Darktrace Proof of Value

DATA SHEET

What is a Proof of Value?

A Proof of Value (POV) is a unique, easy four-week trial that allows you to evaluate Darktrace’s Enterprise Immune System and Threat Visualizer within your own environment. The POV allows organizations to understand why some of the world’s leading companies are relying on Darktrace to gain unprecedented visibility into their networks and detect emerging cyber threats within their systems in real time – before they develop into damaging incidents. Our experienced team will install a Darktrace appliance within your environment in just one day, and give you access to our groundbreaking Threat Visualizer interface. During the POV, you will also receive detailed updates on what we find, produced by our world-leading cyber analysts.

Why do a POV?

Achieve Global VisibilityToday’s networks are large, busy and complex, making it very difficult to work out what is going on, where and how, at all times. Darktrace uniquely models, maps and visualizes your entire network, down to device and user level, giving you a unique and intuitive overview of what is going on within your organization.

• See what your network and interactions really look like • Have the ability to ‘zoom in’ on parts of your infrastructure, by network, device or user• Understand your own organization better than your adversaries do

Detect Threats That You Did Not Know ExistedDarktrace’s unique immune system approach is powered by fundamental machine learning and probabilistic mathematics. It does not rely on signatures, rules or a priori knowledge of threats or your environment. The technology constantly learns what is ‘normal’ activity in your environment, correlating multiple weak indicators in order to form an accurate understanding of normal and abnormal behavior.

• Find anomalies and threats that you did not know existed – Darktrace’s machine learning and mathematical approach works from day one, and is constantly learning in order to detect unusual behaviors, without any a priori knowledge

• Understand what your top security priorities are – Darktrace lets you see and act on the top threats to your organization, without getting distracted by the noise of the network

• Take timely action to minimize risks to your organization and curb malicious or harmful behaviors

Threat Intelligence ReportsA Darktrace POV includes three weekly Threat Intelligence Reports that will explain and detail the most salient anomalies that the Enterprise Immune System finds, as determined by our expert analysts. Darktrace employs some of the world’s leading cyber intelligence and security professionals. Our cyber threat analysts typically have strong government intelligence backgrounds, from the NSA, GCHQ, MI5 and other intelligence agencies, with unprecedented, real-world experience of encountering and defending against some of the most persistent and pernicious cyber threats and attackers.

• Benefit from the expert analysis of the world’s leading cyber threat analysts• Collaborate directly with our analysts to understand the unique findings of the Darktrace appliance• Receive weekly Threat Intelligence Reports from the second week onwards, providing tailored analysis of your environment’s

top threats based on the investigations of our lead cyber analysts • Get expert advice on threat remediation in response to the anomalies detected

How does it work?

1. Installation of the Darktrace applianceA single Darktrace appliance can be installed in 1-2 hours or less, and uses up to 2U of rack space.

2. Passive data collectionDarktrace uses raw network traffic in order to get maximum visibility of your network and to model your enterprise, devices and users to a high degree of accuracy. Data is passively collected using one of the following methods:• Port spanning via your existing network equipment• Insertion or reuse of an in-line network tap• Access to existing repositories of network data

3. Data analysis and modelingDarktrace immediately starts ingesting, analyzing and modeling network data. Using its unique, probabilistic and machine learning algorithms, Darktrace establishes a ‘pattern of life’ for the enterprise, as well as every individual device and user, and detects true anomalies. Over the course of the POV, this understanding is constantly refined and revised as the Enterprise Immune System incrementally learns more and more about how your organization behaves.

POV Timescale

Level Schedule Steps Your Resource

1

Pre-POV Schedule installation date of the Darktrace appliance You are assigned a dedicated Cyber Technology Specialist (CT)

Day 1• Installation (1-2 hours)• Data flow validation• Machine learning is activated

Your CT

Week 1

Learn about your network• Your network is topologically mapped in 3D via the

Threat Visualizer interface• See what is happening within the organization, as it

happens

Your CT and access as needed to your dedicated Cyber Analyst

2 Week 2

Understand user behavior

• Gain initial access to the Threat Notification Center• Visualizer demonstrates unusual employee

behaviors • Gain insights into how user credentials are utilized• Weekly Threat Intelligence Reports begin

Your CT and access as needed to your Cyber Analyst

3 Week 3

Investigate real-time threats

• Gain full access to the Threat Notification Center• User interface familiarization training to make the

most of the Threat Visualizer• Appreciate how the Threat Visualizer provides

greater visibility and investigative power to your environment.

• See and respond to real-time alerts of true anomalies, which have bypassed other security controls

• Second weekly Threat Intelligence Report

Your CT and access as needed to your Cyber Analyst.

4

Week 4

Evaluate & review

• Final Threat Intelligence Report and POV Threat Summary is delivered at review meeting

• POV trial expires

Executive sponsor and senior Subject Matter Expert

Post POV• Sign agreement• Plan enterprise deployment and your support needs

Executive sponsor

About DarktraceNamed ‘Technology Pioneer’ by the World Economic Forum, Darktrace is one of the world’s leading cyber threat defense companies. Its Enterprise Immune System technology detects previously unidentifi ed threats in real time, powered by machine learning and mathematics developed at the University of Cambridge, which analyze the behavior of every device, user and network within an organization. Some of the world’s largest corporations rely on Darktrace’s self-learning appliance in sectors including energy and utilities, fi nancial services, telecommunications, healthcare, manufacturing, retail and transportation. The company was founded in 2013 by leading machine learning specialists and government intelligence experts, and is headquartered in Cambridge, UK, and San Francisco, with global offi ces in London, Paris, Milan, Singapore, Tokyo, New York, Chicago, Washington D.C., Boston, Los Angeles, Dallas, Toronto, Auckland and Melbourne.

T: +44 (0) 1223 350 653 E: info@darktrace.com www.darktrace.com

Secure Connection Darktrace appliances connect back to Darktrace Central Management over a secure and encrypted, dual-factor authentication channel in order to receive new mathematical models and software updates. For managed deployments and POVs, this also enables Darktrace cyber analysts to review and tune system output. Customers maintain total control of the connection, which is initiated and maintained from the appliance and can be started, terminated or audited at any time. For the purposes of carrying out continual health checks, we request that a connection is maintained during normal business hours.

Mapping DataTo take full advantage of the unsupervised machine-learning hosts with dynamic IP addressing, the DHCP signal from server to client must be contained in the data feed. This helps build the most granular understanding of particular machine and user behavior. For deployments beyond the Proof of Value, other forms of mapping data can be used to permit integration with many industry-standard log systems.

Privacy & Legal Considerations

• Data collection is passive – all collected data remains on-premises and is not uploaded to the cloud or to a Darktrace data center. Data is only accessible through the secure connection unless otherwise agreed.

• The appliance does not affect network and business operations • Data is securely deleted if you do not wish to proceed beyond the POV• A shrink wrap legal agreement is required to activate the appliance

Alternatively, VPN can be used to connect the appliance to Darktrace Central Management, in accordance with the customers’ protocols.

If DHCP data from the network is not available, please ask your Darktrace contact for secondary options.

Resources Required for Success

POV-004en Darktrace © Copyright 2013-2014 Darktrace Limited. All rights reserved. Darktrace is a registered trademark of Darktrace Limited. Enterprise Immune System, and Threat Visualizer are unregistered trademarks of Darktrace Limited. Other trademarks included herein are the property of their respective owners.