Try our new research platform with insights from 80,000+ expert users

Abnormal Security vs Darktrace comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 27, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Abnormal Security
Ranking in Email Security
3rd
Average Rating
9.6
Reviews Sentiment
7.9
Number of Reviews
10
Ranking in other categories
Secure Email Gateway (SEG) (2nd)
Darktrace
Ranking in Email Security
8th
Average Rating
8.2
Reviews Sentiment
7.2
Number of Reviews
82
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (1st), Network Traffic Analysis (NTA) (1st), Network Detection and Response (NDR) (1st), Extended Detection and Response (XDR) (6th), Cloud Security Posture Management (CSPM) (15th), Cloud-Native Application Protection Platforms (CNAPP) (11th), Attack Surface Management (ASM) (4th), AI-Powered Cybersecurity Platforms (2nd)
 

Mindshare comparison

As of August 2025, in the Email Security category, the mindshare of Abnormal Security is 7.4%, up from 4.4% compared to the previous year. The mindshare of Darktrace is 2.9%, up from 1.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Email Security
 

Featured Reviews

ChrisBrown5 - PeerSpot reviewer
Automated threat detection that protects against corruption with minimal intervention
Abnormal Security is valuable because it features an automated scoring tool that doesn't require much intervention from our team. It enhances threat detection capabilities by making the process automated and is easy to scale to our entire environment. Additionally, it protects us from being business email compromised, which is invaluable for maintaining our security.
Malebo Lethoba Group - PeerSpot reviewer
Have found the AI analyst and detection functions highly valuable for network operations while managing complexity in initial setup
The functions I find most valuable in Darktrace are the AI analyst as well as the detection.The autonomous response capabilities of Darktrace are not crucial for me because it doesn't work in a network where there are no core switches. In a modern network, the autonomous response doesn't work, especially when sitting in a shared data center.If I'm running a traditional network where I am not in a shared data center with a layer two dedicated for my resources, then it can work for me. However, if I am in a data center where I don't have layer two, it becomes an issue because the autonomous response is reliant on sending spoofed TCP resets to my core switch to block traffic, which is a major issue.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What I like about Abnormal Security is that it notifies me if any of my partners or suppliers are experiencing a security breach by analyzing their database and identifying potential cyber threats."
"Their ability to take things out of the mailbox and catch things much faster than users is excellent."
"It does some really cool stuff that other tools aren't doing. We found it to be really effective, and the AI/ML functionality is really what differentiates them."
"Initial auto-remediation allows us to auto-remediate before the email lands in the end user's inbox for a split second."
"The features that appeal to me most are the combination of auto-remediation and Detection 360."
"Ease of use is undoubtedly one of the most valuable features of Abnormal Security."
"I like Abnormal's threat protection with auto-remediation, but I also love its abuse mailbox feature, which automatically responds to the end user. That feature has a super-valuable security component and helps improve the user experience."
"One of the things that I love about them is that the setup and installation are super easy. All you do is give them access to your Microsoft 365 tenant, and through APIs, they are able to do their work. They are doing all this through APIs, so you do not have to install the software and take a month to get it all set up to even see the value of the solution. You could be up and running in less than an hour."
"It is very easy to work with Darktrace once you know how it works and the type of permissions that you need to get related to the security over a network. The interface is awesome. I'm sure that you have seen Ironman, and you know Jarvis, the computer of Tony Stark. The interface of Darktrace is very similar, and you can see in 3D, like a hologram, the whole network, traffic, and all the traces inside the network. The interface is awesome, and it provides a lot of information. At least for us, it is very easy to handle this interface, get the reports, and do the interpretation of those reports. Darktrace also provides mobile monitoring. With an app on your mobile phone, you can view the information live, which is very useful for area directors and field engineers. Darktrace can be also correlated with any type of big data solution, such as Splunk."
"The most valuable features of Darktrace are the tracing of unusual external emails and monitoring the local network."
"Darktrace's most valuable features are that it understands the network environment and is able to trace the traffic and alert on anomalies."
"The most valuable feature has been the behavioral analytics that allows us to monitor all the traffic."
"I have found the most valuable features to be artificial intelligence for cybersecurity, advanced machine learning capabilities, enterprise Immune System, Antigena Network, and Antigena Email. The way the solution detects the threat over the network before it spreads is very good. It notifies you of what the threat is exactly doing and gives you all the details about the execution of that application that had created the threat over your network."
"I am impressed with the product's ability to give insights into network traffic."
"Provides great network protection."
"I particularly like Antigena and the analytics around the real-time monitoring of our network. I also like its reporting because it has got a seven-day reporting period within the system. Every time you run the reports, it gives you the data about the previous seven days. I like that because it is in real-time. I enjoy reading those reports and getting a very clear and decisive idea of what's happening on my network on a real-time basis. I like the actual real-time monitoring of spoofing and things like that. I also like the user monitoring as well as the network logging capabilities."
 

