Introduction
Darktrace was one of the earliest cybersecurity companies to build its core product around unsupervised machine learning, marketing an approach that models the normal “pattern of life” for every device, user, and cloud workload on a network and flags deviations from it, rather than relying on known attack signatures or human-curated threat intelligence. Founded in Cambridge, United Kingdom, in 2013 by mathematicians and cyber-defense experts including Poppy Gustafsson, Nicole Eagan, Jack Stockdale, and Dave Palmer, with backing from entrepreneur Mike Lynch’s Invoke Capital, Darktrace listed on the London Stock Exchange in 2021 before being taken private by Thoma Bravo in 2024.
For readers of Brel’s AI in cybersecurity coverage, Darktrace is a useful two-part case study: an early, genuine example of unsupervised AI applied to network defense at scale, and — following its acquisition and two subsequent CEO changes — a concrete illustration of how private equity ownership can reshape leadership and growth expectations at a formerly public AI-native security vendor.
What the company does
Darktrace’s ActiveAI Security Platform applies proprietary, self-learning AI across cloud, email, identity, operational technology, endpoint, and network environments, building a continuously updated behavioral baseline for each customer and using deviations from that baseline to detect novel or previously unseen threats. The platform is also designed to take autonomous response action — for example, isolating a compromised device — rather than only generating alerts for human analysts to act on.
Who it serves
According to the company’s own materials at the time of its Thoma Bravo acquisition, Darktrace’s platform and services protect nearly 10,000 customers across all major industries globally, supported by more than 2,400 employees. Its self-learning approach has been particularly marketed toward organizations concerned about threats that would not match any known signature or published indicator of compromise, a category the company argues is growing as attackers increasingly use novel or AI-assisted techniques.
Company background
Darktrace was founded in 2013 in Cambridge, United Kingdom, by a group of mathematicians and cyber-defense experts associated with Invoke Capital, the investment firm of entrepreneur Mike Lynch, who has no ongoing role at the company. Darktrace listed on the London Stock Exchange under ticker DARK in 2021. On April 26, 2024, private equity firm Thoma Bravo agreed to acquire Darktrace for approximately $5.3 billion in cash, a 44% premium to its recent three-month average share price; the acquisition, backed by existing shareholders including funds tied to KKR and Summit Partners, formally completed on October 1, 2024, delisting Darktrace from the London Stock Exchange. Leadership has changed twice since the deal closed: Jill Popelka, who had joined Darktrace’s board and then became chief operating officer before succeeding co-founder Poppy Gustafsson as CEO around the time of the acquisition, stepped down in January 2026 after roughly sixteen months; Ed Jennings was named president and CEO in March 2026, Darktrace’s third chief executive in eighteen months. The company remains headquartered in Cambridge, with a second research-and-development center in The Hague, Netherlands.
Product and AI capabilities
Darktrace has consistently marketed its core differentiation as being genuinely unsupervised: rather than training models primarily on labeled attack data drawn from other customers or public threat feeds, its AI learns the specific, evolving pattern of life within each individual customer’s environment and flags departures from it as risk signals. Over time, the company has extended this from network anomaly detection into cloud, email, identity, operational technology, and endpoint modules, marketed together as the ActiveAI Security Platform, and has filed more than 200 patent applications tied to work from its Cambridge and Hague research teams.
Key developments
Darktrace grew from its 2013 Cambridge founding into a London Stock Exchange-listed company by 2021, expanding its platform through acquisitions such as Cybersprint in 2022 for attack-surface management. Thoma Bravo’s $5.3 billion take-private acquisition, announced in April 2024 and completed that October, ended Darktrace’s three years as a public company. Since then, the company has experienced rapid leadership turnover under its new private equity owner: Jill Popelka’s departure after sixteen months as CEO in January 2026, followed by Ed Jennings’s appointment as Darktrace’s third CEO in eighteen months in March 2026, with reporting attributing the turnover in part to Thoma Bravo’s demand for faster revenue growth.
Why it matters
Darktrace remains one of the more commonly cited real-world examples of unsupervised machine learning applied to threat detection at production scale, predating much of the generative-AI-driven marketing language that now dominates the security industry. Its post-acquisition leadership churn is equally instructive for a different reason: it offers a concrete, publicly reported timeline of how a private equity owner’s growth expectations can translate into rapid executive turnover at a formerly founder-led AI security company, a dynamic worth watching as more AI-native security vendors move from public or founder-led ownership into private equity portfolios.
Sector context
Within Brel’s AI in cybersecurity coverage, Darktrace is most often compared with CrowdStrike and other autonomous-response vendors, though Darktrace’s unsupervised, per-customer behavioral modeling approach is architecturally distinct from the cloud-trained, cross-customer telemetry models that underpin much of CrowdStrike’s and SentinelOne’s detection engines. Darktrace’s acquisition by Thoma Bravo also parallels Thoma Bravo’s earlier purchase of British security vendor Sophos, giving Brel readers two recent examples of the same private equity firm’s approach to owning AI-native cybersecurity companies.
Sources and references
This profile draws on Thoma Bravo’s and Darktrace’s official press releases and independent reference and press sources.
- Thoma Bravo — “Thoma Bravo Completes Acquisition of Darktrace” (2024)
- Reuters — “Thoma Bravo to buy UK’s Darktrace for around $5.3 bln” (2024)
- BusinessCloud — “Darktrace names 3rd CEO in 18 months after Popelka ‘forced out'” (2026)
- Wikipedia — “Darktrace”