Vectra AI Pros and Cons

Vectra AI Pros

LW
reviewer1259193
Head of Information Security at a insurance company with 1,001-5,000 employees
One of the key advantages for us is we define a 24/7 service around it. We use far more of Vectra alerts than we do with our SIEM product because we understand that when we get an alert from Vectra we actually need to do something about it.
View full review »
SW
reviewer1439937
Operational Security Manager at a financial services firm with 1,001-5,000 employees
The most valuable feature for Cognito Detect, the main solution, is that external IDS's create a lot of alerts. When I say a lot of alerts I really mean a lot of alerts. Vectra, on the other hand, contextualizes everything, reducing the number of alerts and pinpointing only the things of interest. This is a key feature for me. Because of this, a non-trained analyst can use it almost right away.
The key feature for me for Detect for Office 365 is that it can also concentrate all the information and detection at one point, the same as the network solution does. This is the key feature for me because, while accessing data from Office 365 is possible using Microsoft interfaces, they are not really user-friendly and are quite confusing to use. But Detect for Office 365 is aggregating all the info, and it's only the interesting stuff.
View full review »
SR
reviewer1296420
Global Security Operations Manager at a manufacturing company with 5,001-10,000 employees
One of the most valuable features of the platform is its ability to provide you with aggregated risk scores based on impact and certainty of threats being detected. This is both applied to individual and host detections. This is important because it enables us to use this platform to prioritize the most likely imminent threats. So, it reduces alert fatigue follow ups for security operation center analysts. It also provides us with an ability to prioritize limited resources.
View full review »
Learn what your peers think about Vectra AI. Get advice and tips from experienced pros sharing their opinions. Updated: April 2021.
502,499 professionals have used our research since 2012.
AG
reviewer1302852
Sr. Specialist - Enterprise Security at a mining and metals company with 5,001-10,000 employees
The solution's ability to reduce alerts, by rolling up numerous alerts to create a single incident or campaign, helps in that it collapses all the events to a particular host, or a particular detection to a set of hosts. So it doesn't generate too many alerts. By and large, whatever alerts it generates are actionable, and actionable within the day.
View full review »
JM
reviewer1362528
Manager, IT Security at a energy/utilities company with 201-500 employees
Vectra produces actionable data using automation. That has helped us. It's less manpower now to look at incidents, which has definitely increased efficiency. Right now, in a lot of cases, our mean time to detection is within zero days. This tells me by the time something happened, and we were able to detect it, it was within the same day.
View full review »
RM
reviewer1263180
Cyber Security Analyst at a financial services firm with 1,001-5,000 employees
It is doing some artificial intelligence. If it sees a server doing a lot of things, then it will assume that is normal. So, it is looking for anomalous behavior, things that are out of context which helps us reduce time. Therefore, we don't have to look in all the logs. We just wait for Vectra to say, "This one is behaving strange," then we can investigate that part.
View full review »
BV
reviewer1444719
Project Manager at a university with 1,001-5,000 employees
It has helped us to organize our security. We get a better overview on what is happening on the network, which has helped us get quicker responses to users. If we see malicious activity, then we can quickly take action on it. Previously, we weren't getting an overview as fast as we are now, so we can now provide a quicker response.
View full review »
John Vicencio
Cyber Specialist, Forensics at Richemont
It gives you access, with Recall, to instant visibility into your network through something like a SIEM solution. For us, being able to correlate all of this network data without having to manage it, has provided immediate value. It gives us the ability to really work on the stuff where I and my team have expertise, instead of having to manage a SIEM solution...
View full review »
Eric Weakland
Director, Information Security at American University
The solution provide visibility into behaviors across the full lifecycle of an attack in our network, beyond just the Internet gateway. It makes our security operations much more effective because we are now looking not just at traffic on the border, but we're looking at east-west internal traffic. Now, not only will we see if an exploit kit is being downloaded, but we would be able to see then if that exploit kit was then laterally distributed into our environment.
View full review »
MH
Headofinfosec82347
Head of Information Security at a retailer with 1,001-5,000 employees
It has reduced the time it takes to respond to attacks. That comes back to the proactive point. It makes us able to lower down in the kill chain, we can react now, rather than reacting to incidents that happened, we can see an instant, in some cases, as it's being implemented, or as it's being launched.
View full review »

