Editing Darktrace



Path to sustainable profitable growth unclear; initiate with UW

Darktrace is a provider of AI-led cybersecurity solutions. Today, Darktrace leads the Network Detection and Response market and has seen good early success with its email product; however, against the backdrop of '''1)''' high competition and potential commoditization of security solutions addressing similar use-cases and '''2)''' relatively low platform lock-in and customer stickiness, we expect customer acquisition and retention to become more challenging for Darktrace going forward. With ARR growth tied to new customer acquisition, we believe that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. Accordingly, we initiate coverage with an Underweight rating and Dec-23 price target of 400p.

* Darktrace’s addressable markets are characterized by low barriers to entry and high competition. With relatively low barriers to entry and increased competition, we see a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools. In addition, there is risk from public cloud vendors such as Microsoft, Google and Amazon making a big push in the areas of cloud traffic and email security.
* Shifting the focus to profitability. High competition and low customer stickiness will likely translate to higher customer acquisition costs and prompt Darktrace to increase investments in existing and new product development – both of which will limit margin leverage going forward, in our view. We expect the sum of revenue growth and FCF margin (‘Rule of 40’) to dip and remain below 40% over the next couple of years. Eventually, this is likely to reflect in Darktrace’s valuation compared to other cybersecurity peers that consistently beat this 40% benchmark. With ARR growth tied to new customer acquisition, we believe that higher customer acquisition costs and lower customer retention are likely to challenge the company’s ability to deliver profitable growth. Our adj. EBITDA estimates are 22%/4% below consensus for FY23/24, respectively.
* Initiating at UW. We initiate coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p (~10% downside vs. current spot). Our price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group median (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors).


Summary Investment Thesis and Valuation

Darktrace is a provider of AI-led cybersecurity solutions. Today, Darktrace leads the Network Detection and Response market and has seen good early success with its email product; however, against the backdrop of 1) high competition and potential commoditization of security solutions addressing similar use-cases and 2) relatively low platform lock-in and customer stickiness, we expect customer acquisition and retention to become more challenging for Darktrace, going forward. With ARR growth tied to new customer acquisition, we believe that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. Accordingly, we initiate coverage with an Underweight rating and Dec-23 price target of 400p.

Our Dec-23 price target of 400p is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to its peer group median (vs. YTD average of ~25% discount). Our choice of a higher discount vs. peer median reflects our view of increased competition and limited visibility on the path to achieve sustained profitable growth. On a relative basis, we believe that there are better opportunities elsewhere to play the proactive cybersecurity theme – such as Crowdstrike (leading disruptor in endpoint security), CyberArk (Privileged Access Management leader), Tenable (leader in vulnerability management) and Varonis (user and entity behavior analytics).

Performance Drivers


Executive Summary‌

Founded in Cambridge (UK) in 2013, Darktrace is a provider of AI-led threat detection and response security solutions covering on-premises network, cloud, SaaS, email, endpoints and OT (Operational Technology) environments. Further, Darktrace will roll out solutions tackling preventative security and remediation post attacks as part of its continuous AI security loop. According to Darktrace, its cyber AI platform does not rely on a historical signatures-based detection / rules-based response playbook; instead, its technology aims to learn the ‘patterns of life’ for an enterprise, creating a constantly evolving baseline for ‘normal’ behavior, and detects and responds to deviations from the normal.

Darktrace competes in market segments characterized by relatively low barriers to entry and high competition. Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product; however, against the backdrop of '''1)''' high competition and potential commoditization of security solutions addressing similar use-cases, '''2)''' relatively low platform lock-in and '''3)''' growing enterprise awareness of competing vendors, we expect customer acquisition and retention to become more challenging for Darktrace, going forward. With ARR (annualized recurring revenue) growth tied to new customer acquisition, we believe that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. This will reflect in Darktrace’s valuation compared to its peer group, in our view. '''Accordingly, we initiate coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p (~10% downside vs. current spot).''' Our price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors).

Shifting the focus to profitability

Darktrace has delivered ‘beat and raise’ results in its short reporting history since IPO in Apr-21. In the near term, we expect demand for AI-led detection and response solutions to remain high – this coupled with Darktrace’s brand awareness (a function of its high marketing spend), investment in additional salesforce hiring and the roll- out of the new ‘Prevent’ product offering should translate to healthy new customer acquisition and thus ARR growth, in our view. That said, unless the quality and stickiness of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in our view, even though the company may deliver healthy growth in the near term. We also note the overhang from pre IPO shareholders who may dispose of shares, with the next lock-up expiry on 25th April, as per Bloomberg.

In our view, Darktrace needs to demonstrate a decoupling between ARR growth and new customer acquisition & investment in sales headcount – this will be a function of a sustained increase in average contract ARR per new customer and continued improvement in net ARR retention rate (a function of lower churn and higher upsell/cross-sell). Sustained improvement in these metrics would allow the market to be more convinced of the company’s competitive positioning and moat.

Our estimates for 2022/23/24 revenue stand 1%/2%/5% higher than Bloomberg consensus estimates; we expect the company to deliver adjusted EBITDA margin at the high end of its guidance range in 2022; however, our estimates for 2023/24 adjusted EBITDA stand 22%/4% below consensus estimates.

{| class="wikitable"
|+Table 1: Darktrace Revenue and adjusted EBITDA: FY22-24E - JPMe vs. consensus<ref>Source: J.P. Morgan estimates, Bloomberg Finance L.P.</ref>
|FY ends in Jun
| colspan="3" |FY22
| colspan="3" |FY23
| colspan="3" |FY24
|-
|$ (m)
|JPMe
|Cons.
|Diff. (%)
|JPMe
|Cons.
|Diff. (%)
|JPMe
|Cons.
|Diff. (%)
|-
|Revenue
|415.5
|409.6
|1.4%
|548.1
|536.5
|2.2%
|701.5
|670.2
|4.7%
|-
|Adj. EBITDA
|49.2
|48.6
|1.3%
|47.2
|60.4
|<nowiki>-21.9%</nowiki>
|81.0
|84.6
|<nowiki>-4.3%</nowiki>
|-
|margin (%)
|11.8%
|11.9%
|<nowiki>-2bps</nowiki>
|8.6%
|11.3%
|<nowiki>-265bps</nowiki>
|11.5%
|12.6%
|<nowiki>-108bps</nowiki>
|}
Market for AI-led threat detection and response security solutions marked by low barriers to entry and high competition

Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product. However, with relatively low barriers to entry and increased competition, we see a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for vendors such as Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools such as Endpoint Detection and Response (EDR), in our view. In addition, we believe that there is a real competitive threat from public cloud vendors such as Microsoft, Amazon and Google making a big push into proactive threat detection and response solutions for cloud traffic and email as enterprise workloads transition to the cloud.

ARR growth tied to new customer acquisition

A significant portion of Darktrace’s total addressable market opportunity depends on the company’s ability to grow its ARR independent of new customer acquisition.

However, despite reporting higher platform adoption stats in the last couple of years, the company has not reported any meaningful uptick in average contract ARR (Dec- 21 level approx. flat vs. Jun-19). This is partly explained by Darktrace’s focus on acquiring new customers, SMB/mid-market skew in customer base and impact from new product launches. It remains to be seen whether Darktrace can decouple ARR growth from new customer acquisition, which will only get tougher with high competition and growing enterprise awareness of competing vendors. Unless the quality and stickiness of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in our view, even though the company may deliver healthy growth in the near term.

Risks to profitability

With low barriers to entry and high competition in the markets Darktrace operates in, we believe that customer acquisition and retention will get tougher going forward. This may lead to higher customer acquisition costs and prompt Darktrace to increase investments in existing and new product development. While Darktrace may report healthy near-term growth, the eventual success of the company will be determined based on how the company balances growth and profitability. Assessing this development through the lens of ‘Rule of 40’ (revenue growth + FCF margin) is a good indicator of the progress the company is making to sustain profitable growth. We expect the sum of revenue growth and FCF margin to dip and remain below 40% over the next couple of years. Eventually, this is likely to reflect in Darktrace’s valuation compared to other cybersecurity peers that consistently beat this 40% benchmark, in our view.

