Common interview slip
A lot of candidates say 'Darktrace is just another IPS that matches signatures and blocks bad traffic'. That answer sinks a Darktrace interview straight away.
Darktrace is built on Self-Learning AI: it uses mostly unsupervised machine learning to learn the normal pattern of life for every device, user and the organisation, then flags meaningful deviations from that normal — no signatures, no rules and no threat feeds required to detect. Because it models normal rather than known-bad, it catches novel, zero-day and insider threats that signature tools miss. It all lives on the ActiveAI Security Platform — coverage modules (/ NETWORK, / EMAIL, / CLOUD, / OT, / IDENTITY, / ENDPOINT) plus cross-platform Cyber AI Analyst, Autonomous Response and Proactive Exposure Management. Knowing that distinction is exactly what interviewers test.
① Self-Learning AI & the ActiveAI platform — modelling normal, not known-bad
Q: What is Darktrace's Self-Learning AI, and how is it different from signatures?
Model answer: Darktrace uses Self-Learning AI — mostly unsupervised machine learning — to learn the normal pattern of life for every device, user and the organisation as a whole. It then flags meaningful deviations from that learned normal. A signature tool only catches what someone has already written a rule for; Darktrace models normal, so it catches novel and zero-day attacks and insider threats with no threat feeds required. The clean one-liner: signatures match known-bad, Self-Learning AI learns your normal and flags the unusual.
Q: Where does the 'Enterprise Immune System' name fit?
Model answer: That was Darktrace's original framing — an analogy to the human immune system, which learns 'self' and reacts to 'not-self'. The technology is the same idea (learn normal, react to abnormal); the current branding is Self-Learning AI. If an interviewer uses the old term, show you know it is the same self-vs-not-self concept now called Self-Learning AI.
Q: Walk me through the ActiveAI Security Platform.
Model answer: One platform with two layers. The coverage modules watch each domain: Darktrace / NETWORK (NDR), / EMAIL, / CLOUD, / OT, / IDENTITY and / ENDPOINT. Across all of them sit the cross-platform capabilities: Cyber AI Analyst (autonomous investigation and triage), Autonomous Response (formerly Antigena — proportionate action), and Proactive Exposure Management (formerly PREVENT — attack-path modelling and attack surface management). Modules detect; the cross-platform layer investigates, responds and hardens.
When asked what Darktrace is, anchor your answer with 'Self-Learning AI that learns each device and user's normal pattern of life and flags deviations — no signatures or threat feeds, so it catches novel and insider threats'. That one line proves you understand the core idea, not just the brand name.
What does Darktrace's Self-Learning AI model in order to detect threats?
② Darktrace / NETWORK — passive NDR, encrypted traffic and deployment
Q: How does Darktrace / NETWORK do NDR, and how is it deployed?
Model answer: Darktrace / NETWORK is Network Detection and Response. It is deployed passively, out-of-band — it watches a copy of traffic from a SPAN port or a network TAP, so it adds no inline latency and cannot break traffic by being in the path. It learns the pattern of life on the wire and detects C2 beaconing, lateral movement, data exfiltration and the early stages of ransomware. Deployment is a master appliance (physical, virtual or cloud) with probes, plus cSensors for cloud and osSensors on hosts; data can stay on-prem, and you investigate in the Threat Visualizer.
Q: Can it see threats in encrypted traffic?
Model answer: Yes — without decrypting it. Darktrace analyses behaviour and metadata: who talks to whom, how often, volumes, timing, and how rare or unusual the connection is for that device. A beacon to a never-before-seen destination on an odd schedule stands out even when the payload is encrypted. So it does not need to decrypt to spot the anomaly — a strong point to make versus tools that depend on payload inspection.
Q: NDR vs a traditional IDS/IPS — what is the difference?
Model answer: An IDS/IPS is signature-based and often inline — it matches known-bad patterns and can block in the path. NDR here is behavioural and passive — it learns normal and flags deviations from a SPAN/TAP, so it sees novel and insider activity an IPS would miss and never adds latency. The interview line: IPS matches signatures inline; NDR learns normal and detects behaviourally, out-of-band.
Mostly unsupervised machine learning that learns each device and user's normal pattern of life and flags deviations — no signatures or threat feeds needed, so it catches novel and insider threats.
The NDR module. Deployed passively out-of-band via a SPAN port or TAP — no inline latency. Detects C2 beaconing, lateral movement, exfiltration and early ransomware, including in encrypted traffic by metadata.