Cons

"There could be more selectable options and more granular selections available."
"I, as such, do not have anything that I do not like or would like to add, but you could argue that because they are doing it API-based, there is a chance that something could slip through temporarily before they are able to pull it out. In theory, it could happen just because of the nature of the system. They are not in line with the delivery of the mail. They are kind of asynchronous, which is a pro as well as a con. If it is synchronous, then I know it would always stop them, but because it is asynchronous, things could get through temporarily or because of some system issues on the Microsoft side or their side. It is the nature of the beast, but it is a little bit of a con."
"The biggest pain point for us is the lack of support for on-premise email systems."
"When we're working on something as engineers, and we find an idea or a method of doing something that would be greatly improved by doing it another way, there should be an ability for me to click the ideas button, type in an idea that I have, and submit it to a product review team or developers to have them think through the process a little bit more."
"There could be room for improvement in enhancing integration with other cybersecurity tools."
"I would like to have the ability to customize the auto-remediation feature."
"The pricing for academic institutions and student mailboxes is challenging."
"The ideal scenario would be for Abnormal Security to work in tandem with Microsoft to analyze incoming emails."
"They just need to work on their price. In terms of features, we are trying to understand all the features that we have. We're still exploring everything that we have so that we can fully utilize it. At this point in time, it is not about the features. It is more about utilization. We're just trying to utilize everything to full capacity."
"The dashboard and reporting for this solution could be improved as it is currently complex. The GUI for this solution could also be improved."
"The solution would benefit from automation. Currently, you have to know what you are searching for."
"The program is quite expensive."
"I was under impression that Darktrace's automatic blocking would be an out-of-the-box feature, but we had to integrate it with our firewall to get it to block automatically. The salesperson should be upfront and explain that you need to integrate it with your network. I would also like to see more reporting on risk. Banks in my region want to see at a glance the risk level of various assets."
"The management dashboards and the meter dashboards should be more user-friendly and simple to use for easy management."
"I would like for the product to work on the endpoints as well. I would like to see enhanced visibility into the endpoints and network but this solution only sits on the network itself."
"It is expensive, but everything else has been great so far."
 

Pricing and Cost Advice

"The license is based on the user count, so the number of users that have an email address in the organization."
"Overall, we'd certainly prefer lower pricing, but Abnormal Security doesn't seem unreasonable compared to similar offerings in the market."
"Abnormal Security, on the other hand, provides the same level of functionality for just over $60,000 – that's half the price!"
"The pricing appears fair, and they demonstrate a genuine willingness to work with us on it."
"The pricing is quite high, estimated at around $350,000 per year."
"The cost of the solution is expensive for smaller businesses. They will not be able to afford it or might not need this type of security solution."
"It was $3,600 a month or $2,000 plus or so. I am not sure. Its licensing is pretty simple."
"The pricing is reasonable."
"The pricing is very flexible for Darktrace. Sometimes, a customer does not have the appropriate budget, but Darktrace can handle that. They offer monthly payments, so the customer can acquire the solution very easily."
"The pricing is expensive. It costs over $100,000 a year."
"The price of the solution is not cheap. It is not a one-time purchase, there is a subscription that needs to be paid every one to five years depending on your choice. It is expensive but you can reduce the price by only using the services that you want."
"There is an annual license to use Darktrace."
report
Use our free recommendation engine to learn which Email Security solutions are best for your needs.
865,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
9%
Manufacturing Company
7%
Government
7%
Computer Software Company
13%
Manufacturing Company
9%
Financial Services Firm
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Abnormal Security?
The features that appeal to me most are the combination of auto-remediation and Detection 360.
What is your experience regarding pricing and costs for Abnormal Security?
I find the pricing to be favorable, but I did not disclose the exact cost.
What needs improvement with Abnormal Security?
There could be more selectable options and more granular selections available.
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing user interface that makes setup easy and seamless. CrowdStrike Falcon offers a cl...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is meant for smaller to medium-sized businesses. It is also a good option for organ...
What do you like most about Darktrace?
A very useful feature in Darktrace for real-time threat analysis is the packet inspection that analyzes the packet traffic in real time.
 

Overview

 

Sample Customers

Foot Lcoker, Xerox, Liberty Mutual, Mattel, Boston Scientific
Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.
Find out what your peers are saying about Abnormal Security vs. Darktrace and other solutions. Updated: July 2025.
865,295 professionals have used our research since 2012.