Best Network Detection and Response (NDR) Software

How Many Network Detection and Response (NDR) Software Products Does G2 Track?

Total Products under this Category: 78

Category Stats (Sep 2026)

  • Average Rating: 4.39/5 The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: BluSapphire OnePlatform (+1.05%) - Among all products in this category, BluSapphire OnePlatform recorded the largest rating increase compared to last month

Last updated: September 01, 2026

How Does G2 Rank Network Detection and Response (NDR) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 1,600+ Authentic Reviews
  • 78+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Network Detection and Response (NDR) Software

G2 Grid® for Network Detection and Response (NDR) Software plotting products by satisfaction and market presence

Highlighted products: Progress WhatsUp Gold, Sophos NDR, TrendAI Vision One, Cortex XDR, Darktrace / NETWORK, ExtraHop, Rapid7 Next-Gen SIEM, and ManageEngine ADAudit Plus.

Underlying data: [Grid® JSON](https://www.g2.com/categories/network-detection-and-response-ndr/grids.json?focus%5B%5D=progress-whatsup-gold&focus%5B%5D=sophos-ndr&focus%5B%5D=trendai-vision-one&focus%5B%5D=palo-alto-networks-cortex-xdr&focus%5B%5D=darktrace-network&focus%5B%5D=extrahop&focus%5B%5D=rapid7-next-gen-siem&focus%5B%5D=manageengine-adaudit-plus)

Progress WhatsUp Gold

WhatsUp Gold is an IT infrastructure monitoring software designed to help users identify and resolve network issues swiftly, often before they impact end users. This solution provides comprehensive visibility into network performance and availability, enabling IT professionals to maintain optimal operations across their infrastructure. With its interactive mapping interface, WhatsUp Gold allows users to visualize the status of all devices connected to their network, making it easier to monitor both on-premise and cloud-based resources. Targeted primarily at IT administrators and network engineers, WhatsUp Gold is particularly beneficial for organizations that rely heavily on network performance for their daily operations. Its user-friendly design caters to both seasoned professionals and those new to network management, offering a range of features that streamline the monitoring process. The software is designed to support various use cases, from small businesses needing basic monitoring capabilities to large enterprises requiring advanced network management solutions. One of the standout features of WhatsUp Gold is its customizable drag-and-drop dashboards, which provide users with the flexibility to tailor their monitoring experience according to specific needs. These dashboards present real-time data on device status and performance, allowing users to quickly assess the health of their network. Additionally, the software’s automatic discovery and mapping capabilities enable users to visualize their entire network topology, ensuring that no device goes unnoticed during monitoring. WhatsUp Gold also emphasizes optimization, helping users manage network traffic and bandwidth utilization effectively. By providing actionable insights and unified views of network performance, the software empowers IT teams to troubleshoot issues efficiently. The ability to identify and resolve network and server problems proactively not only enhances operational efficiency but also improves overall user satisfaction by minimizing downtime. In summary, WhatsUp Gold offers a robust and interactive solution for IT infrastructure monitoring, combining ease of use with powerful features. Its focus on real-time visibility, customization, and proactive troubleshooting makes it a valuable tool for organizations looking to enhance their network management capabilities.

Average Rating: 4.4/5.0

Total Reviews: 379

How Do G2 Users Rate Progress WhatsUp Gold?

  • Quality of Support: 8.8/10 (Category avg: 8.9/10)

Who Is the Company Behind Progress WhatsUp Gold?

  • Seller: Progress Software
  • Company Website:
  • Year Founded: 1981
  • HQ Location: Burlington, MA.
  • Twitter: @ProgressSW
    48,773 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    4,242 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Network Engineer, Network Administrator
  • Top Industries: Information Technology and Services, Education Management
  • Company Size: 58% Medium, 27% Large

What Do G2 Reviewers Say About Progress WhatsUp Gold?

