Most engineers think…
Most people picture automated response as 'the tool detects something bad and blocks the device'. That mental model is exactly why automated blocking gets switched off — a blunt block breaks legitimate work, so nobody trusts it to run on its own.
Darktrace Autonomous Response is different because it acts from the device's learned pattern of life. Instead of nuking the whole device, it does the minimum needed — block just the anomalous connection, or enforce what is normal for that device while stopping what isn't. Because the action is grounded in the device's own normal, it is precise enough to run autonomously and in seconds, which is what finally makes automation safe enough to leave on — even at 2am with nobody watching.
① The automation dilemma — why blunt blocking gets switched off
Everyone wants the security tool to just stop the attack automatically. The problem is that traditional automated blocking is too blunt: 'block the whole device', 'cut the user off', 'quarantine the host'. When that fires on a false positive — or on a real threat that shares a device with real work — it breaks the business. So after a few painful outages, teams quietly turn automation off and go back to manual response, which is slow.
Darktrace Autonomous Response (the capability formerly branded Antigena Network) is built to escape that trade-off. It takes targeted action to neutralise an in-progress threat without disrupting normal business. The detection layer (NDR) flags the anomaly; Autonomous Response then works out the smallest action that stops it while leaving legitimate activity alone.
Why do teams often disable traditional automated blocking?
② Proportionate, surgical action — from the pattern of life
The defining idea is proportionate, surgical action derived from the device's learned pattern of life. Darktrace already knows what normal looks like for that device, so it does the minimum needed rather than a blanket block.
The four main actions
In practice that means one of: block only the specific anomalous connection; enforce the pattern of life (allow everything that is normal for the device, stop only what isn't); block a specific port or destination; or quarantine the device — the heaviest action, used only if it is genuinely necessary. Legitimate activity keeps working throughout.
This precision is the whole point. Traditional blocking is risky because it is blunt; Darktrace's actions are precise enough to run autonomously because they are based on the device's own normal. That is what makes safe automation possible.
Formerly Antigena Network. Takes targeted action to neutralise an in-progress threat without disrupting normal business — the actuator that stops the attack.
The per-device, per-user model of normal that Self-Learning AI builds. The source of truth for what to allow and what to stop.
The minimum needed — block just the bad connection or enforce normal — instead of blunt-blocking the whole device. Precision is what makes autonomy safe.
Confirmation mode = an analyst approves each action. Fully autonomous = it acts on its own. Phase it in, often off-hours first.
In an interview, frame Autonomous Response as proportionate action from the pattern of life: it does the minimum that neutralises the threat — block one connection or enforce normal — not a blanket block. That precision is the reason it can be left running autonomously.
What is Darktrace's surgical, proportionate action derived from?
③ Speed, modes and enforcement — how the action lands
Speed is the headline. Autonomous Response acts in seconds. That matters enormously for fast-moving attacks like ransomware, and for out-of-hours and weekend incidents when no analyst is watching the console — exactly when a manual process fails.
Modes and enforcement
You choose how much autonomy to give it. In human-confirmation mode an analyst approves each proposed action; in fully autonomous mode it acts on its own. You can phase it in — start with confirmation, then widen autonomy as trust builds, often turning on full autonomy for off-hours first.
For the action itself, Autonomous Response can enforce natively (Darktrace itself drops or limits the connection) or push the action out via integrations with firewalls, NAC and EDR — so it fits the controls you already run.
Saying Autonomous Response simply blocks or quarantines the host misses the point and sounds like the blunt tools teams disable. Quarantine is the last resort; the usual action is blocking the specific anomalous connection or enforcing the device's pattern of life so normal work continues.
▶ Watch ransomware get stopped surgically at 2am
How a compromised device is contained without breaking normal traffic. Press Play for the healthy path, then Break it to see the classic failure.
Ransomware starts spreading at 2am on a weekend with nobody on shift. Which setting lets Autonomous Response stop it itself?
