Compare Darktrace vs. Vectra AI

Darktrace is ranked 2nd in Network Traffic Analysis (NTA) with 10 reviews while Vectra AI is ranked 4th in Network Traffic Analysis (NTA) with 2 reviews. Darktrace is rated 7.6, while Vectra AI is rated 8.6. The top reviewer of Darktrace writes "A great solution for threat detection that intelligently and immediately responds to attacks across your enterprise system". On the other hand, the top reviewer of Vectra AI writes "Gives us that extra chance to stop a disaster before it happens". Darktrace is most compared with Cisco Stealthwatch, Vectra AI and CrowdStrike, whereas Vectra AI is most compared with Darktrace, Cisco Stealthwatch and ExtraHop Reveal(x).
Cancel
You must select at least 2 products to compare!
Darktrace Logo
26,342 views|18,950 comparisons
Vectra AI Logo
5,342 views|4,386 comparisons
Most Helpful Review
Find out what your peers are saying about Cisco, Darktrace, Plixer and others in Network Traffic Analysis (NTA). Updated: February 2020.
397,717 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
This solution’s encrypted traffic analysis helps us stay in compliance with government regulations. It is all about understanding data exfiltration, what is ingressing and egressing in our network. One common attack vector is exfiltrating data using encryption. My capabilities to see potential data exfiltration over encrypted traffic is second to none now.Other solutions will say, "Hey, this device is doing something weird." But they don't aggregate that data point with other data points. With Awake you have what's called a "fact pattern." For example, if there's a smart toaster on the third floor that is beaconing out to an IP address in North Korea, sure that's bizarre. But if that toaster was made in North Korea it's not bizarre. Taking those two data points together, and automating something using machine-learning is something that no other solution is doing right now.The query language makes it easy to query the records on the network, to do searches for the various threat activities that we're looking for. The dashboard, the Security Knowledge Graph, displays information meaningfully and easily. I am able to find the information that I want to find pretty quickly.The most valuable feature is the ability to see suspicious activity for devices inside my network. It helps me to quickly identify that activity and do analysis to see if it's expected or I need to mitigate that activity quickly.

Read more »

Ability to see events and exactly what traffic or website the device had tried to connect to that raised the alert or issue.Its most valuable feature is its ability to identify malicious connected IPs from outside and the attacks that get through to the inside.The Dynamic Threat Dashboard is very nice, as it lists all of your threats and rates them, and then you can choose whether to investigate further.The solution is stable. We've never had any problems with it.The most valuable aspect of this solution is that it has very efficient search functionality.A simple, powerful AI solution that just does all the work for you when you turn it on.Darktrace is extremely stable.What I like about Darktrace, is that you can quickly identify threats.

Read more »

It is doing some artificial intelligence. If it sees a server doing a lot of things, then it will assume that is normal. So, it is looking for anomalous behavior, things that are out of context which helps us reduce time. Therefore, we don't have to look in all the logs. We just wait for Vectra to say, "This one is behaving strange," then we can investigate that part.One of the key advantages for us is we define a 24/7 service around it. We use far more of Vectra alerts than we do with our SIEM product because we understand that when we get an alert from Vectra we actually need to do something about it.

Read more »

Cons
I would like to see the capability to import what's known as STIX/TAXII in an IOC format. It currently doesn't offer this.I would like to see a bit more in terms of encrypted traffic. With the advent of programs that live off the land, a smart attacker is going to leverage encryption to execute their operation. So I would like to see improvements there, where possible. Currently, we're not going to be decrypting encrypted traffic. What other approaches could be used?I enjoy the query language, but it could be a bit more user-friendly, especially for new users who come across it... They should push it more into a natural language style as opposed to a query language.There's room for improvement with some of the definitions, because I don't have time and I'm not a Tier 4 analyst. I believe that is something they're working towards.

Read more »

The product doesn't have an endpoint agent that can react to triggers set on the device,Darktrace needs to automate the reports of false positives, botnets and everything.This is quite an expensive product so the pricing is something that can be improved.The solution would benefit from automation. Currently, you have to know what you are searching for.Tracing and correlation of events could be improved.It could build in integrations for some complementary products, but it has an assistant plugin so this is not really a big deal.Darktrace does not have any capabilities to configure.The program is quite expensive.

Read more »

We would like to see more information with the syslogs. The syslogs that they send to our SIEM are a bit short compared to what you can see. It would be helpful if they send us more data that we can incorporate into our SIEM, then can correlate with other events.The solution has not reduced the security analyst workload in our organization because we still need to SIEM. Unfortunately, while Vectra, for us, is a brilliant tool for network investigations, giving wonderful visibility, it doesn't go the whole way to replace our SIEM that is needed for compliance. So, I still have the same amount of alerting and logging that I did before. It gives us more defined ability to see incidents, but it doesn't give us enough information to satisfy a PCI or 27001 audit.

Read more »

Pricing and Cost Advice
The solution has saved thousands of dollars within the first day. Our ROI has to be in the tens of thousands of dollars since October last year.

Read more »

It is inexpensive considering what it can do and the competition.

Read more »

The license is based on the concurrent IP addresses that it's investigating. We are around $300,000 a year for three years. We have 9,800 to 10,000 IP addresses.There are additional features that can be purchased in addition to the standard licensing fee, such as Cognito Recall and Stream.We are running at about 90,000 pounds per year. The solution is a licensed cost. The hardware that they gave us was pretty much next to nothing. It is the license that we're paying for.