==== Risks to our view‌ ====

* Competition risks may take time to play out: While we believe that the market for AI-led threat detection and response solutions remains highly competitive, Darktrace’s brand awareness (supported by high marketing spend) may continue to support new customer acquisition without incurring higher costs. XDR vendor solutions may take time to mature; in addition, enterprises may likely be wary of getting locked-in to any particular XDR vendor’s ecosystem, potentially diluting the competitive threat from XDR vendors. Mid-term competitive threat from public cloud vendors may not materialize within a reasonable timeframe.
* Broader platform adoption across larger enterprise customers: Darktrace’s customer base is skewed towards SMB/mid-market enterprises (~85% of customers generate sub-$100k ARR); however, growing adoption in larger enterprises and the subsequent shift in customer mix, may drive higher average contract ARR per customer and lower gross ARR churn – factors that may help the company scale up profitability over the coming years.
* A '''sustained decoupling between ARR growth and new customer acquisition'''  / investment in new sales headcount might prompt us to revisit our UW thesis, as this would put the company on path towards sustainable profitable growth.
* Regulatory/compliance laws (or cyber insurance requirements) mandating the use of AI-led threat detection and response solutions could boost demand for Darktrace’s offering, potentially lowering new customer acquisition costs.
* M&A: Darktrace may appear a candidate for acquisition by larger cybersecurity vendors looking to acquire AI-driven detection and response solutions. This expectation may offer downside support to Darktrace’s share price, in our view.
* Near-term support from healthy ‘beat and raise’ results: Our concerns on profitable growth may not play out over the next few quarters, which may result in the company delivering consistent strong performance in the near-term.

{| class="wikitable"
|+Table 2: Darktrace: Summary of key financial items<ref>Source: Company data, J.P. Morgan estimates; *includes share-based comp and associated employer tax charges.</ref>
|$ (m), FY ends in Jun
|2018
|2019
|2020
|2021
|2022E
|2023E
|2024E
|-
|Revenue
|79.4
|137.0
|199.1
|281.3
|415.5
|548.1
|701.5
|-
|YoY
|
|72.5%
|45.3%
|41.3%
|47.7%
|31.9%
|28.0%
|-
|Gross profit
|71.2
|124.8
|181.6
|252.9
|369.7
|483.5
|613.9
|-
|as % of revenue
|89.6%
|91.1%
|91.2%
|89.9%
|89.0%
|88.2%
|87.5%
|-
|Key opex items as % of revenue*
|
|
|
|
|
|
|
|-
|Sales & marketing
|114.7%
|95.3%
|81.9%
|67.2%
|63.2%
|63.8%
|62.0%
|-
|R&D
|9.5%
|7.1%
|6.0%
|10.2%
|10.5%
|12.9%
|13.4%
|-
|G&A
|15.8%
|14.8%
|13.5%
|20.1%
|23.2%
|22.8%
|21.0%
|-
|Operating profit
|(40.6)
|(36.2)
|(24.9)
|(38.5)
|(32.5)
|(62.4)
|(62.1)
|-
|as % of revenue
|<nowiki>-51.1%</nowiki>
|<nowiki>-26.4%</nowiki>
|<nowiki>-12.5%</nowiki>
|<nowiki>-13.7%</nowiki>
|<nowiki>-7.8%</nowiki>
|<nowiki>-11.4%</nowiki>
|<nowiki>-8.9%</nowiki>
|-
|Adjusted EBIT
|(37.3)
|(28.9)
|(14.6)
|0.1
|11.5
|(4.2)
|12.1
|-
|as % of revenue
|<nowiki>-47.0%</nowiki>
|<nowiki>-21.1%</nowiki>
|<nowiki>-7.3%</nowiki>
|0.0%
|2.8%
|<nowiki>-0.8%</nowiki>
|1.7%
|-
|Adjusted EBITDA
|(27.0)
|(11.3)
|8.9
|29.7
|49.2
|47.2
|81.0
|-
|as % of revenue
|<nowiki>-34.0%</nowiki>
|<nowiki>-8.2%</nowiki>
|4.5%
|10.6%
|11.8%
|8.6%
|11.5%
|-
|Net cash
|12.0
|33.1
|18.4
|307.1
|328.0
|348.6
|388.3
|-
|FCF
|(35.1)
|(9.0)
|(3.8)
|34.6
|44.8
|33.1
|52.3
|-
|LTM FCF as % of LTM revenue
|<nowiki>-44.2%</nowiki>
|<nowiki>-6.5%</nowiki>
|<nowiki>-1.9%</nowiki>
|12.3%
|10.8%
|6.0%
|7.5%
|-
|LTM revenue growth + FCF margin (%)
|
|66.0%
|43.4%
|53.6%
|58.4%
|38.0%
|35.4%
|}
Valuation‌

We initiate coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p. Our price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group median (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors). Darktrace is likely to report healthy near-term momentum – a function of strong demand for AI-led threat detection and response solutions, brand awareness (driven by its high marketing spend), investments in adding salesforce capacity and roll-out of the new ‘Prevent’ product suite. However, the stickiness of Darktrace’s customer base may be challenged by commoditization of offerings targeting similar security use-cases, low switching costs and as enterprise awareness of competing vendor offerings increases. This could eventually translate to higher customer churn, in our view. With ARR growth tied to new customer acquisition, we believe that higher customer acquisition costs and lower customer retention are likely to challenge the company’s ability to deliver profitable growth. This is likely to reflect in Darktrace’s valuation compared to its peer group, in our view.

Rather than looking at a blanket list of all listed cybersecurity companies, we include a targeted list of product-led detection and response, threat/user-behavior analytics and cyber exposure/vulnerability management vendors as part of Darktrace’s peer group. We exclude from our peer group services-led companies such as Mandiant and SecureWorks, network equipment companies such as Arista and Cisco and managed security service providers (see Table 3 for details).

We take the following points into consideration while benchmarking Darktrace’s multiple vs. its peer group:

* Darktrace currently leads the network detection and response (NDR) market; however, this segment is characterized by relatively low barriers to entry and high competition. Providers of network security, Endpoint Detection and Response (EDR) and SIEM/SOAR systems are entering the NDR market, as part of their eXtended Detection and Response (XDR) strategy – this will further increase the competitive intensity for Darktrace, in our view (note that Darktrace does not have a strong standalone EDR, SIEM or network security offering and works as a complement to these point security tools). In addition, there is potential risk from public cloud vendors such as Microsoft, Google and Amazon making a big push in the areas of cloud traffic monitoring and email security, in our view. Darktrace has seen good early success with its products, but with growing enterprise awareness of different vendors addressing similar use-cases and low customer stickiness, we believe that customer acquisition and retention is likely to get tougher for Darktrace, going forward.

* A significant portion of Darktrace’s total addressable market opportunity depends on the company’s ability to grow its ARR independent of new customer acquisition. Despite reporting higher platform adoption stats in the last couple of years, the company has not reported any meaningful uptick in average contract ARR (Dec-21 level approx. flat vs. Jun-19). This is partly explained by Darktrace’s focus on acquiring new customers, SMB/mid-market skew in customer base (and relatively higher churn as a result) and impact from new product launches. It remains to be seen whether Darktrace can decouple ARR growth from new customer acquisition, which will only get tougher with high competition and growing enterprise awareness of competing vendors. For sustainable profitable growth longer term, high customer retention will be key, in our view.

* Early success in the AI-driven threat detection and response market and investment in marketing has helped Darktrace scale rapidly, delivering above- average growth (52% 2018-21 revenue CAGR); however, the eventual success will be determined based on how the company balances growth and profitability. Assessing this development through the lens of ‘Rule of 40’ (revenue growth + FCF margin) is a good indicator of the progress the company is making to sustain profitable growth. We expect the sum of revenue growth and FCF margin to dip and remain below 40% over the next couple of years. Eventually, this is likely to reflect in Darktrace’s valuation compared to other cybersecurity peers that consistently beat this 40% benchmark.

Darktrace made its market debut in Apr-21 at 9x 1-yr forward EV/sales (calendarized). The stock has de-rated since then and currently trades at 6x ’23E EV/sales (calendarized) compared to the peer group median at 9x. We believe the multiple de-rating reflects increased awareness of the highly competitive nature of the market Darktrace operates in. In the near term, we expect demand for AI-led detection and response solutions to remain high – this coupled with Darktrace’s brand awareness (a function of its high marketing spend), investment in additional salesforce hiring and the roll-out of the new ‘Prevent’ product offering will likely translate to healthy new customer acquisition and thus ARR growth. However, the stickiness of Darktrace’s customer base is likely to be challenged by commoditization of offerings targeting similar security use-cases and as enterprise awareness of competing vendor offerings increases. This could eventually translate to higher customer churn, in our view. With ARR growth tied to new customer acquisition, we believe that higher customer acquisition costs and lower customer retention are likely to challenge the company’s ability to deliver profitable growth. This will likely reflect in Darktrace’s valuation compared to its peer group.

We acknowledge that this may take some time to play out, especially in the current environment, where demand for proactive security solutions is likely to remain high. We do not see Darktrace’s discount to its peer group narrowing unless the company is able to demonstrate a sustained decoupling between ARR growth and new customer acquisition (which will be a function of a sustained increase in average contract ARR per customer, lower churn and continued improvement in net ARR retention rate).

