Compare Cisco Stealthwatch vs. Darktrace

Cisco Stealthwatch is ranked 1st in Network Traffic Analysis (NTA) with 39 reviews while Darktrace is ranked 2nd in Network Traffic Analysis (NTA) with 10 reviews. Cisco Stealthwatch is rated 8.0, while Darktrace is rated 7.6. The top reviewer of Cisco Stealthwatch writes "You are able to drill down into a center's utilization, then create reports based on it". On the other hand, the top reviewer of Darktrace writes "A great solution for threat detection that intelligently and immediately responds to attacks across your enterprise system". Cisco Stealthwatch is most compared with Darktrace, Splunk User Behavior Analytics and Cisco Stealthwatch Cloud, whereas Darktrace is most compared with Cisco Stealthwatch, Vectra AI and CrowdStrike. See our Cisco Stealthwatch vs. Darktrace report.
Cancel
You must select at least 2 products to compare!
Cisco Stealthwatch Logo
24,729 views|15,348 comparisons
Darktrace Logo
26,342 views|18,950 comparisons
Most Helpful Review
Find out what your peers are saying about Cisco Stealthwatch vs. Darktrace and other solutions. Updated: January 2020.
399,540 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
This solution’s encrypted traffic analysis helps us stay in compliance with government regulations. It is all about understanding data exfiltration, what is ingressing and egressing in our network. One common attack vector is exfiltrating data using encryption. My capabilities to see potential data exfiltration over encrypted traffic is second to none now.Other solutions will say, "Hey, this device is doing something weird." But they don't aggregate that data point with other data points. With Awake you have what's called a "fact pattern." For example, if there's a smart toaster on the third floor that is beaconing out to an IP address in North Korea, sure that's bizarre. But if that toaster was made in North Korea it's not bizarre. Taking those two data points together, and automating something using machine-learning is something that no other solution is doing right now.The query language makes it easy to query the records on the network, to do searches for the various threat activities that we're looking for. The dashboard, the Security Knowledge Graph, displays information meaningfully and easily. I am able to find the information that I want to find pretty quickly.The most valuable feature is the ability to see suspicious activity for devices inside my network. It helps me to quickly identify that activity and do analysis to see if it's expected or I need to mitigate that activity quickly.

Read more »

The most valuable feature is anomaly detection, where it finds things that are not allowed internally.Most of the engineers I've worked with have been really good. Very knowledgeable and easy to work with.Being able to graph and show data to management has improved our organization. We can show the data to the higher-ups. It shows them that it's picking up on these anomalies and doing its job.It's a dependable product that is able to pinpoint where we have vulnerabilities if they occur.Using the Cognitive Analytics feature, we have complete visibility that we didn’t have before.The most valuable feature about this solution is that it gives me insight of my network.It has improved our internal knowledge of what's going on with the network, and that's helpful.The most valuable features of this solution are the logging, keeping threats under control, and keeping our data and environment secure.

Read more »

Ability to see events and exactly what traffic or website the device had tried to connect to that raised the alert or issue.Its most valuable feature is its ability to identify malicious connected IPs from outside and the attacks that get through to the inside.The Dynamic Threat Dashboard is very nice, as it lists all of your threats and rates them, and then you can choose whether to investigate further.The solution is stable. We've never had any problems with it.The most valuable aspect of this solution is that it has very efficient search functionality.A simple, powerful AI solution that just does all the work for you when you turn it on.Darktrace is extremely stable.What I like about Darktrace, is that you can quickly identify threats.

Read more »

Cons
I would like to see the capability to import what's known as STIX/TAXII in an IOC format. It currently doesn't offer this.I would like to see a bit more in terms of encrypted traffic. With the advent of programs that live off the land, a smart attacker is going to leverage encryption to execute their operation. So I would like to see improvements there, where possible. Currently, we're not going to be decrypting encrypted traffic. What other approaches could be used?I enjoy the query language, but it could be a bit more user-friendly, especially for new users who come across it... They should push it more into a natural language style as opposed to a query language.There's room for improvement with some of the definitions, because I don't have time and I'm not a Tier 4 analyst. I believe that is something they're working towards.

