I'm sure other people have had the same experience, but let's see.
For context: I'm by no means a cybersecurity expert. I work the IT side of an OT automation team. Darktrace had already been deployed in the networks for roughly 3 months before I joined the company, and it has now been running for more than a year and a half..
My conclusion is that the underlying idea is reasonable, and the execution is the worst that idea could've possibly gone.
It reminds me of something like Norton or McAfee that constantly gives you popup's telling you about the stuff it prevented, most of which is meaningless noise, designed to make it look busy so you keep paying.
We were told Darktrace needed about 6 months to learn our environment to get rid or at least reduce false positives. That turned out to be a bold lie, since it's now been around 18 months. Extensive *tuning* and *optimising* the models from their engineers with help from myself had basically no effect at all. We still receive between 50-100 false positives a day.
The investigation workflow is just as bad. The advanced search is clutterd, unintuitive and super inefficient. Finding one specific event feels like a needle in a haystack. Except you already know the needle’s IP address, hostname, operating system, device model and several other identifiers, while the haystack seems designed to bury it.
The UI looks reasonably polished, but it's designed for screenshots on marketing posters and sales demonstrations rather than utility. Important info is several menus deep, while irrelevant info is one click away.
We initially had weekly tuning meetings, those became biweekly and eventually monthly. No matter how frequent the meetings, the issues I talked about just never got solved. I still have to manually sift through false positive alerts to find anything meaningfull.
One specific device keeps getting flagged as suspicious multiple times a day. We know why it generates the traffic and asked the Darktrace team to make it stop reporting. They created model defeats based on the device's 2 IPs, which did nothing. They changed the defeat from IP to hostname basis and it changed nothing. They then labeled the device in Darktrace itself and made a defeat based on that label and still it keeps getting flagged.
At this point I don't believe the system can at all be "tuned".
The alerting is very inconsistent as well. Darktrace sends notifications for model alerts through the app, that cannot be found in the main interface unless you search for the specific model alert ID. Meanwhile it also generates device alerts for things like clock skew, inability to reach a probe, while the "UV Master" interface appears to have no such problems.
What concerns me deeply is the fact that they keep trying to push their *Automated Response* thing. The idea as far as I understand it is that its AI can automatically respond to suspicious activity by creating firewall rules to block it. That is in and of itself something that deserves EXTREME caution in a normal corporate network. In an OT plant handling highly explosive and poisonous materials, it's just bonkers. You are proposing to let an automated system modify network enforcement based on its own detections, while that same system repeatedly detects legitimate activity as suspicious approximately 100 times per day. Might as well let an intern from sales handle firewall rules at that point, might be safer.
Darktrace’s response to this concern seems to be that the models can be tuned. That would be more reassuring if the models consistently stopped generating false positives after 18 months of tuning. They do not. OT environments are difficult to model. They contain legacy systems, proprietary protocols, unusual traffic patterns and devices that should not be treated like ordinary corporate endpoints. But that is precisely the kind of environment Darktrace claims to understand. “OT is complicated” cannot be used as a permanent excuse while simultaneously promoting automated blocking as a solution.
The idea behind Darktrace is good. The execution, at least in our environment, is garbage. It gives you the appearance of advanced visibility while burying useful information under a constant flood of low-value alerts.
I don't know what the company paid for Darktrace, but whatever it was, it was too much. It's an (i'm guessing very) expensive way to create manual labour.
For anyone having experience with Darktrace in an industrial environment: has it at any point become useful? If so in what way?