Accordingly, we initiate coverage on the stock with an Underweight rating and set our Dec-23 price target at 400p, based on 5.5x ’23E EV/sales (calendarized), ~35% discount to its peer group median (vs. YTD average of ~25% discount). Our choice of a higher discount vs. peer median reflects our view of increased competition and limited visibility on the path to achieve sustained profitable growth. On a relative basis, we believe that there are better opportunities elsewhere to play the proactive cybersecurity theme – such as CrowdStrike (leading disruptor in endpoint security), CyberArk (Privileged Access Management leader), Tenable (leader in vulnerability management) and Varonis (user and entity behaviour analytics).
{| class="wikitable"
|+Table 3: Darktrace: Peer valuation comparison<ref>Source: Bloomberg Finance L.P., J.P. Morgan; calendarized data presented; priced intraday as of 4th April.</ref>
!
!Price
!Mkt. cap.
!EV
!EV/sales
!
! colspan="2" |FCF margin (%)
! colspan="3" |Revenue growth (%) Rule of 40*
|-
!
!LC
!$, m
!$, m
!2022E
!2023E
!2022E
!2023E
!2022E
! colspan="2" |2023E
|-
|Darktrace
|451.0
|4,133.6
|3,805.1
|7.9
|6.1
|11%
|13%
|38%
|30%
|43%
|-
|Check Point Software
|140.9
|18,716.3
|14,932.9
|6.5
|6.2
|51%
|51%
|6%
|5%
|56%
|-
|CrowdStrike
|228.3
|52,675.1
|51,465.0
|24.6
|18.1
|29%
|31%
|50%
|36%
|67%
|-
|Fortinet
|344.7
|55,437.9
|53,958.1
|12.6
|10.4
|35%
|38%
|28%
|20%
|58%
|-
|Palo Alto Networks
|625.9
|61,645.5
|62,261.5
|10.5
|8.6
|34%
|35%
|25%
|22%
|57%
|-
|Qualys
|144.3
|5,631.4
|5,274.6
|10.9
|9.3
|36%
|34%
|18%
|17%
|51%
|-
|Rapid7
|114.2
|6,631.4
|7,320.5
|10.7
|8.7
|6%
|10%
|28%
|22%
|32%
|-
|SentinelOne
|41.3
|11,018.1
|9,377.5
|26.4
|16.2
|<nowiki>-42%</nowiki>
|<nowiki>-6%</nowiki>
|82%
|62%
|57%
|-
|Splunk
|147.2
|23,660.7
|25,353.0
|7.9
|6.4
|11%
|14%
|23%
|23%
|37%
|-
|Tenable
|59.8
|6,566.0
|6,475.8
|9.7
|8.1
|15%
|17%
|23%
|20%
|37%
|-
|Varonis
|49.4
|5,306.9
|4,803.6
|9.8
|8.1
|3%
|6%
|25%
|22%
|28%
|-
|Median
|
|
|
|10.6
|8.7
|22%
|24%
|25%
|22%
|54%
|}
{| class="wikitable"
|+Table 4: Darktrace: Fair value per share (GBp) - sensitivity to discount vs. peer group median<ref>Source: J.P. Morgan.</ref>
|Discount to peer median (%)
|0%
|5%
|10%
|15%
|20%
|25%
|30%
|35%
|40%
|-
|Fair value per share (GBp)
|605
|576
|548
|519
|490
|462
|433
|404
|375
|}
Company Overview‌

Darktrace is a provider of proactive, AI-led threat detection and response security solutions covering on-premises network, cloud, SaaS, email, endpoints and Industrial IoT/OT environments. Darktrace’s threat detection and response approach assumes that cyber threats will succeed in breaching the organization (unlike perimeter defence technologies that seek to prevent threats from entering the organization’s digital estate) and detects and responds to these threats from within the enterprise.

Darktrace does not rely on historical signatures-based detection / rules-based response playbook; instead, its technology aims to learn the ‘patterns of life’ for an enterprise (using unsupervised machine learning), creating a constantly evolving baseline for ‘normal’ behavior, and detects & responds to deviations from the normal. By learning the organization’s ‘self’, Darktrace’s approach promises to weed out subtle, previously unseen patterns and emerging threats that would otherwise go unnoticed. Darktrace was founded in Cambridge, UK, in 2013. Today, Darktrace serves >6.5k customers (across all industries, from providers of critical public services such as healthcare and energy through to banks, retailers and manufacturers) in over 110 countries and has more than 1.7k employees globally.

Product overview‌

Darktrace’s cyber AI platform provides coverage across an enterprise’s network (on- premises, cloud and SaaS), email and endpoints. Further, Darktrace will roll out solutions tackling preventative security and remediation/healing post attacks as part of its continuous AI security loop. Given its breadth of offerings and platform approach, Darktrace does not fit neatly into any particular cybersecurity sub- segment. The use-cases targeted by Darktrace’s product overlap with NDR (Network Detection and Response), XDR (eXtended Detection and Response), EDR (Endpoint Detection and Response) and SIEM (Security Incident and Event Management) solutions.

Darktrace’s self-learning technology underpins its Cyber AI platform which includes the following core product families:

Immune System (Detection): This product forms the basis of Darktrace’s “detection” offering. Darktrace offers two variations of the Immune System – the Enterprise Immune System and the Industrial Immune System (for OT environments). The Immune System learns from the organization’s data (from across cloud, SaaS, networks, client devices, industrial/IoT and email) to form a bespoke and constantly evolving understanding of a business’s digital environment. Darktrace creates this bespoke model of normal behavior for an organization by monitoring and analyzing network traffic across the organization’s digital estate. To monitor and analyze on-premises network traffic, Darktrace will deploy a physical device (appliance) that ingests real-time network traffic via a SPAN port or network tap. Darktrace’s vSensors (and OS-sensors) provide visibility into traffic between virtual machines in cloud deployments (these virtual sensors in turn feed network traffic data to a master appliance, either located on-premises or cloud-hosted, to create a holistic picture of an organization’s activity). Similarly, for endpoints, Darktrace’s cSensors provide visibility into and map the behavior of endpoints that are off the VPN. Darktrace Immune System integrates with other security tools via an open and extensible architecture, enabling ingestion of new forms of telemetry from other security tools (such as firewalls and EDRs).

Antigena (Response): The Antigena product family forms the basis of Darktrace’s autonomous response capabilities. The Antigena product works in two modes, i.e. the autonomous mode and the human confirmation mode. In autonomous mode, Antigena automatically takes action against a flagged attack to enforce normal business operations (e.g. by interrupting connections via TCP resets and integrations with other point security solutions such as network access control, firewalls or EDR tools); in the human confirmation mode, the customer must decide manually how to respond to the flagged attack. Beyond the enterprise network (Antigena for Network), Darktrace’s offerings also include coverage for email (Antigena Email) and endpoints (Antigena for Endpoint).

Cyber AI analyst (Investigation): This product offering is aimed at augmenting the capabilities of cybersecurity analyst teams by automating threat investigation at machine speed. Cyber AI analyst automatically triages, interprets and reports on security incidents. Darktrace claims that Cyber AI analyst reduces triage time by up to 92%. Cyber AI analyst can also be integrated with tools across an enterprise’s security stack, allowing investigations to be triggered based on telemetry data from security tools such as CrowdStrike or Carbon Black. The incident reports generated by Cyber AI analyst can be exported to an SIEM, SOAR or ticketing system.

‘Prevent’ and ‘Heal’ product families to round out the continuous AI security loop: In addition to the detection, response and investigation capabilities offered through the above product families, Darktrace is trialing (with early adopters) proactive security technology via its ‘Prevent’ product family. The idea underpinning the Prevent product suite is to identify and strengthen vulnerable attack pathways (which lead to key assets). The company plans to roll out its Prevent product suite more broadly to customers by mid-CY22. Darktrace announced the acquisition (first since inception) of Cybersprint, an attack surface management company that brings an ‘outside-in’ view of an organization’s security posture (complementing Darktrace’s ‘inside-out’ view of the organization) to eliminate blind spots and detect risks. Darktrace will pay €47.5m for Cybersprint, corresponding to 12.5x ARR – the amount will be paid approx. 75% in cash and 25% in equity. An attack surface is essentially the sum total of an organization’s assets (hardware, software, cloud, SaaS) that store, process or transmit sensitive data. Attack surface management involves the discovery, inventory, prioritization and security monitoring of an organization’s internet- exposed assets. The acquisition of Cybersprint complements Darktrace’s foray into proactive cyber security (with the ‘Prevent’ product suite). Darktrace highlighted that Attack Surface Management will be available as a new module in the Prevent product family. In addition to Detect, Respond, Investigate and Prevent product families, Darktrace is researching AI-driven healing as a means to aid human teams in the remediation process in the aftermath of an attack.