AI-generated summary from verified user reviews

Pros
  • Users value the ease of use of Progress WhatsUp Gold, appreciating its intuitive interface and simple setup process.
  • Users love the real-time visibility provided by WhatsUp Gold’s interactive network maps and intuitive dashboards.
  • Users value the real-time visibility and ease of use provided by Progress WhatsUp Gold for network performance monitoring.
  • Users value the timely and proactive alert notifications of Progress WhatsUp Gold, enhancing issue detection and network reliability.
  • Users appreciate the intuitive user interface of Progress WhatsUp Gold, enhancing real-time network monitoring and management.
Cons
  • Users find the cost of Progress WhatsUp Gold to be high, especially for smaller organizations and add-ons.
  • Users find the poor interface design of Progress WhatsUp Gold can be clunky and outdated in complex setups.
  • Users find the complex setup process of Progress WhatsUp Gold to be cumbersome and challenging, especially for advanced configurations.
  • Users note a steep learning curve with Progress WhatsUp Gold, particularly for advanced configuration and initial setup.
  • Users find the interface outdated, especially when managing complex environments, impacting overall user experience.

What Are Recent G2 Reviews of Progress WhatsUp Gold?

What Are G2 Users Discussing About Progress WhatsUp Gold?

Sophos NDR

Sophos NDR works together with your managed endpoints and firewalls to monitor network activity for suspicious and malicious patterns they cannot see. It detects abnormal traffic flows from unmanaged systems and IoT devices, rogue assets, insider threats, previously unseen zero-day attacks, and unusual patterns deep within the network.

Average Rating: 4.8/5.0

Total Reviews: 16

How Do G2 Users Rate Sophos NDR?

  • Metadata Enrichment: 9.8/10 (Category avg: 8.5/10)
  • Quality of Support: 9.9/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 9.8/10 (Category avg: 8.6/10)
  • Network Visibility: 9.4/10 (Category avg: 8.9/10)

Who Is the Company Behind Sophos NDR?

  • Seller: Sophos
  • Year Founded: 1985
  • HQ Location: Oxfordshire
  • Twitter: @Sophos
    36,759 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    5,550 employees on LinkedIn®
  • Ownership: LSE:SOPH

Who Uses This Product?

  • Top Industries: Information Technology and Services
  • Company Size: 100% Small, 6% Medium

What Are Recent G2 Reviews of Sophos NDR?

TrendAI Vision One

TrendAI Vision One is a cloud-native security operations platform, serving cloud, hybrid, and on-premises environments. It combines ASM and XDR in a single console to effectively manage cyber risk across your organization. The platform provides powerful risk insights, earlier threat detection, and automated risk and threat response options. Utilize the platform’s predictive machine learning and advanced security analytics for a broader perspective and advanced context. TrendAI Vision One integrates with its own expansive protection platform portfolio and industry-leading global threat intelligence, in addition to a broad ecosystem of purpose-built and API-driven third-party integrations.

Average Rating: 4.7/5.0

Total Reviews: 246

How Do G2 Users Rate TrendAI Vision One?

  • Metadata Enrichment: 7.2/10 (Category avg: 8.5/10)
  • Quality of Support: 8.7/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 8.1/10 (Category avg: 8.6/10)
  • Network Visibility: 8.7/10 (Category avg: 8.9/10)

Who Is the Company Behind TrendAI Vision One?

  • Seller: TrendAI
  • Company Website:
  • Year Founded: 1988
  • HQ Location: Tokyo
  • LinkedIn® Page: www.linkedin.com
    7,996 employees on LinkedIn®
  • Ownership: OTCMKTS:TMICY

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 52% Large, 34% Medium

What Do G2 Reviewers Say About TrendAI Vision One?

AI-generated summary from verified user reviews

Pros
  • Users benefit from centralized visibility across environments, enhancing risk management and simplifying security analysis and monitoring.
  • Users appreciate the intuitive and unified security dashboard of TrendAI Vision One for seamless monitoring and response.
  • Users appreciate the ease of use of TrendAI Vision One, simplifying security management with intuitive dashboards and automation.
  • Users value the centralized cloud management of TrendAI Vision One, highlighting its ease of setup and integration.
  • Users value the unified threat detection capabilities of TrendAI Vision One, enhancing cybersecurity and reducing alert fatigue.
Cons
  • Users find the interface complex and suggest improving third-party integrations for better usability and accessibility.
  • Users experience integration issues with third-party tools, making the platform less flexible and user-friendly.
  • Users face a steep learning curve with TrendAI Vision One, which complicates setup and effective usage of features.
  • Users note the high cost of TrendAI Vision One compared to competitors, impacting overall value perception.
  • Users feel the limited features of TrendAI Vision One hinder reporting capabilities and integration options.