Formerly Antigena. Takes proportionate, surgical action from the learned normal — blocks just the malicious connection or enforces the pattern of life — in seconds, in human-confirm or autonomous mode, natively or via firewall/NAC/EDR.
Automates Tier-1/2 investigation: correlates related anomalies into one investigated incident with a severity and a natural-language report, cutting triage time and alert fatigue.
Your network team worries a new monitoring tool will add latency or break traffic. How is Darktrace / NETWORK deployed to avoid that?
③ Autonomous Response & Cyber AI Analyst — surgical action and automated triage
Q: What is Autonomous Response and how is it different from a normal block?
Model answer: Autonomous Response (formerly Antigena) takes proportionate, surgical action derived from the learned normal. Instead of a blunt 'shut the whole host down', it can block just the one malicious connection or enforce that device's normal pattern of life — stopping the bad behaviour while legitimate work continues. It acts in seconds, runs in human-confirmation or fully autonomous mode, and can enforce natively or by integrating with your firewall, NAC or EDR. The contrast to draw: a traditional block is blunt and breaks the business; Autonomous Response is targeted because it knows what normal looks like.
Q: What does Cyber AI Analyst do?
Model answer: Cyber AI Analyst automates the Tier-1 and Tier-2 investigation that a human analyst would otherwise do by hand. It correlates related anomalies across the environment into a single investigated incident, assigns a severity, and writes a natural-language report of what happened and why it matters. The payoff is less alert fatigue and far shorter triage time — analysts open one investigated incident instead of stitching together dozens of raw alerts.
Q: How do these two work together on a live threat?
Model answer: A model breach fires on / NETWORK (say, a beacon). Cyber AI Analyst investigates, links it to related anomalies, and raises an investigated incident with a severity and a plain-English summary. If the device's behaviour is clearly malicious, Autonomous Response can hold or block just that connection in seconds — automatically out of hours, or pending an analyst's click in human-confirmation mode. Detect, investigate, respond — all from the learned normal.
A classic error is describing Autonomous Response as a blunt kill-switch. It does not slam the whole host off by default — it takes proportionate action from the learned normal, often blocking just the malicious connection or enforcing the pattern of life. Calling it a blunt block misses the whole point and is a red flag in a Darktrace interview.
▶ Watch Darktrace catch a beacon — and find why a response is missed
Step through how an anomaly becomes an investigated incident and a surgical response. Press Play for the healthy path, then Break it to see the classic out-of-hours mistake.
A device shows clearly malicious beaconing but is also running a live business application. Why is Autonomous Response better than a blunt full-host block?
④ Operations & advanced — model breaches, tuning, exposure and fit
Q: What is the difference between a model breach and a Cyber AI Analyst incident?
Model answer: Darktrace evaluates models; when a device's behaviour crosses a model's logic you get a model breach — a single anomaly trigger. A Cyber AI Analyst incident is the correlated, investigated picture — several related breaches stitched into one storyline with a severity and a report. Breaches are the raw signals; the incident is the conclusion. Saying you triage from the incident, not breach-by-breach, signals real operational maturity.
Q: A model is noisy. Do you disable it?
Model answer: Almost never disable it. You tune it — adjust thresholds, scope it to the right devices, or whitelist a genuinely normal behaviour — so you keep the detection but cut the noise. Disabling a model creates a blind spot. The good answer is 'investigate why it is firing, then tune rather than switch off'.
Q: What is Proactive Exposure Management, and how does Darktrace fit with our SIEM, EDR and firewall?
Model answer: Proactive Exposure Management (formerly PREVENT) is the proactive side — it does attack-path modelling and attack surface management (ASM) to find and help harden exposures before they are exploited, whereas detection and response are reactive. And Darktrace complements, not replaces your stack: it detects behaviourally and then feeds and triggers the SIEM, EDR and firewall — for example, Autonomous Response pushing an action through the firewall or EDR, or alerts and context flowing into the SIEM.
Arjun, a SOC analyst at a Pune fintech, faces this
Overnight, Darktrace / NETWORK raises several model breaches on a finance workstation: rare external connections on an unusual schedule and a small but steady outbound data flow. Arjun arrives to a Cyber AI Analyst incident flagged high severity and needs to explain, in the interview-style debrief, how he triaged it.