Sensors

Darktrace’s cybersecurity products utilize sensors placed within the enterprise’s digital infrastructure – these sensors can be delivered physically (using an appliance) or virtually (in software). Darktrace has two primary distribution centers for its physical appliances: one based at its HQ in Cambridge, which focuses on shipments outside of Europe and the other in Dublin, which focuses on shipments throughout Europe. The physical appliances use standard components that are built into server units by Darktrace suppliers at its distribution sites. Darktrace receives pre-built server units and will then load software onto the appliance, including customer specific pre-configurations. Each Darktrace physical appliance is encoded such that it can only be used in conjunction with Darktrace products. The company can prepare hundreds of appliances a day that are ready to be shipped to customer sites. In some regions, Darktrace utilizes channel partners for onward transport and installation of the appliances. In addition, Darktrace has its own technical team (including cyber technicians and engineers) who will perform site visits and installations, where possible.

Customer base‌

Darktrace’s customer base has expanded from 1,659 in 2018 (period ending in Jun- 18) to 6,531 as of Dec-21 (growing 40% YoY during 1H22), with products deployed in more than 110 countries. The customers span all industries and sizes – Financial Services, Darktrace’s biggest industry vertical by number of customers, represented 19% of total customers as of Feb-21.

No single customer accounted for more than 10% of revenue in 1H22, 2021 and 2020. By geography (based on contractual location), US and Canada account for the biggest portion of total revenue (38% in 1H22, of which US was 34%), followed by Europe (24%), UK (17%) and Rest of the World (21%). Some Darktrace customers include City of Las Vegas, FarFetch, McLaren Group, Micron, Samsung, Ted Baker, Kohl’s, Coca Cola, NHS, Serco, Funding Circle, etc.


Churn

The majority of Darktrace customers fall in the SMB/mid-market category, with

~85% of customers with contract size up to $100k in ARR. This portion has remained fairly consistent in recent years. Customers with contract size less than

$100k in ARR contributed 51% of total ARR during 1H22.

The company has demonstrated a track record of driving higher platform adoption across new and existing customers. The portion of customers purchasing more than one product has increased from 47% in 2019 to 88% in 1H22 (with the portion of customers purchasing four or more products (out of a possible 10 currently) rising from 5% in 2019 to 43% in 1H22). The majority of Darktrace customers buy multiple products at the initial point of purchase.

Darktrace reported 1-year gross ARR churn of 6.4% as of end-1H22 (six-month period ending in Dec-21) vs. 7.6% exiting Jun-21. As expected, Darktrace sees higher churn among customers with contract size less than $100k in ARR. Darktrace’s 1-yr gross ARR churn is higher compared to other cybersecurity vendors (such as Crowdstrike, which reported 1-yr gross ARR churn of ~2% in FY21) given its SMB/mid-market heavy customer base. Darktrace reported net ARR retention rate of 105.1% in 1H22 (increasing from 99.1% in 2020 and 102.9% in 2021) – the increase in net ARR retention rate is a function of higher product upsell/cross-sell and stabilizing churn. Darktrace is investing in its customer success function, which should help stabilize churn and drive higher upsells/cross-sells at the point of renewal. That said, given the SMB/mid-market heavy customer base (which is characterized by higher churn compared to larger enterprise customers) and multiple products purchased at the initial point of sale (which limits the scope of cross-sells), Darktrace does not expect to see a significant improvement in net ARR retention rate going forward (the improvement, if any, is likely to be more gradual).

Darktrace sees its offerings as complementary to an enterprise’s existing security investments. The company sees a large greenfield opportunity for its products (a potential addressable customer base of >150k across industries) – accordingly, Darktrace remains focused on acquiring new customers and driving high platform adoption at the initial point of purchase.

Darktrace’s lead generation comes from different sources including:


Inside sales;


Marketing events;


Partner channel;


Self-prospecting;


Inbound enquiries.


Post lead generation, Darktrace primarily relies on ‘highly replicable and scalable’ POV (Proof of Value) trials of its technology to acquire new customers. The POV trials require minimal set-up and scoping and allow a potential new customer to evaluate Darktrace’s Cyber AI platform on its own digital estate free of charge. The trials typically run over a 30-day period. Darktrace notes that its Cyber AI platform detects serious threats that other security tools have missed in 77% of POV trials – according to Darktrace, this drives a high conversion rate post trials. The figure below summarizes Darktrace’s POV playbook – the company highlights that the average length of the sales cycle from session 1 to contract completion is 84 days.

Given Darktrace’s strategic focus on acquiring new customers, its ARR growth is dependent on the scaling of its POV trials. This in turn is dependent on hiring of new account executives (AEs). Darktrace has indicated that ~24% of its POVs were generated exclusively by its inside sales team. The inside sales teams are incentivized based on the number of qualified meetings booked as % of closed deals. Around 28% of Darktrace’s POVs come from the partner channel.


Darktrace sells its platform both directly to customers and through its channel partners (including resellers and managed security service providers). A majority of Darktrace’s sales (~65%) are generated via its direct sales personnel.

Direct sales

Darktrace’s approach to building its direct sales team relies on hiring and training fresh graduates from universities (Darktrace does not hire tenured enterprise salespeople). New account executives hired by Darktrace deliver first POV and sales in their third and fifth months of employment, respectively. Thus, Darktrace considers a salesperson to be productive only in their fifth month of employment.

The salesperson is subject to quotas and targets that scale with the duration of employment. The incentive structure for salespeople includes a formal commission on sales (including uncapped commission on new deals, upsells and renewals).

Approx. 50% of the commission is paid on accepted bookings and approx. 50% upon successful account management, over the first year.

Channel partners

Darktrace sees its partner channel primarily as a source of lead generation, rather than a channel to offload services/implementation, as Darktrace’s technology is relatively easy to set up, according to the company. Darktrace’s partners consist of value-added resellers, managed security service providers and technology partners that offer solutions complementary to Darktrace’s offering. Darktrace has more than 370 active channel partners including Atos, BT, Reply, SHI, Bytes, Computacenter, Eurofins, Telstra, Sis, Nth Generation and ConvergeOne. Darktrace does not rely on any single partner for a significant portion of its sales, with its largest partner accounting for ~2% of 1H21 sales. In terms of commercial arrangement, Darktrace works with its channel partners on a margin sharing basis (5-30%, depending on the involvement in the deal).

Competition landscape‌

Growing demand for proactive threat detection and response solutions (across network, cloud, email and endpoint) has underpinned Darktrace’s rapid customer- base and ARR growth in recent years. However, with relatively low barriers to entry and increased competition, we see a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for vendors such as Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools such as Endpoint Detection and Response (EDR), in our view.

Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product; however, against the backdrop of commoditization, high competition, growing enterprise awareness of vendors addressing proactive detection and response use-cases and relatively low switching costs, we believe that customer acquisition and retention is likely to get tougher for Darktrace, going forward. In addition, there is a real competitive threat from public cloud vendors such as Microsoft, Amazon and Google making a big push into proactive threat detection and response solutions for cloud traffic and email as enterprise workloads transition to the cloud.

Darktrace’s approach to threat detection and response does not rely on a historical signatures-based detection / rules-based response playbook; instead, its technology aims to learn the ‘patterns of life’ for an enterprise, creating a constantly evolving baseline for ‘normal’ behavior, and detects and responds to deviations from the normal. Darktrace’s cyber AI platform provides coverage across an enterprise’s network (on-premises, OT, cloud and SaaS), email and endpoints. Further, Darktrace will roll out solutions tackling preventative security and remediation/healing post attacks as part of its continuous AI security loop. Given its breadth of offerings and platform approach, Darktrace does not fit neatly into any particular cybersecurity sub-segment.

Darktrace notes that it does not compete with the vast majority of cybersecurity vendors as it sees its offering as complementary to an enterprise’s existing layered security stack. However, enterprise purchasing decisions are business-problem- driven and the use-cases addressed by Darktrace today are targeted by point security solution vendors such as EDR (Endpoint Detection and Response), NDR (Network Detection and Response), SIEM (Security Information and Event Management) / SOAR (Security Orchestration, Automation and Response) system and secure email gateway/cloud email security vendors. Over the mid-term, competition may also come from vendors combining multiple point solutions as part of an eXtended Detection and Response (XDR) platform. With visibility into a growing portion of enterprise traffic, public cloud vendors and zero trust/secure service edge providers such as Zscaler and Fortinet may choose to offer an integrated threat detection and response solution, potentially trimming the available opportunity for Darktrace, in our view.

Below, we provide an overview of Darktrace’s competitors across different categories based on the product offering/use-case.