What Are Recent G2 Reviews of TrendAI Vision One?

What Are G2 Users Discussing About TrendAI Vision One?

Cortex XDR

Cortex XDR is the industry’s first extended detection and response platform that stops modern attacks by integrating data from any source. With Cortex XDR, you can harness the power of AI, analytics and rich data to detect stealthy threats. Your SOC team can cut through the noise and focus on what matters most with intelligent alert grouping and incident scoring. Cross-data insights accelerate investigations, so you can streamline incident response and recovery. Cortex XDR delivers peace of mind with best-in-class endpoint protection that achieved the highest combined protection and detection scores in the MITRE ATT&CK® round 3 evaluation. The Cortex XDR platform collects and analyzes all data, so you can gain complete visibility and holistic protection to secure what’s next.

Average Rating: 4.5/5.0

Total Reviews: 82

How Do G2 Users Rate Cortex XDR?

  • Metadata Enrichment: 10.0/10 (Category avg: 8.5/10)
  • Quality of Support: 8.7/10 (Category avg: 8.9/10)
  • Network Visibility: 10.0/10 (Category avg: 8.9/10)

Who Is the Company Behind Cortex XDR?

  • Seller: Palo Alto Networks
  • Company Website:
  • Year Founded: 2005
  • HQ Location: Santa Clara, CA
  • Twitter: @PaloAltoNtwks
    128,951 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    23,492 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer & Network Security, Information Technology and Services
  • Company Size: 41% Medium, 40% Large

What Do G2 Reviewers Say About Cortex XDR?

AI-generated summary from verified user reviews

Pros
  • Users find the ease of use of Cortex XDR exceptional, appreciating its intuitive interface and effective management.
  • Users value the rapid and accurate threat detection capabilities of Cortex XDR, enhancing their cybersecurity experience.
  • Users value the unified detection and response capability of Cortex XDR, enhancing threat investigation efficiency and accuracy.
  • Users value the intelligent alert system of Cortex XDR, which minimizes unnecessary notifications and enhances focus.
  • Users value the advanced AI technology in Cortex XDR, which delivers relevant alerts without overwhelming notifications.
Cons
  • Users experience a noticeable performance impact on lower-end systems when using the Cortex XDR agent.
  • Users face compatibility issues with Cortex XDR, limiting the installation of certain essential software on their systems.
  • Users find the complexity of Cortex XDR challenging, especially when customizing detections and tuning policies.
  • Users find the management complexity of Cortex XDR challenging, with a steep learning curve for policy tuning.
  • Users find the difficult learning curve of Cortex XDR challenging, especially when tuning policies and customizing detections.

What Are Recent G2 Reviews of Cortex XDR?

What Are G2 Users Discussing About Cortex XDR?

Darktrace / NETWORK

Darktrace / NETWORK™ is the industry’s most advanced Network Detection and Response (NDR) solution. It learns what normal behavior is for your entire modern network, using Self-Learning AI to detect and autonomously contain any activity that could cause business disruption including known, novel and insider threats. - Sophisticated agentic AI to automate triage and investigation at speed and scale - Recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for NDR - Over 10,000 customers globally

Average Rating: 4.5/5.0

Total Reviews: 44

How Do G2 Users Rate Darktrace / NETWORK?

  • Metadata Enrichment: 9.3/10 (Category avg: 8.5/10)
  • Quality of Support: 9.2/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 9.3/10 (Category avg: 8.6/10)
  • Network Visibility: 9.3/10 (Category avg: 8.9/10)

Who Is the Company Behind Darktrace / NETWORK?