④ Rolling it out safely — and how it pairs up
A safe rollout is a trust dial, not a switch. Start in human-confirmation mode so the team sees the proposed actions and learns to trust them. Then enable fully autonomous action where the risk of waiting is highest — off-hours and weekends, and for high-confidence, fast-spreading threats like ransomware — before widening it across the day.
How it pairs up
Autonomous Response does not work alone. NDR detection spots the anomaly and is the trigger; Autonomous Response takes the surgical action; and Cyber AI Analyst investigates and triages afterwards, explaining what happened so the team has the story by morning.
The pitfall to avoid: deploying it but leaving it in confirmation-only mode with nobody on shift to confirm. Then a 2am ransomware breach just waits for an approval that never comes — and spreads. Match the autonomy to when humans are actually watching.
Sneha at Meridian Logistics in Hyderabad faces this
At 2am on a Saturday a finance workstation starts encrypting file shares over SMB and beaconing to an unknown external host; by Monday several shares are partly encrypted.
Autonomous Response was deployed but left in human-confirmation-only mode with no autonomy for off-hours, so the recommended action sat waiting for an approval that never came.
The model breach and the proposed Autonomous Response action are both visible, timestamped 02:01 — but the action status is 'pending confirmation' and autonomy is disabled outside business hours.
Darktrace ▸ Model breach ▸ Autonomous Response ▸ action status & autonomy scheduleEnable fully autonomous mode for the off-hours / weekend window and for high-confidence ransomware-type breaches, so it can enforce the device's pattern of life immediately — blocking the malicious SMB writes and the C2 connection while leaving normal traffic alone.
Re-test with a controlled out-of-hours simulation: the action fires in seconds with no analyst, the malicious connections stop, normal traffic continues, and Cyber AI Analyst produces the investigation summary for Monday review.
Don't assume autonomy is on when it counts. Run a controlled simulation during the off-hours window and confirm in the console that the action fires in seconds with no analyst, the threat is contained, and Cyber AI Analyst produces the investigation. That single test answers 'will it actually act at 2am?'.
What is the classic pitfall when rolling out Autonomous Response?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why can Darktrace leave automated response switched on when most teams have to switch theirs off? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Autonomous Response
- Darktrace capability (formerly Antigena Network / RESPOND) that takes targeted action to neutralise an in-progress threat without disrupting normal business.
- Pattern of life
- The per-device, per-user model of normal behaviour built by Darktrace Self-Learning AI; the source of truth for what to allow and what to stop.
- Proportionate / surgical action
- Doing the minimum needed to stop a threat — block one connection or enforce normal — instead of blunt-blocking the whole device.
- Enforce pattern of life
- An action mode that allows a device's normal traffic while stopping only the anomalous parts.
- Human-confirmation mode
- A mode where an analyst approves each proposed Autonomous Response action before it executes.
- Fully autonomous mode
- A mode where Autonomous Response acts on its own, in seconds, without waiting for human approval.
- Quarantine
- A heavier action that isolates a device from the network; used only when genuinely necessary, not as the default.
- NDR
- Network Detection and Response — the detection layer that flags the anomaly Autonomous Response acts on.
- Cyber AI Analyst
- Darktrace's automated investigation and triage that explains an incident after the action is taken.
📚 Sources
- Darktrace — Autonomous Response product overview. darktrace.com
- Darktrace — Antigena Network / RESPOND: network autonomous response. darktrace.com
- Darktrace — Self-Learning AI and the device 'pattern of life'. darktrace.com
- Darktrace — Stopping ransomware in seconds with Autonomous Response. darktrace.com
- Darktrace — Autonomous Response integrations with firewalls, NAC and EDR. darktrace.com
- Darktrace — Cyber AI Analyst: automated investigation and triage. darktrace.com
What's next?
Got how the action works? Next, go deep on Cyber AI Analyst — Darktrace's automated investigation and triage that explains what happened, stitches the events into one incident, and writes the analyst's report for you.