==== Competition remains intense in the network detection and response market‌ ====
The security industry is seeing a shift from legacy prevention-based security approaches to proactive detection and response technologies. Endpoint security has already undergone this transition, with organizations moving from antivirus (AV) to next-generation AV to Endpoint Detection and Response (EDR) solutions. The move to Network Detection and Response (NDR) is a similar shift on the network, i.e. the next step in the transition from traditional prevention-only security solutions such as Intrusion Detection Systems (IDS) and Intrusion Detection and Prevention Systems (IDPS). NDR vendors offer an integrated set of network traffic monitoring, threat detection, investigation and response capabilities – these vendors provide a broad visibility into an enterprise’s internal network by monitoring and analyzing traffic among users/devices across the enterprise’s digital estate (on-premises, SaaS and cloud).

NDR approach to security has gained traction in recent years as this provides an added layer of network visibility without requiring agents to be installed on devices and is invisible to attackers. NDR tools augment the capabilities of security teams by monitoring network traffic in real-time (or near real-time), detecting and prioritizing threats and syncing (via APIs) with other point security solutions (firewalls, network access control, EDR, SIEM/SOAR systems) either to initiate an automated customized response (especially for high-risk incidents/breaches) or for further investigation and threat hunting.

Put simply, NDR tools employ unsupervised machine learning to establish a baseline for ‘normal’ network activity and flag deviations from the normal as alerts for further monitoring; supervised machine learning and other tools can then be applied on the flagged alerts to categorize possible threats or malicious activity. NDR tools do not rely only on past threat signatures or indicators of compromise for threat detection and can monitor both north-south and east-west traffic (with proper design of NDR deployments), making these tools a good complement to traditional security solutions such as firewalls and IDS/IPS (which primarily rely on historical threat signatures for detection).

NDR vendor offerings overlap with Darktrace’s network portfolio (Enterprise Immune System, Antigena for Network and Cyber AI analyst) – in fact, prior to rolling out solutions for email and endpoint, Darktrace was primarily an NDR vendor. According to Gartner, the NDR market stood at $1.3bn in 2021 (+27% YoY) and is expected to grow at a 4-yr CAGR of 16% reaching $2.4bn by 2025. Darktrace is the leading vendor in this market with 25% share, followed by Cisco (14%), ExtraHop (13%) and Vectra AI (9%). Some other key NDR vendors include FireEye (Trellix), Fidelis, Gigamon, IronNet and RSA Netwitness.


Demand for NDR solutions will likely remain high as enterprises introduce an added layer of network traffic visibility to their layered security stack; however, competition in this space remains intense. There are more than 20 vendors offering NDR solutions ranging from early-/mid-stage start-ups to large, established cybersecurity companies. NDR vendor offerings have also matured with basic capabilities and on-premises/cloud/SaaS coverage provided by most vendors.

Further, as enterprises increasingly incorporate NDR as part of their security stack, enterprise awareness of different vendor offerings in this space is likely to increase.

In addition, with visibility into a growing portion of enterprise traffic, NDR vendors may face competition from zero trust/secure service edge providers such as Zscaler and Fortinet that may add network traffic analytics as part of an integrated cloud security stack (today, NDR vendors offer integrations to zero trust architectures to capture logs for added visibility). Public cloud players such as Amazon, Microsoft and Google may also make a big push addressing real-time cloud traffic analysis and threat response solutions – Today, these public cloud vendors offer packet mirroring, which allows third-party network traffic analysis tools such as Darktrace to monitor traffic to/from virtual machines. However, given the importance of cloud traffic visibility, this may be brought into the fold of in-built cloud security offered by public cloud vendors in the future.

==== The future of NDR is XDR‌ ====
As stated previously, endpoint security has undergone a transition from basic AV solutions to next-generation AV and Endpoint Protection Platforms (EPPs) to Endpoint Detection and Response (EDR) solutions. However, there is a growing realization that the siloed approach to security is not enough to combat modern-day cyber threats. In fact, EDR tools face limitations when it comes to visibility into cloud workloads, IoT and unmanaged devices. This security gap is now being filled by tools such as NDR, cloud workload protection platforms, and user behavior analytics. This development has only added more siloed point security tools to an enterprise’s security arsenal.

These tools don’t usually work well together and, even when they do, security analysts have to sift through a high number of alerts. These issues are giving rise to a new approach termed eXtended Detection and Response (XDR).

XDR vendors seek to integrate telemetry from multiple sources such as endpoint, network, cloud, identity, etc. to offer contextually rich and targeted threat analysis and incident response systems. This is akin to SIEM systems; however, XDR offerings tend to be less open, with the use-case limited to threat detection and response. Eventually, we believe that EDR, NDR, user behavior analytics and some SIEM/SOAR functionality will be brought into the fold of XDR. We are already seeing integration of NDR capabilities from point solution vendors as part of their XDR strategy. Some key XDR vendors include Cisco, Palo Alto Networks, Crowdstrike, Sophos, IBM, Microsoft, Trend Micro, Rapid7 and SentinelOne.

In our view, the growing list of XDR vendors will only increase the competitive intensity for vendors such as Darktrace, which does not have a strong standalone offering for endpoint, SIEM or network security (Darktrace solutions work as a complement to these point security tools). Larger enterprises using best-of-breed security vendors are more likely to license additional modules from these XDR vendors to improve network visibility and threat analytics. Smaller enterprises (with a limited security budget) may choose to outsource threat detection and response to Managed Detection and Response (MDR) vendors or other MSSPs (Managed Security Service Providers) given the high cost and complexity of managing NDR appliances and alerts. Some key MDR / managed SOC vendors include SecureWorks, Arctic Wolf, Rapid7, Sophos, eSentire, etc.

Against the backdrop of commoditization of basic NDR capabilities, increased competition from XDR vendors, growing vendor awareness and relatively low switching costs, we believe that customer acquisition and retention will likely get tougher for Darktrace, going forward.

We acknowledge that the shift toward integrated XDR solutions will not happen overnight and these solutions may take some time to mature. However, with vendors already aggressively pursuing such strategies, we believe that the convergence between EDR, NDR, cloud workload protection platforms and user behavior analytics tools is inevitable.

==== Pure-play NDR specialists are good acquisition candidates‌ ====
Given the prospect of commoditization and eventual convergence with XDR offerings, we expect some consolidation in the NDR market; we see pure-play NDR vendors as good acquisition candidates. Deal activity in the NDR market is picking up pace – as examples, Blackstone-backed Vectra AI raised $130m at a post money valuation of $1.2bn in Apr-21; ExtraHop was acquired by Bain Capital and

Crosspoint Capital for $900m in Jun-21. Existing network equipment vendors are also making a play in this market (Arista acquired Awake Security in 2020 and Cisco has been developing its Stealthwatch offering).

In addition, vendors are adding NDR capabilities as part of their integrated XDR platform; these vendors are either buying pure-play NDR specialists or organically building NDR capabilities – as examples, Check Point Software introduced its NDR offering in 2021, Crowdstrike acquired a strategic stake in Corelight in Sep-21, Sophos acquired Braintrace in Jul-21, LogRhythm acquired MistNet in Jan-21 and VMware acquired Lastline in Jun-20.

Darktrace is a not a pure NDR specialist and offers an XDR-like approach to security (across network, email and endpoint). Thus it does not look a strong acquisition candidate in this context, especially from vendors that have an established EDR or email security offering. Having said this, we would not rule out the possibility of Darktrace being acquired by a larger security vendor (looking to add AI-driven threat detection and response capabilities) in the future.

{| class="wikitable"
|+
|NDR vendor
|Deal type
|Acquired by
|Date Comment
|-
|Bricata
|Acquisition
|OpenText
|Nov-21
|-
|Corelight
|Series D
|
|Sep-21 Raised $75m in Series D investment led by Energy Impact Partners, With
|}


==== Email security moving beyond secure email gateway solutions; however, competition is heating up‌ ====
Similar to the trends discussed above for endpoint and network, email security is seeing a transition from traditional gateway-led protection approaches to AI-led cloud email security supplement solutions that scan the entire email system for anomalies. These solutions link to cloud email systems (Microsoft/Google) via APIs to provide a contextually richer understanding of email activity (analyzing user behavior, senders, links and attachments in the context of normal “patterns of life”) – adding an additional line of defence on top of built-in capabilities offered by email providers such as Microsoft and Google.

In our view, mature enterprises are not likely to replace existing secure email gateway solutions in favor of integrated cloud email security offerings (just as these enterprises are not likely to forgo investments in IDS/IDPS in favor of NDR); rather these solutions will likely supplement existing secure gateway investments. Smaller enterprises may choose integrated cloud email security solutions (working in conjunction with built-in security from cloud email providers such as Microsoft’s Defender) over secure email gateway offerings. We expect integrated cloud email security solutions to gain traction in the coming years. However, like in the NDR space, we do see pure-play cloud email security specialists as good acquisition

candidates – either by secure email gateway vendors or XDR vendors (e.g. Check Point’s acquisition of Avanan in Aug-21).