  • Seller: Darktrace
  • Company Website:
  • Year Founded: 2013
  • HQ Location: Cambridgeshire, England
  • Twitter: @Darktrace
    18,177 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    2,597 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Financial Services, Information Technology and Services
  • Company Size: 60% Medium, 32% Large

What Do G2 Reviewers Say About Darktrace / NETWORK?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the excellent monitoring capabilities of Darktrace, offering impressive visibility and efficient network analysis.
  • Users appreciate the self-learning AI technology of Darktrace/Network, effectively adapting to threats without extensive configuration.
  • Users commend Darktrace's rapid threat detection, ensuring robust security with minimal manual intervention for maximum efficiency.
  • Users commend the responsive customer support of Darktrace/Network, enhancing learning and facilitating efficient troubleshooting.
  • Users highlight the autonomous AI-driven cybersecurity of Darktrace, which effectively detects and responds to threats in real time.
Cons
  • Users report a significant learning curve with Darktrace as the AI generates numerous alerts during initial setup.
  • Users note that the product can be expensive, particularly for smaller organizations with constrained budgets and significant training costs.
  • Users experience alert issues with Darktrace, needing extensive manual tuning to manage false positives during the learning phase.
  • Users find the complex setup of Darktrace challenging, requiring skilled teams for effective management and configuration.
  • Users experience false positives occasionally, requiring IT support to resolve issues affecting network connectivity.

What Are Recent G2 Reviews of Darktrace / NETWORK?

What Are G2 Users Discussing About Darktrace / NETWORK?

ExtraHop

ExtraHop is the cybersecurity partner enterprises trust to reveal cyber risk and build business resilience. The ExtraHop RevealX platform for network detection and response and network performance management uniquely delivers the instant visibility and unparalleled decryption capabilities organizations need to expose the cyber risks and performance issues that other tools can’t see. When organizations have full network transparency with ExtraHop, they can investigate smarter, stop threats faster, and keep operations running. RevealX deploys on premises or in the cloud. It addresses the following use cases: - Ransomware - Zero trust - Software supply chain attacks - Lateral movement and C2 communication - Security hygiene - Network and Application Performance Management - IDS - Forensics and more A few of our differentiators: Continuous and on-demand PCAP: Full packet processing is superior to NetFlow and yields higher quality detections. Strategic decryption across a variety of protocols, including SSL/TLS, MS-RPC, WinRM, and SMBv3, gives you better visibility into early-stage threats hiding in encrypted traffic as they attempt to move laterally across your network. Protocol coverage: RevealX decodes more than 70 network protocols. Cloud-scale machine learning: Rather than relying on limited "on-box" compute power for analysis and detections, RevealX uses sophisticated cloud-hosted and cloud-scale machine learning workloads to identify suspicious behavior in real time and create high-fidelity alerts. ExtraHop was named a Leader in The Forrester Wave™: Network Analysis and Visibility, Q2 2023. Key Technology Integration and Go-to-Market Partners: CrowdStrike: RevealX integrates with CrowdStrike Falcon® LogScale, Falcon Insight XDR, Falcon Threat Graph, and Falcon Intelligence. Splunk SOAR AWS Google Cloud Security Founded in 2007, ExtraHop is privately held and headquartered in Seattle, Wash. To learn more, visit www.extrahop.com.

Average Rating: 4.6/5.0

Total Reviews: 68

How Do G2 Users Rate ExtraHop?

  • Metadata Enrichment: 9.1/10 (Category avg: 8.5/10)
  • Quality of Support: 9.0/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 9.3/10 (Category avg: 8.6/10)
  • Network Visibility: 9.8/10 (Category avg: 8.9/10)

Who Is the Company Behind ExtraHop?

  • Seller: ExtraHop Networks
  • Year Founded: 2007
  • HQ Location: Seattle, Washington
  • Twitter: @ExtraHop
    10,695 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    774 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Hospital & Health Care, Transportation/Trucking/Railroad
  • Company Size: 69% Large, 26% Medium

What Do G2 Reviewers Say About ExtraHop?

AI-generated summary from verified user reviews

Pros
  • Users value the all-in-one monitoring solution of ExtraHop, appreciating its comprehensive visibility and insightful analysis of network traffic.
  • Users value the comprehensive monitoring capabilities of ExtraHop, enhancing network visibility and analysis effectively.
  • Users appreciate the easy deployment of ExtraHop, benefiting from seamless installation on both physical and virtual networks.
  • Users value the responsive support from ExtraHop's knowledgeable Customer Success teams, enhancing their overall experience and satisfaction.

What Are Recent G2 Reviews of ExtraHop?

What Are G2 Users Discussing About ExtraHop?

