In 2013, a handful of Cambridge mathematicians and former UK intelligence analysts set out with an odd premise: teach a machine to learn a network's normal "pattern of life," then let it flag anything that breaks the pattern. That premise became Darktrace.
How does Darktrace make money from an idea that started as academic research? Through annual subscription licences, sold and renewed like any modern SaaS business, priced against the size and complexity of the network being defended. That's the short answer. The longer one is a genuinely interesting story about UK deep-tech, a £1.7 billion London listing, a $5.3 billion take-private deal, and a business model that's held up through both.
Meet Darktrace: Cambridge's AI Security Pioneer
Darktrace is a Cambridge-founded AI cybersecurity company that uses self-learning software to detect and autonomously respond to cyber threats, without relying on known attack signatures. It was founded in 2013 by Poppy Gustafsson, Dave Palmer, Emily Orton, Jack Stockdale and Nicole Eagan mathematicians from the University of Cambridge working alongside cyber defence specialists with backgrounds in UK intelligence, seed-funded by Dr Mike Lynch's Invoke Capital.
The company still calls Cambridge home, alongside offices in London, San Francisco and Singapore, and a second R&D centre in The Hague. By 30 June 2024, it counted 9,735 customers, up 10.6% year-over-year and by the time its acquisition closed that October, Darktrace was serving nearly 10,000 organisations with a global team of over 2,300 people.
That's the shape of the business. What made it worth backing at IPO, and buying out four years later, is the pitch underneath it.
The Autonomous Cyber Defence Pitch
Autonomous cyber defence means software that detects and neutralises a threat in real time, without a human analyst approving the response first. Darktrace's founding technology, once branded the "Enterprise Immune System," learns the normal behaviour of every user, device and network inside an organisation, then treats any deviation as a signal worth investigating.
Its flagship response product, Antigena, acts on that signal directly isolating suspicious activity within seconds, rather than waiting for a security team to triage an alert. A companion tool, Cyber AI Analyst, mimics a human investigator, correlating events and writing up incident reports in plain language. Together they're the reason Darktrace gets described as self-defending: the platform doesn't just watch the network, it acts on it.
That's a compelling pitch to a CISO. It's also a genuinely different revenue model from the perimeter-firewall vendors Darktrace grew up competing against, which is where the money question actually gets answered.
How It Makes Money: Subscription Licences by Network Size
How does Darktrace make money, mechanically? Through annual subscription licences priced against the number of devices, IP addresses or users a customer wants monitored, rather than a one-off software sale. It's the Darktrace business model in its simplest form recurring revenue, scaled to the customer's network, renewed and usually upsold every year.
Darktrace doesn't publish list pricing; every quote depends on the modules chosen (network, email, cloud, endpoint, OT), device count, and contract length. Independent buyer benchmarking (Vendr) puts the median annual contract at roughly $55,200, with large-enterprise deals routinely running past $300,000 though these are third-party estimates, not company-disclosed figures, so treat them as a guide rather than gospel.
What Darktrace does disclose, through its old investor filings, tells the clearer story:
That table is the Darktrace business model laid bare: revenue growing roughly in step with customer count and ARR, with a net ARR retention rate of 106.6% at 30 June 2024 meaning existing customers were, on balance, spending more, not less, year over year. Because Darktrace subscription pricing scales with network size rather than seat count, larger customers naturally pay more as they grow, which is exactly what drove ARR from $637.3 million to $782.2 million in a single year. That's Darktrace subscription pricing doing its job: low churn, strong upsell, revenue that compounds without needing to win an entirely new customer every time.
From IPO to Take-Private: The Thoma Bravo Acquisition
Is Darktrace still listed on the London Stock Exchange? No - it floated there on 30 April 2021 at 250p a share, valuing the company at £1.7 billion, before being taken private in October 2024. Shares jumped more than 40% on debut, proof at the time that how does Darktrace make money could sustain a public-market valuation, not just private investor enthusiasm.
It didn't stay public for long. On 26 April 2024, US private equity firm Thoma Bravo agreed to acquire Darktrace for $7.75 a share, an all-cash deal implying an enterprise value of roughly $4.99 billion about 34 times the company's adjusted EBITDA for the year to December 2023. The deal was completed on 1 October 2024, and Darktrace's shares were suspended and delisted from the FTSE 100 the following day.
Darktrace didn't move house. It's still headquartered in Cambridge, still building the same platform it's simply no longer answerable to public shareholders, and now sits inside Thoma Bravo's software portfolio instead.
Darktrace vs Traditional Cybersecurity Vendors
The difference between Darktrace and traditional cybersecurity vendors is that Darktrace's AI learns each customer's own network behaviour, while most legacy tools detect threats by matching activity against known attack signatures. That distinction is the whole basis of the Darktrace business model: sell the learning, not just the lookup table.
It put Darktrace up against a genuinely mixed field Vectra AI in AI-driven network detection, CrowdStrike and Microsoft Defender in endpoint security, Palo Alto Networks' Cortex XSIAM in unified platforms, and legacy players like Cisco. None of them price quite like Darktrace does. That's precisely why Darktrace subscription pricing scaled to network size rather than seat count has held up as customers keep renewing rather than switching.
The Bottom Line
So, how does Darktrace make money, in the end? Through the same subscription-by-network-size model it's used since 2013 recurring revenue, priced on the size of the network being protected, renewed and upsold as customers grow rather than sold once and forgotten. That's Darktrace subscription pricing at its simplest: pay for what you're protecting, renew every year, expand as the network does.
What set Darktrace apart was never the pricing mechanism; plenty of security vendors sell subscriptions. It was building an AI product good enough to make that recurring bet worth renewing, first for public shareholders, and now for Thoma Bravo. The founders' 2013 idea was a machine that learns what "normal" looks like, so it can spot what isn't turned into a business worth $5.3 billion within a decade. Whatever comes next for Darktrace as a private company, that's the model it'll keep running on.
FAQs
1. What is Darktrace?
Darktrace is a Cambridge-founded AI cybersecurity company, established in 2013, that uses self-learning software to detect and autonomously respond to cyber threats. It was founded by Poppy Gustafsson, Dave Palmer, Emily Orton, Jack Stockdale and Nicole Eagan, backed initially by Mike Lynch's Invoke Capital.
2. Is Darktrace still a UK company?
Darktrace is still headquartered in Cambridge, UK, but it's no longer publicly owned. Since Thoma Bravo's $5.3 billion acquisition completed in October 2024, it has operated as a privately held subsidiary of the US private equity firm, delisted from the London Stock Exchange.
3. What is autonomous cyber defence?
Autonomous cyber defence is security software that detects and neutralises threats in real time without waiting for a human analyst to approve the response. Darktrace's Antigena product is a widely cited example, designed to isolate malicious activity within seconds of detection.
Also read: A Record Year for UK Agricultural Technology: Inside the £367m Rush Into Farming's Future
Sources: Darktrace plc investor relations filings and trading updates (2022–2024), Thoma Bravo press releases, London Stock Exchange/MarketScreener disclosures, Wikipedia, Talis Capital, Dealroom, and Vendr buyer benchmarking data. Figures reflect the most recent publicly available data at the time of writing.
The EP+ Editorial Desk covers UK startups, founder stories, and venture capital. All editorial content is independently produced and human-reviewed before publication.