The workstation is beaconing to a never-before-seen command-and-control destination — a classic deviation from its learned pattern of life. The traffic is encrypted, so a payload-only tool saw nothing unusual.
In the Threat Visualizer, Arjun opens the Cyber AI Analyst incident rather than reading each breach separately. The natural-language report links the rare destination, the odd timing and the steady exfil-shaped flow into one storyline, with the device, user and timeline laid out.
Threat Visualizer ▸ Cyber AI Analyst ▸ Incident ▸ Model breaches ▸ Device + timelineBecause the behaviour is clearly malicious, Arjun confirms the Autonomous Response action that holds just the beaconing connection (the device keeps its normal business traffic), then has the firewall/EDR isolate the host for forensics. He does not disable the model that fired; he notes it worked as intended.
Re-check the incident: the beacon connections stop, no new external rare-destination breaches appear on that device, and the rest of its pattern of life is unchanged. The incident is closed as a true positive with the AI Analyst report attached as evidence.
Never answer a noisy-model question with 'switch it off'. Disabling a model creates a blind spot. The strong answer is to investigate why it fires, then tune thresholds, scope or whitelist a genuinely normal behaviour — keeping the detection while cutting the noise. Prove the fix from the incident, not a hunch.
What is the difference between a model breach and a Cyber AI Analyst incident?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what does Darktrace's Self-Learning AI learn, and how does that let it catch a zero-day that a signature tool would miss? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Self-Learning AI
- Darktrace's core: mostly unsupervised machine learning that learns the normal pattern of life for each device, user and the organisation and flags deviations — no signatures or threat feeds needed.
- Pattern of life
- The learned normal behaviour of a device or user — who it talks to, when, how much, which services — that Darktrace compares live activity against to spot anomalies.
- ActiveAI Security Platform
- Darktrace's platform: coverage modules (/ NETWORK, / EMAIL, / CLOUD, / OT, / IDENTITY, / ENDPOINT) plus cross-platform Cyber AI Analyst, Autonomous Response and Proactive Exposure Management.
- Darktrace / NETWORK (NDR)
- The Network Detection and Response module, deployed passively out-of-band via SPAN/TAP; detects C2 beaconing, lateral movement, exfiltration and early ransomware, including in encrypted traffic by metadata.
- Autonomous Response (Antigena)
- Takes proportionate, surgical action from the learned normal — blocks just the malicious connection or enforces the pattern of life — in seconds, in human-confirm or autonomous mode, natively or via firewall/NAC/EDR.
- Cyber AI Analyst
- Automates Tier-1/2 investigation: correlates related anomalies into one investigated incident with a severity and a natural-language report, cutting triage time and alert fatigue.
- Model breach vs incident
- A model breach is a single anomaly trigger when behaviour crosses a model's logic; a Cyber AI Analyst incident is the correlated, investigated picture stitched from several breaches.
- Proactive Exposure Management (PREVENT)
- The proactive layer: attack-path modelling and attack surface management (ASM) to find and harden exposures before they are exploited, complementing reactive detection and response.
- Master, probes, cSensors, osSensors
- The deployment pieces: a master appliance (physical/virtual/cloud) with probes that watch SPAN/TAP traffic, cSensors for cloud and osSensors on hosts; investigated in the Threat Visualizer.
📚 Sources
- Darktrace — The Darktrace ActiveAI Security Platform: Self-Learning AI and the coverage modules. darktrace.com/products
- Darktrace — Darktrace / NETWORK: passive NDR, deployment (master, probes, sensors) and detection. darktrace.com/products/network
- Darktrace — Autonomous Response (formerly Antigena): proportionate action and response modes. darktrace.com/products/autonomous-response
- Darktrace — Cyber AI Analyst: autonomous investigation, triage and investigated incidents. darktrace.com/products/cyber-ai-analyst
- Darktrace — Proactive Exposure Management (formerly PREVENT): attack-path modelling and attack surface management. darktrace.com/products/proactive-exposure-management
- Darktrace — How Self-Learning AI works: pattern of life, unsupervised ML and detecting novel threats. darktrace.com/cyber-ai
What's next?
Done with the interview prep? Go deeper on Darktrace design — how Self-Learning AI builds a pattern of life, where to place / NETWORK sensors, how to choose Autonomous Response modes, how Cyber AI Analyst investigates, and how Proactive Exposure Management models attack paths and your attack surface.