Darktrace, a vendor of AI for cybersecurity solutions, announced on Wednesday enhanced capabilities for Cyber AI Analyst, a patented AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritizes incidents. The latest innovations, including the introduction of new proprietary advanced machine learning models, will enhance threat detection, investigation and alert prioritization, arming security teams with deeper, more granular insights for faster decision-making.
First introduced in 2019, Cyber AI Analyst is an agentic AI system that mirrors the human investigative process – it can question data, test hypotheses, and reach conclusions without human intervention. Using a combination of advanced AI techniques including unsupervised machine learning, models trained on expert cyber analysts, and custom security-specific language models, Cyber AI Analyst autonomously investigates and triages alerts at machine speed and scale, mimicking human reasoning to form hypotheses, correlate seemingly unrelated events, and generate transparent and interpretable AI insights with complete incident reports within minutes.
By investigating relevant alerts from Darktrace and third-party security tools, and surfacing only the most impactful threats, Cyber AI Analyst dramatically streamlines the alert triage and prioritization process, giving security teams more time to focus on what matters. Cyber AI Analyst provides SOCs with the equivalent of up to 30 additional full time employees performing Level 2 analysis and written reporting annually.
The continued growth of cybercrime-as-a-service models, combined with the rising use of offensive AI, is increasing the speed, scale and sophistication of cyber attacks. Security teams are facing a relentless flood of alerts—leaving incidents uninvestigated, increasing alert fatigue, and heightening the risk of missed threats.
With the shortage of skilled cyber professionals continuing to grow, organizations are increasingly turning to AI-powered tools to enhance efficiency in the SOC; 88 percent of security professionals believe that the use of AI is critical to freeing up time for teams to become more proactive according to Darktrace’s 2025 State of AI Cybersecurity report. To further help uplift security teams, Darktrace is introducing two next-generation AI models for cybersecurity within Cyber AI Analyst, including:
- Darktrace Incident Graph Evaluation for Security Threats (DIGEST): Using graph neural networks, this new model predicts which security incidents are most likely to escalate into major compromises by analyzing the structure and progression of attacks to spot early indicators of high-risk threats. DIGEST enables security teams to detect critical threats sooner and prioritize the incidents that matter most.
- Darktrace Embedding Model for Investigation of Security Threats – Version 2(DEMIST-2): This proprietary language model is specifically trained for cybersecurity use cases. It has deeper contextual understanding of security data, and is able to perform multiple, distinct complex tasks like accurately assessing hostnames, understanding the sensitivity of file names, and precise tracking of users and entities across multiple domains. This automates complex security tasks, reduces manual analysis time and improves incident correlation – helping SOC teams respond faster. DEMIST-2 can be deployed anywhere and outperforms comparable models that are much larger in size, delivering resource efficiency with superior performance.
“Security teams are increasingly overwhelmed — facing not just a surge in alerts, but adversaries that are faster, stealthier, and more sophisticated,” said Tim Bazalgette, Chief AI Officer, Darktrace. “To meet this challenge, we’ve augmented Cyber AI Analyst with two additional machine learning models. Unlike the foundational LLMs that underlie many generative and agentic systems, these models are purpose-built for cybersecurity and bring greater precision and depth of analysis into the SOC.”
Bazalgette added that by understanding how attacks evolve and predicting which threats are most likely to escalate, these models enable earlier detection, sharper prioritization, and faster, more confident decision-making. “Empowering defenders with AI has never been more critical and we remain committed to driving innovation that helps our customers proactively reduce risk, strengthen their security posture, and uplift their teams.”