Read more »

The usability of this solution needs to be improved.We've run into some issues with the configuration.They should include Citrix VDIs in the next release.The GUI could use some improvement. Being able to find features more easily would be a great improvement if it was simplified.The initial setup is complex, as there is a lot to configure.It hasn't really improved our direct detection rate but it has definitely reduced our incident response time as we wouldn't have been able to detect threats or immediate risks without this solution.I would like to see more and cleaner reporting. For example, if I pull up Steven and I want to look and maybe compare him to what you've done in the past week, and compare that to the past six months, the point would be to see what the difference in activity looks like over this time. I don't see that capability in reporting to date. You see that trend but you don't really see a straightforward comparison. That right there is key to what we want to see about the normal activity.It is time-consuming to set it up and understand how the tool works.

Read more »

The product doesn't have an endpoint agent that can react to triggers set on the device,Darktrace needs to automate the reports of false positives, botnets and everything.This is quite an expensive product so the pricing is something that can be improved.The solution would benefit from automation. Currently, you have to know what you are searching for.Tracing and correlation of events could be improved.It could build in integrations for some complementary products, but it has an assistant plugin so this is not really a big deal.Darktrace does not have any capabilities to configure.The program is quite expensive.

Read more »

Pricing and Cost Advice
The solution has saved thousands of dollars within the first day. Our ROI has to be in the tens of thousands of dollars since October last year.

Read more »

Our fees are approximately $3,000 USD.Licensing is on a yearly basis.We pay for support costs on a yearly basis.On a yearly basis, licensing is somewhere around $30,000.The yearly licensing cost is about $50,000.The pricing for this solution is good.The licensing costs are outrageous.Today, we are part of the big Cisco ELA, and it is a la carte. We can get orders for whatever we want. At the end of the day, we have to pay for it in one big expense, but that is fine. We are okay with that.

Read more »

It is inexpensive considering what it can do and the competition.

Read more »

report
Use our free recommendation engine to learn which Network Traffic Analysis (NTA) solutions are best for your needs.
399,540 professionals have used our research since 2012.
Answers from the Community
Cara Wolf
author avatarC.J. Oosthuizen
Real User

CylancePROTECT is AI-powered endpoint protection that will scan your endpoint devices with AI and Machine Learning security. It does not work with traditional signature-based protection and will cover your endpoints against the latest malware and event Potential Unwanted Programs. We are also a Darktrace partner and if interested we can demo both Cyber Security solutions to your company. If you are interested in more information about CylancePROTECT and Darktrace and would like to run a free POC, please contact me at cj@groveis.com.

author avatarImadTaha
Real User

I that feel there are two old problems still there in the market:
1-Vendors don't talk to each other.
2-Whoever is focusing on endpoint is missing the network and human side and the opposite is also true.

I love, for example, what Darktrace is doing in the network side and the playback option to know what happened in my network during a long holiday, for example, things will never be caught by a second-generation AV but I need to have a solid 2nd gen. AV besides the total high cost of Darktrace which by the way is worth it for IT pros but not for business owners.

We need to have something like virus total but for risks and threats beyond viruses where all vendors work on this and all endpoint customers with different vendors connect to it to be secured.

author avatarCEO & Founder at a tech services company with 1-10 employees
Real User

Raffael Marty, Vice President, Forcepoint Research and Intelligence, said: "There is no artificial intelligence in the field of information security, and it is unlikely to be developed in 2019." Most of unsupervised machine learning-based network anomaly detection solution does not provide why the anomaly has been aroused and whether the anomaly is malicious or not. Most of such solution's pricing model is based on number of endpoints but I prefer to have flat fee subscription-based.

author avatarJürgen Weiss
User

The most important thing to get traction is your business approach and some kind of openness for 3rd parties. NOBODY needs "fancy Dashboards"!

