “Instead of looking at all the data everywhere, Cyber AI Analyst tells you where the issues might be so you can figure it out,” said Bryon Black, IT manager, South Coast Water District.
“Security teams are increasingly overwhelmed — facing not just a surge in alerts, but adversaries that are faster, stealthier, and more sophisticated. To meet this challenge, we’ve augmented Cyber AI Analyst with two additional machine learning models. Unlike the foundational LLMs that underlie many generative and agentic systems, these models are purpose-built for cybersecurity and bring greater precision and depth of analysis into the SOC. By understanding how attacks evolve and predicting which threats are most likely to escalate, these models enable earlier detection, sharper prioritization, and faster, more confident decision-making,” said Tim Bazalgette, Chief AI Officer, Darktrace. “Empowering defenders with AI has never been more critical and we remain committed to driving innovation that helps our customers proactively reduce risk, strengthen their security posture, and uplift their teams.”
For more information on Darktrace’s Cyber AI Analyst, download the solution brief here.
Related News:
Darktrace Report: 78% of CISOs See Growing Impact of AI Cyber Threats
Darktrace 2024 Threat Report Uncovers Rising MaaS Threats & Evasion Tactics
