UK-based cybersecurity company Darktrace has upgraded the capabilities of Cyber AI Analyst, a patented AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritises incidents.
The upgrades, including introducing new proprietary advanced machine learning models, will improve threat detection, investigation and alert prioritisation, arming security teams with deeper, more granular insights for faster decision-making.
First introduced in 2019, Cyber AI Analyst is a pioneering agentic AI system that mirrors the human investigative process – it can question data, test hypotheses, and reach conclusions without human intervention.
Using a combination of advanced AI techniques, including unsupervised machine learning, models trained on expert cyber analysts, and custom security-specific language models, Cyber AI Analyst autonomously investigates and triages alerts at machine speed and scale, mimicking human reasoning to form hypotheses, correlate seemingly unrelated events, and generate transparent and interpretable AI insights with complete incident reports within minutes.
By investigating all relevant alerts from Darktrace and third-party security tools and surfacing only the most impactful threats, Cyber AI Analyst streamlines the alert triage and prioritisation process, giving security teams more time to focus on what matters. Cyber AI Analyst provides security operation centres with the equivalent of up to 30 additional full-time employees performing Level 2 analysis and written reporting annually.
Introducing Next-Generation AI Models for Cybersecurity
The continued growth of cybercrime-as-a-service models, combined with the rising use of offensive AI, is increasing the speed, scale and sophistication of cyber attacks.
Security teams are facing a relentless flood of alerts, leaving incidents un-investigated, increasing alert fatigue, and heightening the risk of missed threats. With the shortage of skilled cyber professionals continuing to grow, organisations are increasingly turning to AI-powered tools to improve efficiency within security operation centres.
Eighty-eight percent of security professionals believe that the use of AI is critical to freeing up time for teams to become more proactive, according to Darktrace’s 2025 State of AI Cybersecurity report.
To further help security teams, Darktrace is introducing two next-generation AI models for cybersecurity within Cyber AI Analyst, including:
- Darktrace Incident Graph Evaluation for Security Threats (DIGEST): Using graph neural networks, this new model predicts which security incidents are most likely to escalate into major compromises by analysing the structure and progression of attacks to spot early indicators of high-risk threats.
- DIGEST enables security teams to detect critical threats sooner and prioritise the incidents that matter most.
- Darktrace Embedding Model for Investigation of Security Threats – Version 2 (DEMIST-2): This proprietary language model is specifically trained for cybersecurity use cases. It has deeper contextual understanding of security data and can perform multiple, distinct complex tasks, such as accurately assessing hostnames, understanding the sensitivity of file names, and precise tracking of users and entities across multiple domains.
This automates complex security tasks, reduces manual analysis time and improves incident correlation – helping SOC teams respond faster. DEMIST-2 can be deployed anywhere and outperforms comparable models that are much larger in size, delivering resource efficiency with superior performance.
Uplifting Teams While Improving Productivity and Cyber Resilience
Customers in various industries rely on Darktrace’s Cyber AI Analyst to scale security operations, taking on time-consuming tasks to free team members for more strategic work.
The security team at South Coast Water District, a critical infrastructure organisation in California, reports that while it would previously have taken three hours to figure out an alert’s severity. Cyber AI Analyst decreased that time to merely 20 minutes.
“Security teams are increasingly overwhelmed, facing not just a surge in alerts, but adversaries that are faster, stealthier, and more sophisticated,” said Darktrace Chief AI Officer Tim Bazalgette. “To meet this challenge, we’ve augmented Cyber AI Analyst with two additional machine learning models.”
“Unlike the foundational LLMs that underlie many generative and agentic systems, these models are purpose-built for cybersecurity and bring greater precision and depth of analysis into the SOC,” he added. “By understanding how attacks evolve and predicting which threats are most likely to escalate, these models enable earlier detection, sharper prioritisation, and faster, more confident decision-making.”
“Empowering defenders with AI has never been more critical, and we remain committed to driving innovation that helps our customers proactively reduce risk, strengthen their security posture, and uplift their teams.”