Darktrace’s Antigena Email (launched in 2019) has seen good early success in the market for integrated cloud email security solutions. Here, the company competes with vendors such as Avanan, Abnormal Security (raised $50m at $500m+ valuation in Nov-20), Tessian ($500m valuation as of May-21), Vade and Ironscales. In addition, competition (especially, in the SMB/mid-market segment) may come from secure email gateway vendors such as Proofpoint and Mimecast.

==== Breach and attack simulation vendors‌ ====
Although still in the early stages of product roll-out, Darktrace’s foray into preventative cybersecurity (breach and attack simulation) puts the company in competition with vendors such as CyCognito, Mandiant, Qualys and AttackIQ. Darktrace plans to roll out its ‘Prevent’ product suite more broadly by mid-CY22.

Customer survey feedback‌

We commissioned Guidepoint to conduct a survey of CISOs/CTOs across 30 current and past Darktrace customers (13 current and 17 past customers). Darktrace has 6,531 active customers as of Dec-21. Hence, we note that this survey only covers a subset of active and previous customers, albeit should provide some insights on the customer perspective. We summarize our key takeaways from the survey below:

==== Product-market fit and competition‌ ====
Enterprise purchasing decisions are business problem-driven. We asked survey participants to highlight the key business problems and decision criteria that prompted the consideration/purchase of Darktrace products. Answers to this question help gain insights to Darktrace’s product-market fit and value proposition, i.e. the problems that the market perceives the company’s products to solve. Darktrace sees its offerings as complementary to an organization’s existing security stack and does not see any cybersecurity vendor as its direct competitor, given its coverage and breadth of offerings. However, the business problems that prompted an enterprise to consider/purchase Darktrace products and the alternatives it considered in evaluating Darktrace’s products present a more realistic picture of what enterprises view as alternatives to Darktrace in the fight for cybersecurity wallet-share.

We summarize key themes from the survey responses below:

Business problems that led to the consideration of Darktrace’s products:

* Need for an expanded layer of network monitoring, better network traffic analysis and cloud security;
* Lack of security resources to monitor threats and need for a SIEM/SOAR solution for analytics and threat hunting;
* Need for an AI-driven solution to secure against internal threats and APT (Advanced Persistent Threats) that does not rely on past indicators of compromise;
* Need for anomaly detection and autonomous blocking of threats; and
* Improved email protection against spear/whale phishing.  Key survey responses to the question “Which business problem prompted the consideration of Darktrace products?”
* “Overall IT/Network security and staffing bandwidth. We didn’t have enough resources to monitor the previous systems we had in place and respond in a timely fashion to events that could be incidents. We looked to Darktrace to minimize the number of resources required to monitor our security and increase our visibility.”
* “Initially the thought of a silent hacker sitting in our system gathering data or information about our security systems. AI was the only thing that could spot this. At the time we only had traditional layers of protection that were not good enough.”
* “The initial idea was to utilize AI and Automation and reduce manual efforts in our day-to-day SOC operations.”
* “Increased threats, sophistication and resources applied to cyberattacks required more diligence on our part. We have our clients’ PHI data so critical we are protected.”
* “Need for Security Operations Center but with limited resources. We also needed a way to watch both on-premises and cloud networks.”
* “Improved email protection was required to reduce spear and whale phishing issues we [were] seeing in addition to [an] ML-based solution for SaaS logins.”  Key decision criteria that led to the purchase of Darktrace products:  Survey responses to the question ''“What were the key criteria that led to the purchase of Darktrace products?”'' highlight key customer expectations and value demonstrated or promised by Darktrace during/post a Proof of Value (POV) trial.  The responses can be summarized in the following key buckets:
* Product performance (includes metrics such as accuracy of detection, scalability and ease of deployment & use);
* Coverage (especially for cloud/OT environments);
* AI capabilities/non-reliance on known threat signatures;
* Vendor reputation (includes peer reviews and recommendation from SIs);
* Total cost of ownership;
* Interoperability with existing security stack;
* Other product features (such as full packet capture and user interface);
* Service & Support.  Alternatives considered  Unsurprisingly, network detection and response (NDR) vendors surfaced as the biggest competitor category, followed by Endpoint/eXtended Detection & Response (EDR/XDR) vendors, Secure Email Gateway providers and SIEM/managed SOC system vendors.
* NDR vendors: ExtraHop, Vectra AI, Cisco Stealthwatch, RSA Netwitness, Corelight;
* EDR/XDR vendors: Crowdstrike, Cylance, Palo Alto Networks, FireEye, SentinelOne, Carbon Black, Sophos, Skout;
* Secure Email Gateway vendors: Mimecast;
* SIEM/managed SOC system vendors: Splunk, SecureWorks, Arctic Wolf.

{| class="wikitable"
|+Table 6: Responses to the question "What do you most like/dislike about Darktrace products?" by current Darktrace customers (n=13)<ref>Source: J.P. Morgan. Survey comments have been reproduced in their original form and have not been edited except as indicated. Survey comments should not be attributed to J.P. Morgan and are not representative of its views.</ref>
|#
| colspan="3" |Likes
| colspan="3" |Dislikes
|-
|1
|Network detection
|Dashboard
|Detection capabilities
|Complexity
|High total cost of

ownership
|Limited to network

visibility
|-
|2
|Integrates with our

existing security stack
|Excellent detection and

configurability
|Low false positive and

great reporting
|Configuration requires

time/learning
|Tuning/customization

non-trivial
|Initial setup took longer

than [expected]
|-
|3
|Good price
|Good features
|Good support
|Limited function
|Not best of breed
|Can be difficult to use
|-
|4
|AI feature
|Automation
|Machine learning
|N/A
|N/A
|N/A
|-
|5
|System management
|Ability to detect threats
|Reliability
|Can be time consuming

in managing log reports
|Time to build skills
|Lack of overall portfolio
|-
|6
|User interface
|Ability to give actionable info
|Always improving functionality
|It’s expensive
|Need a path to cloud only solution
|Antigena email will sometimes not filter out email until after it hits

the mailbox
|-
|7
|Rich in product features that are specific to our business

needs
|Road map for future technology that aligns to our needs
|Engineering support and service is above other vendors
|Can be quite costly when you add all the licenses and feature

sets
|N/A
|N/A
|-
|8
|Usability
|Effectiveness
|Price
|Learning curve
|Integration into data sources (separate

reporting)
|External source coverage
|-
|9
|Dashboard and ease of use
|Machine learning models
|Ease of customisation
|Cost is a little high
|Expanding the solution will be costly
|Feature requests need to be submitted via the

customer portal
|-
|10
|Comfort blanket
|Solves unique problem
|[Threat hunt]
|V expensive
|[Marketing]
|
|-
|11
|UI and ease of use
|Ability to apply

exceptions
|Behavioral based

scoring
|New endpoint agent

[requires] AI analyst
|Models are hard to

create
|No archiving capability
|-
|12
|Performance at

spotting strange or undesirable behaviour
|User-friendly interface
|The way it interrogates

logs and allows network traffic playback
|Cost
|Lack of HTTPS inspection
|
|-
|13
|Clever AI engines
|[Continuously] improving & adopting to

new emerging threats
|Can work with human in the loop
|Cost
|Time to deploy
|Lack of compatibility with some older

hardware
|}
{| class="wikitable"
|+Table 7: Responses to the question "What do you most like/dislike about Darktrace products?" by past Darktrace customers (n=17)<ref>Source: J.P. Morgan. Survey comments have been reproduced in their original form and have not been edited except as indicated. Survey comments should not be attributed to J.P. Morgan and are not representative of its views.</ref>
|#
| colspan="3" |Likes
| colspan="3" |Dislikes
|-
|1
|Easy to work with, once you know how
|AI
|Unsupervised machine learning
|Price
|Integration
|Wanted endpoint

protection for remote workers
|-
|2
|Scalable
|Cost
|Somewhat ease of use
|Interoperability with

other security products
|False positives
|Admin overhead
|-
|3
|Product options
|Coverage specifics
|AI
|Cost
|False positive
|Deployment
|-
|4
|Suite of products
|Focus on industrial

segment
|Coverage areas email,

IT, OT etc.
|Niche product
|Not tightly coupled with

public clouds
|Skills
|-
|5
|AI capabilities
|Easy deployment
|TCO
|Integration with legacy

systems
|Scalability
|Roadmap
|-
|6
|Hard to say at this point. The visualization tool they have is pretty slice
|N/A
|N/A
|Not a lot of value for the money
|Other security tools provided similar alerting and sometimes they alerted on things