Most of the known vendors like Darktrace is extremely "sales offensive" and they don't have a clear sales strategy (direct or channel). A free POV (30days) is a common approach to attract new customers, but the outcome is not really important. It says nothing about the PAINS on the customer site.

Know your competitors!!!! There are many AI CyberSec Startups and Technologies - 99% are using "Machine Learning" what needs more time to the realtime reaction in critical phases. Preferred is Deep Learning like DeepInstinct offers.

Pricing Model per IP´s is pretty usual - but you need flexibility.

author avatarCara Wolf
User

Thank you I’m not really interested in being sold to. I’m asking about what works, what doesn’t and pricing models. I don’t want any demos.

author avatarCara Wolf
User

Thank you for your comments...what if the malware does not present as anomalous?

author avatarMarkBarrett
User

We are an Endpoint focused firm represented a Pyramid of EP based protection services (email & web filter, coupled with EP protection, cyber insurance and dark web monitoring). Our key AI product offering is Cylance, world class in it's ability to protect you where over 95% of all hacks occur, the End Point. Cylance is typically sold as a manged service due to some of the complexities of tailoring the product to fit your business needs. Typically the service is price per EP, per month.

author avatarCara Wolf
User

Thank you, I am familiar with Darktrace and really like the product. I'd like to know your thoughts on additional features and pricing preferences.

Top Comparisons
Compared 60% of the time.
Compared 21% of the time.
Compared 25% of the time.
Compared 19% of the time.
Compared 9% of the time.
Compared 5% of the time.
Also Known As
AwakeCisco Stealthwatch Enterprise, Lancope StealthWatch
Learn
Awake Security
Cisco
Darktrace
Overview

Awake Security is the only advanced network traffic analysis company that delivers a privacy-aware solution capable of detecting and visualizing behavioral, mal-intent and compliance incidents with full forensics context. Powered by Ava, Awake’s security expert system, the Awake Security Platform combines federated machine learning, threat intelligence and human expertise. The platform analyzes billions of communications to autonomously discover, profile and classify every device, user and application on any network. Through automated hunting and investigation, Awake uncovers malicious intent from insiders and external attackers alike. The company is ranked #1 for time to value because of its frictionless approach that delivers answers rather than alerts.

Cisco Stealthwatch uses NetFlow to provide visibility across the network, data center, branch offices, and cloud. Its advanced security analytics uncover stealthy attacks on the extended network. Stealthwatch helps you use your existing network as a security sensor and enforcer to dramatically improve your threat defense.

Darktrace is the world’s leading machine learning company for cyber security.

Created by mathematicians from the University of Cambridge, Darktrace’s Enterprise Immune System uses AI algorithms that mimic the human immune system to defend enterprise networks of all types and sizes.

Our self-learning approach is the first non-consumer application of machine learning to work at scale, across all network types, from physical, virtualized, and cloud, through to IoT and industrial control systems.

By applying its unique, unsupervised machine learning, Darktrace has identified 30,000 previously unknown threats in over 2,000 networks, including zero-days, insider threats and subtle, stealthy attacks.

Offer
Identify hidden network threats


Your network may have security risks that you don't know about. Schedule a live demo to see how you can use Awake Security to identify and mitigate these threats.

Learn more about Cisco Stealthwatch
Learn more about Darktrace
Sample Customers
Coming Soon...Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREFIrwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol
Top Industries
VISITORS READING REVIEWS
Software R&D Company23%
Comms Service Provider13%
Healthcare Company11%
Marketing Services Firm7%
REVIEWERS
Healthcare Company24%
Financial Services Firm16%
Manufacturing Company8%
University5%
VISITORS READING REVIEWS
Comms Service Provider23%
Software R&D Company18%
Government7%
Financial Services Firm6%
VISITORS READING REVIEWS
Software R&D Company28%
Comms Service Provider14%
Media Company7%
Retailer6%
Find out what your peers are saying about Cisco Stealthwatch vs. Darktrace and other solutions. Updated: January 2020.
399,540 professionals have used our research since 2012.
We monitor all Network Traffic Analysis (NTA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.