Vectra AI Cons

LW
reviewer1259193
Head of Information Security at a insurance company with 1,001-5,000 employees
The solution has not reduced the security analyst workload in our organization because we still need to SIEM. Unfortunately, while Vectra, for us, is a brilliant tool for network investigations, giving wonderful visibility, it doesn't go the whole way to replace our SIEM that is needed for compliance. So, I still have the same amount of alerting and logging that I did before. It gives us more defined ability to see incidents, but it doesn't give us enough information to satisfy a PCI or 27001 audit.
View full review »
SW
reviewer1439937
Operational Security Manager at a financial services firm with 1,001-5,000 employees
Vectra is still limited to packet management. It's only monitoring packet exchanges. While it can see a lot of things, it can't see everything, depending on where it's deployed. It has its limits and that's why I still have my SIEM.
The main improvement I can see would be to integrate with more external solutions.
View full review »
SR
reviewer1296420
Global Security Operations Manager at a manufacturing company with 5,001-10,000 employees
You are always limited with visibility on the host due to the fact that it is a network based tool. It gives you visibility on certain elements of the attack path, but it doesn't necessarily give you visibility on everything. Specifically, the initial intrusion side of things that doesn't necessarily see the initial compromise. It doesn't see stuff that goes on the host, such as where scripts are run. Even though you are seeing traffic, it doesn't necessarily see the malicious payload. Therefore, it's very difficult for it to identify these type of host-driven complex attacks.
View full review »
Learn what your peers think about Vectra AI. Get advice and tips from experienced pros sharing their opinions. Updated: April 2021.
502,499 professionals have used our research since 2012.
AG
reviewer1302852
Sr. Specialist - Enterprise Security at a mining and metals company with 5,001-10,000 employees
One thing which I have found where there could be improvement is with regard to the architecture, a little bit: how the brains and sensors function. It needs more flexibility with regard to the brain. If there were some flexibility in that regard, that would be helpful, because changing the mode of the brain is complex. In some cases, the change is permanent. You cannot revert it.
View full review »
JM
reviewer1362528
Manager, IT Security at a energy/utilities company with 201-500 employees
I would like to see a bit more strategic metrics instead of technical data. Information that I could show to my executive management team or board would be valuable.
View full review »
RM
reviewer1263180
Cyber Security Analyst at a financial services firm with 1,001-5,000 employees
We would like to see more information with the syslogs. The syslogs that they send to our SIEM are a bit short compared to what you can see. It would be helpful if they send us more data that we can incorporate into our SIEM, then can correlate with other events.
View full review »
BV
reviewer1444719
Project Manager at a university with 1,001-5,000 employees
In comparison with a lot of systems I used in the past, the false positives are really a burden because they are taking a lot of time at this moment.
View full review »
John Vicencio
Cyber Specialist, Forensics at Richemont
Some of the customization could be improved. Everything is provided for you as an easy solution to use, but working with it and doing specific development could be worked on a bit more in the scope of an incident response team.
View full review »
Eric Weakland
Director, Information Security at American University
Some of their integrations with other sources of data, like external threat feeds, took a bit more work than I had hoped to get integrated.
View full review »
MH
Headofinfosec82347
Head of Information Security at a retailer with 1,001-5,000 employees
The false positives and the tuning side of it is something that could use improvement. But that could be from our side.
View full review »
Learn what your peers think about Vectra AI. Get advice and tips from experienced pros sharing their opinions. Updated: April 2021.
502,499 professionals have used our research since 2012.