Darktrace did not
|Tool was not the most intuitive.
|-
|7
|Ease of use
|Cost
|Strong security
|Poor support
|Better alternatives emerged
|Not great [integration]
|-
|8
|Cost
|Support
|Customer Success
|[Configurability]
|Difficult to read manual
|Cost Performance
|-
|9
|Customisation
|Detection capability
|Logging and UI
|Scalability
|Not many integrations
|Hard to deploy
|-
|10
|Ease of deployment
|Detection of threats - I did say we had a lot of false positives but it did also catch things we most likely wouldn’t

have
|Speed to operations from start of deployment
|False positives - tuning seemed continuous and appeared to never end
|Pricing - Other alternatives that cost less have since become available
|Resources required to manage
|-
|11
|Ease of use
|Scalability
|Detection capabilities
|Cost
|Ease of integration
|Skillset to operate
|-
|12
|Ease of implementation
|Performance
|Antigena [autonomous

response]
|Complexity of resolution
|Limited training
|Lack of customer focus

as they grew
|-
|13
|Industry standard
|Meets needs of its use
|User friendly
|Price
|False positive rate
|Technical material
|-
|14
|Efficacy
|Integrations
|Ease of use
|Price
|N/A
|N/A
|-
|15
|Ease of implementation
|Support
|Cost
|N/A
|N/A
|N/A
|-
|16
|UI
|Ease of use
|Price
|Performance
|Capability
|Deployment
|-
|17
|Intelligence
|GUI
|Feature Rich
|Complicated
|Sometimes UI masks the advanced features
|Data Visualization
|}
A majority of survey respondents (50%) – including customers who have discontinued the use of Darktrace products – indicated that Darktrace ''met expectations'' in terms of overall product performance. 30% of survey respondents (9 out of 30) reported that Darktrace products performed ''lower-than-expectations'', while 20% reported that Darktrace ''exceeded expectations'' in terms of performance.

Qualitative feedback submitted by current and past Darktrace customers indicates that “high price” and “platform complexity” are among the top disliked factors. Several respondents either discontinued or indicated their willingness to discontinue Darktrace solutions due to availability of cheaper alternatives (such as Vectra AI and ExtraHop) and limited value-add from Darktrace products. Separate interviews with customers indicate that switching costs to alternatives are relatively low (3-6 months of training time/model tuning with a new solution). A majority of current Darktrace customers we surveyed (7 out of 13) plan to keep spending with Darktrace unchanged, with 2 current customers indicating their willingness to discontinue usage of Darktrace products.

==== Factors driving churn‌ ====
A total of 17 out of 30 surveyed participants are past Darktrace customers. We asked these respondents the top reasons for discontinuing the use of Darktrace products to gauge the key factors driving churn in customer base. We summarize the responses

in Figure 18 below. “High Price” and “Poor product performance” (here “poor product performance” refers to high number of false positives and associated admin burden in managing the alerts, inability to detect serious threats/attacks), poor integration with other security solutions and availability of better alternatives were the commonly cited reasons for discontinuing Darktrace products.


ARR growth tied to new customer acquisition‌


A significant portion of Darktrace’s total addressable market opportunity depends on the company’s ability to grow its ARR independent of new customer acquisition. However, despite reporting higher platform adoption stats in the last couple of years, the company has not reported any meaningful uptick in average contract ARR (Dec- 21 level approx. flat vs. Jun-19). This is partly explained by Darktrace’s focus on acquiring new customers, SMB/mid-market skew in customer base and impact from new product launches. It remains to be seen whether Darktrace can decouple ARR growth from new customer acquisition, which we believe will only get tougher with high competition and growing enterprise awareness of competing vendors. Unless the quality (in terms of stickiness) of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in our view, even though the company may deliver healthy growth in the near term.




Darktrace sees its total addressable market to be ~$41bn. The company calculates this TAM using a bottom-up approach by multiplying its 2021 ARR of $343m (FY ending in Jun) by the following factors:


27x – to reflect 150k addressable customers (27x installed base as of Jun-21); Darktrace considers any company in any region excluding Russia and China, industry and of any size (> 250 employees) as an addressable customer;


2x to reflect the cross-sell opportunity within Darktrace’s existing product offering;


1.5x to reflect the up-sell opportunity to deploy Darktrace’s products across the entire digital estate of its customers; and


1.5x to reflect the potential adoption of planned future product offerings (including ‘Prevent’ and ‘Heal’ product families).


While Darktrace’s addressable opportunity seems sizable, the company continues to grow its ARR primarily via new customer additions, with limited contribution from average contract ARR uplift. Darktrace reported constant currency (cc) ARR of


$427m as of Dec-21, up from $177m as of Jun-19 (~140% over this period). ARR growth during this period was primarily driven by new customer acquisition, which grew ~140% from 2,731 as of Jun-19 to 6,531 as of Dec-21.




Limited uptick in average contract ARR despite higher platform adoption‌

Average contract ARR (defined as period-end ARR divided by period-end number of customers) stood at $65k as of Dec-21 and is roughly flat vs. the level as of Jun-19. The limited increase in average contract ARR over this period is despite the higher platform adoption the company has delivered in recent years (number of customers purchasing more than one product up from 47% in 2019 to 88% in 1H22).




According to Darktrace, the limited increase in average contract ARR is driven by the following factors:


Impact of new product cycles on average contract ARR;


Limited uplift in net ARR retention rate.






Impact from new product cycles


SMB/mid-market customers (with shorter sales cycles) tend to adopt new products first, causing a temporary dip in average contract ARR; this is followed by a gradual increase in ARR as larger enterprise deals are closed – the dip in average contract ARR during 2019-1H21 (see Figure 20) is explained by the roll-out of new product modules (Cyber AI analyst, Antigena Email, etc.) in 2019. With Darktrace expected to roll out the ‘Prevent’ product suite around Jun-22, the company expects average contract ARR to go through a similar transition (dip followed by gradual increase) from early FY23.




Limited uplift in net retention rate


Darktrace reported net ARR retention rate of 105.1% as of Dec-21, up from 99.9% as of Dec-20 and 101.7% as of Jun-19. The improvement in net ARR retention rate is a function of stabilizing 1-yr gross ARR churn (which declined to 6.4% as of Dec-21, from 8% as of Dec-20 and 8.8% as of Jun-19) and some higher upsell and cross-sell across Darktrace’s installed customer base. These results are driven by a recovery in Darktrace’s SMB/mid-market customer base post pandemic and the positive impact from the scaling of customer success function (created in 2H20). Having said this, Darktrace does not expect net ARR retention rate to move up significantly from the current level – this is due to:


Darktrace’s SMB/mid-market heavy customer base (~85% of Darktrace customers generate sub-$100k in contract ARR) that is characterized by relatively higher churn vs. larger enterprise customers; Darktrace sees normalized 1-yr gross ARR churn at ~6% level;


A significant portion of the platform being sold upfront, leaving limited room for upsells and cross-sells; and


The company’s focus on acquiring new customers to capture the sizable addressable opportunity (150k+ potential addressable customers) – i.e. higher emphasis on “land, land, land” over “land & expand”.


While we acknowledge the skew in Darktrace’s customer base towards SMB/mid- market enterprises, the above factors do not entirely explain why the company has not delivered any significant uplift in average contract ARR.




Darktrace operates in a highly competitive market with broadly similar offerings available from competing vendors. This likely limits the company’s ability to price its products at a premium and increases retention costs. This could partly explain why the company has not seen a meaningful contract ARR uplift despite selling more product modules to its customer base (additional features bundled together to drive retention). This will not impact gross margin necessarily as providing a new product module such as AI analyst or Antigena autonomous response does not require shipping an additional appliance (for on-premises deployments) and may not result in a commensurate increase in hosting costs for cloud-delivered solutions.




In addition, we believe that larger enterprises that have well-resourced security teams and know-how are less likely to use Darktrace solutions as a replacement for a standalone EDR, SIEM or network security solutions; these enterprises will likely continue to stitch together best-of-breed point security solutions or license additional modules from existing XDR vendors to add specific network visibility / threat analytics use-cases. Broader Darktrace platform adoption is more likely across price- conscious and budget-constrained SMB/mid-market customers characterized by lower deal values. These factors may likely limit the increase in average contract ARR values, in our view.




We acknowledge that it is likely too early to judge the success of Darktrace’s cross- sell strategy as the company continues to prioritize new customer acquisition and has a relatively young customer success function. However, in the absence of data that demonstrates the company’s strong up-sell and cross-sell potential, we continue to model a modest increase in average contract ARR going forward.




Thus, ARR growth, in our view, will continue to be driven by new customer acquisition. We believe that high competition in the markets Darktrace operates in will likely make new customer acquisition and retention tougher going forward. This will likely result in either higher gross logo/ARR churn or higher customer incentives needed (to drive retention) and continued high spend on sales and marketing expenses to hunt for new customers to offset churn.