Read more »

report
Use our free recommendation engine to learn which Network Traffic Analysis (NTA) solutions are best for your needs.
397,717 professionals have used our research since 2012.
Answers from the Community
Cara Wolf
author avatar
Real User

CylancePROTECT is AI-powered endpoint protection that will scan your endpoint devices with AI and Machine Learning security. It does not work with traditional signature-based protection and will cover your endpoints against the latest malware and event Potential Unwanted Programs. We are also a Darktrace partner and if interested we can demo both Cyber Security solutions to your company. If you are interested in more information about CylancePROTECT and Darktrace and would like to run a free POC, please contact me at cj@groveis.com.

author avatar
Real User

I that feel there are two old problems still there in the market:
1-Vendors don't talk to each other.
2-Whoever is focusing on endpoint is missing the network and human side and the opposite is also true.

I love, for example, what Darktrace is doing in the network side and the playback option to know what happened in my network during a long holiday, for example, things will never be caught by a second-generation AV but I need to have a solid 2nd gen. AV besides the total high cost of Darktrace which by the way is worth it for IT pros but not for business owners.

We need to have something like virus total but for risks and threats beyond viruses where all vendors work on this and all endpoint customers with different vendors connect to it to be secured.

author avatar
Real User

Raffael Marty, Vice President, Forcepoint Research and Intelligence, said: "There is no artificial intelligence in the field of information security, and it is unlikely to be developed in 2019." Most of unsupervised machine learning-based network anomaly detection solution does not provide why the anomaly has been aroused and whether the anomaly is malicious or not. Most of such solution's pricing model is based on number of endpoints but I prefer to have flat fee subscription-based.

author avatar
User

The most important thing to get traction is your business approach and some kind of openness for 3rd parties. NOBODY needs "fancy Dashboards"!

Most of the known vendors like Darktrace is extremely "sales offensive" and they don't have a clear sales strategy (direct or channel). A free POV (30days) is a common approach to attract new customers, but the outcome is not really important. It says nothing about the PAINS on the customer site.

Know your competitors!!!! There are many AI CyberSec Startups and Technologies - 99% are using "Machine Learning" what needs more time to the realtime reaction in critical phases. Preferred is Deep Learning like DeepInstinct offers.

Pricing Model per IP´s is pretty usual - but you need flexibility.

author avatar
User

Thank you I’m not really interested in being sold to. I’m asking about what works, what doesn’t and pricing models. I don’t want any demos.

author avatar
User

Thank you for your comments...what if the malware does not present as anomalous?

author avatar
User

We are an Endpoint focused firm represented a Pyramid of EP based protection services (email & web filter, coupled with EP protection, cyber insurance and dark web monitoring). Our key AI product offering is Cylance, world class in it's ability to protect you where over 95% of all hacks occur, the End Point. Cylance is typically sold as a manged service due to some of the complexities of tailoring the product to fit your business needs. Typically the service is price per EP, per month.

author avatar
User

Thank you, I am familiar with Darktrace and really like the product. I'd like to know your thoughts on additional features and pricing preferences.

Top Comparisons
Compared 60% of the time.
Compared 21% of the time.
Compared 19% of the time.
Compared 9% of the time.
Compared 5% of the time.
Compared 43% of the time.
Compared 13% of the time.
Compared 6% of the time.
Also Known As
AwakeVectra Networks
Learn
Awake Security
Darktrace
Vectra AI
Video Not Available
Overview

Awake Security is the only advanced network traffic analysis company that delivers a privacy-aware solution capable of detecting and visualizing behavioral, mal-intent and compliance incidents with full forensics context. Powered by Ava, Awake’s security expert system, the Awake Security Platform combines federated machine learning, threat intelligence and human expertise. The platform analyzes billions of communications to autonomously discover, profile and classify every device, user and application on any network. Through automated hunting and investigation, Awake uncovers malicious intent from insiders and external attackers alike. The company is ranked #1 for time to value because of its frictionless approach that delivers answers rather than alerts.

Darktrace is the world’s leading machine learning company for cyber security.

Created by mathematicians from the University of Cambridge, Darktrace’s Enterprise Immune System uses AI algorithms that mimic the human immune system to defend enterprise networks of all types and sizes.

Our self-learning approach is the first non-consumer application of machine learning to work at scale, across all network types, from physical, virtualized, and cloud, through to IoT and industrial control systems.

By applying its unique, unsupervised machine learning, Darktrace has identified 30,000 previously unknown threats in over 2,000 networks, including zero-days, insider threats and subtle, stealthy attacks.

Vectra® is the leader in network detection and response – from cloud and data center workloads to user and IoT devices. Its Cognito® platform accelerates threat detection and investigation using artificial intelligence to collect, store and enrich network metadata with the right context to detect, hunt and investigate known and unknown threats in real time. Vectra offers three applications on the Cognito platform to address high-priority use cases. Cognito Stream™ sends security-enriched metadata to data lakes and SIEMs. Cognito Recall™ is a cloud-based application to store and investigate threats in enriched metadata. And Cognito Detect™ uses AI to reveal and prioritize hidden and unknown attackers at speed.

Offer
Identify hidden network threats


Your network may have security risks that you don't know about. Schedule a live demo to see how you can use Awake Security to identify and mitigate these threats.

Learn more about Darktrace
Learn more about Vectra AI
Sample Customers
Coming Soon...Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, VitolTribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association
Top Industries
VISITORS READING REVIEWS
Software R&D Company25%
Comms Service Provider13%
Healthcare Company12%
Financial Services Firm6%
VISITORS READING REVIEWS
Software R&D Company29%
Comms Service Provider13%
Media Company7%
Retailer6%
VISITORS READING REVIEWS
Comms Service Provider24%
Software R&D Company19%
Financial Services Firm9%
Government6%
Find out what your peers are saying about Cisco, Darktrace, Plixer and others in Network Traffic Analysis (NTA). Updated: February 2020.
397,717 professionals have used our research since 2012.
We monitor all Network Traffic Analysis (NTA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.