Near-term customer acquisition will likely remain healthy driven by salesforce hiring and new product launch‌

We model constant currency ARR to grow 39% to $498m in 2022 (fiscal-year ends in Jun), in-line with the midpoint of company guidance. We model constant currency ARR (measured as of July-21 exchange rates) growth to slow to 29%/25% in 2023/24, respectively. Our estimates are underpinned by the following assumptions.


The roll-out of new ‘Prevent’ product suite around mid-CY22, strong enterprise demand for AI-driven network and email threat detection and response tools and increase in salesforce hiring will likely translate to healthy new customer acquisition in the near term, in our view. Having said this, high competition in the markets Darktrace operates in will make new customer acquisition and retention tougher going forward, in our view. Taking these two factors into account, we model a modest increase (up ~2% p.a.) in net new customer adds in 2023/24 from a base of ~7.5k customers exiting Jun-22.


We model a slight decline in average contract ARR per net new customer added during 1Q-3Q23 (impacted by early uptake by SMB/mid-market customers following the roll-out of the ‘Prevent’ product suite), followed by a gradual increase during 4Q23-4Q24.


We estimate net ARR retention rate to remain constant at 105% throughout our forecast horizon.


Darktrace generates revenue almost exclusively (99%+) from subscription contracts (with an average contract term of ~3 years). Revenue from these subscription contracts is recognized ratably over the contract period. Darktrace has high revenue visibility, with ~80% of annual revenue underpinned by the backlog at the beginning of the period. Based on our ARR assumptions highlighted above, we model revenue to grow 48% YoY to $415m in 2022; our revenue growth estimate of 48% stands slightly above Darktrace’s guided range of 44.5%-46.5%. We model revenue growth to slow to 32%/28% in 2023/24, mimicking the trend in ARR growth during these periods.


Risks to profitability‌

Given that new customer acquisition will be the key pillar of Darktrace’s ARR growth going forward, the efficiency of customer acquisition and the quality of customers added are key drivers of Darktrace’s profitability. The barriers to entry in segments Darktrace operates in are low, in our view, with several start-ups and established cybersecurity vendors targeting similar use-cases. Darktrace currently leads the network detection and response market and has seen good early success with its email product. However, given the competitive backdrop, there is a risk that customer acquisition and retention may get tougher going forward. If this were to happen, it would translate to higher customer acquisition costs and drive increased investments in existing and new product development – both of which will limit margin leverage, in our view. Early success in the AI-driven threat detection and response market and investment in marketing have helped Darktrace scale rapidly, delivering above-average growth (52% 2018-21 revenue CAGR); looking ahead, we believe investor focus will shift towards how the company balances growth and profitability. Assessing this development through the lens of the ‘Rule of 40’ (revenue growth + FCF margin) is a good indicator of the progress the company is making to sustain profitable growth. We expect the sum of revenue growth and FCF margin to dip and remain below 40% over the next couple of years, which would weigh on Darktrace's valuation compared to other cybersecurity peers that consistently beat this 40% benchmark.

==== Higher cloud deployments likely to pressure gross margins‌ ====
This cost bucket primarily includes costs associated with deploying Darktrace software – either via physical appliances or via cloud. Costs associated with providing customer support and supplementary monitoring and response capabilities (‘concierge’ services). Darktrace does not earn any material revenue from selling physical appliances – the company considers physical appliances as its assets, with the corresponding depreciation logged either as cost of sales (for appliances deployed at contracted customer sites) or as sales and marketing expenses (for appliances used in customer acquisition, i.e. as part of the POV process). With a growing portion of cloud-hosted product sales, the portion of hosting costs will increase. The company expects the increase in hosting costs to be partly offset by a decline in appliance depreciation (substitution effect). We model Darktrace’s cost of sales as % of revenue to increase gradually from 10% in 2021 to 12.5% in 2024.


==== Sales & Marketing expenses likely to remain elevated‌ ====
Darktrace has reported scale efficiencies in its core non-T&E operating costs (excluding share-based comp and associated employer tax charges) in recent years, with total non-T&E operating expenses as a % of revenue declining from 86% in 2020 to 74% in 1H22. This is primarily a function of some scale efficiencies the company has reported in its marketing function. Adding back share-based comp and associated charges, non-T&E opex as % of revenue declined from 91% in 2020 to 84% in 1H22. Margin performance in 1H22 was helped by the following one-off components (these costs will likely return through 2H22/2023):

* Impact from pandemic-related sales hiring delays; Darktrace is still getting back to its normal cadence of salesforce hiring and expects a catch-up in employee costs over the coming months;
* Lower facilities/office costs as the return to office was delayed.  While the company has not quantified the impact from these factors, it notes seeing some scale efficiencies, driven by a more efficient marketing function. The majority of sales and marketing expenses (salaries + 50% sales commissions) associated with revenue generated in a given period are incurred in prior periods (during contract acquisition) – this coupled with some improvement in marketing efficiency has translated to scale efficiencies. Darktrace sees a healthy pipeline of potential new customer opportunities and stable POV conversion rates (although the company has not disclosed this metric). However, we believe it is too early to extrapolate this trend to outer years, given the increase in competitive intensity. Wage inflation is another factor to be considered in assessing the evolution of margin going forward.


==== R&D intensity needs to pick up to create a sustainable moat‌ ====
Non-T&E R&D expenses grew as % of revenue from 6% in 2020 to 8% in 1H22 (although this metric declined from 12% in 2H21). This was partly aided in 1H22 due to capitalization of share-based comp and related tax charges associated with development projects that met the capitalization criteria. One criticism of the Darktrace model has been the low R&D spend, both absolute and as % of revenue, compared to US cybersecurity peers. According to Darktrace, this is due to low R&D employee costs (given the company’s R&D function is primarily based in Cambridge, UK) and relatively lower development expenses needed for maintaining the self-learning cyber AI platform. The argument is that, unlike other cybersecurity companies that rely on historical threat signatures, Darktrace does not need to

constantly update its platform to account for new detected threat signatures; accordingly, the company’s R&D dollars are primarily spent on new product development and research.

While there is substance to this argument, we believe that new product development and platform enhancements will be increasingly important in an environment where technical and product differentiation vs. the competition narrows. This may necessitate higher R&D investment (as % of revenue), going forward, if Darktrace is to maintain its edge over competition. We believe R&D expenses as % of revenue should tick up in 2H22 following the Cybersprint acquisition.

==== Margin leverage likely to be limited through our forecast horizon‌ ====
Non-T&E G&A expenses as % of revenue grew from 13% in 2020 to 20% in 1H22 as a result of higher public company costs post IPO. Darktrace expects G&A to tick up in 2H22 followed by decline from 2023.


Darktrace reported total T&E expenses of $1.8m in 2021, down from $21m in 2020 (normalized 2020 T&E expense is $27-28m). The company reported a lower-than- expected T&E expense in 1H22 of $2.7m – with economies opening up and travel returning to normal, Darktrace expects a steep ramp in T&E expenses in 2H22, returning to a more normalized run-rate.

Factoring-in these assumptions, we model total opex (incl. share-based comp and associated tax charges) as % of revenue to tick up slightly from 97% in 2022 to 100% in 2023 (driven by the full year impact of normalized T&E expenses and normalized salesforce hiring), followed by a decline to 96% in 2024. We model share-based comp and associated employer tax charges to be ~11% of revenue throughout our forecast period.


Given our assumptions on opex, we model continued operating loss throughout our forecast horizon. Even after excluding share-based comp and associated employer tax charges, we do not model any significant improvement in adjusted EBIT margin during our forecast horizon.




Long-term steady-state model‌

Darktrace targets steady-state adjusted EBIT margins in the mid-20s% range in the long term. This will be a function of opex components as % of revenue in the following ranges:




Cost of sales: 10-13%


Sales and marketing: 40-43%


R&D: 10-13%


G&A: 10-13%


The company does not expect to hit these steady-state margin levels in the foreseeable future as it continues to prioritize new customer acquisition.


The pursuit of growth will likely limit margin improvement‌

Adjusted EBITDA is calculated as EBITDA plus share-based comp and associated employer tax charges less appliance depreciation incurred as part of cost of sales (i.e. depreciation of appliances deployed at customer sites). We model adjusted EBITDA of ~$50m in 2022 with ~12% margin, at the high end of Darktrace’s guided range of 10-12%. Darktrace expects a steep dip in adjusted EBITDA margin in 2H22 following 24% margin in 1H22. This is driven by the following factors:




Ramp in T&E expenses;


Significant increase in facilities and office costs in 2H;


Return to normal cadence of salesforce hiring;


We expect Darktrace’s adjusted EBITDA margin to improve from 1H23 following the dip in 2H22; however, the pace of improvement is likely to be gradual as the company will continue to invest in sales and marketing to acquire new customers and in new product development as it seeks to build on its platform strategy with ‘Prevent’ and ‘Heal’ product suites.