Rapid7 Next-Gen SIEM

Rapid7 InsightIDR is a SaaS SIEM for modern threat detection and response. InsightIDR enables security analysts to work more efficiently and effectively, by unifying diverse data sources, providing early and reliable out of the box detections, and delivering rich visual investigations and automation to expedite response. With a lightweight cloud deployment and intuitive UI and onboarding experience, InsightIDR customers recognize an accelerated return on their investment and start seeing valuable insights from Day 1. With InsightIDR, teams can advance their threat detection and response program without adding headcount.

Average Rating: 4.4/5.0

Total Reviews: 68

How Do G2 Users Rate Rapid7 Next-Gen SIEM?

  • Metadata Enrichment: 8.3/10 (Category avg: 8.5/10)
  • Quality of Support: 8.9/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 8.0/10 (Category avg: 8.6/10)
  • Network Visibility: 9.0/10 (Category avg: 8.9/10)

Who Is the Company Behind Rapid7 Next-Gen SIEM?

  • Seller: Rapid7
  • Year Founded: 2000
  • HQ Location: Boston, MA
  • Twitter: @rapid7
    124,405 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    8,746 employees on LinkedIn®
  • Ownership: NASDAQ:RPD

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 68% Medium, 31% Large

What Do G2 Reviewers Say About Rapid7 Next-Gen SIEM?

AI-generated summary from verified user reviews

Pros
  • Users find the ease of use of Rapid7 Next-Gen SIEM unparalleled, with simple implementation and clear alerts.
  • Users appreciate the easy integrations of Rapid7 Next-Gen SIEM, benefiting from pre-built connections with numerous third-party tools.
  • Users appreciate the pre-built integrations of Rapid7 Next-Gen SIEM, making it easy to connect with various third-party tools.
  • Users appreciate the seamless integration of UEBA and deception tools for efficient threat detection across the network.
  • Users value the excellent visibility provided by Rapid7 Next-Gen SIEM, enabling easy log searches and clear alerts.
Cons
  • Users find the limited features of Rapid7 Next-Gen SIEM restrict overall functionality and alert setup capabilities.
  • Users find the alerting issues cumbersome, particularly when trying to create and set up pattern-based alerts.
  • Users find the limited alert management capabilities frustrating, complicating the creation of effective and timely alerts.
  • Users find the difficult customization in Rapid7 Next-Gen SIEM limits their ability to create effective alerts.
  • Users find the difficult setup of Rapid7 Next-Gen SIEM hinders effective alert creation and pattern configurations.

What Are Recent G2 Reviews of Rapid7 Next-Gen SIEM?

What Are G2 Users Discussing About Rapid7 Next-Gen SIEM?

ManageEngine ADAudit Plus

ADAudit Plus is a UBA-driven auditor that helps keep your AD, Azure AD, file systems (including Windows, NetApp, EMC, Synology, Hitachi, and Huawei), Windows servers, and workstations secure and compliant. ADAudit Plus transforms raw and noisy event log data into real-time reports and alerts, enabling you to get full visibility into activities happening across your Windows Server ecosystem in just a few clicks. More than 10,000 organizations across the world trust ADAudit Plus to: 1. Instantly notify them about changes in their Windows Server environments. 2. Continuously track Windows user logon activity. 3. Monitor the active and idle time spent by employees at their workstations. 4. Detect and troubleshoot AD account lockouts. 5. Provide a consolidated audit trail of privileged user activities across their domains. 6. Track changes and sign-ins in Azure AD. 7. Audit file accesses across Windows, NetApp, EMC, Synology, Hitachi, and Huawei file systems. 8. Monitor file integrity across local files residing on Windows systems. 9. Mitigate insider threats by leveraging UBA and response automation. 10. Generate audit-ready compliance reports for SOX, the GDPR, and other IT mandates.

Average Rating: 4.6/5.0

Total Reviews: 61

How Do G2 Users Rate ManageEngine ADAudit Plus?

  • Metadata Enrichment: 5.8/10 (Category avg: 8.5/10)
  • Quality of Support: 8.3/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 6.7/10 (Category avg: 8.6/10)
  • Network Visibility: 5.8/10 (Category avg: 8.9/10)

Who Is the Company Behind ManageEngine ADAudit Plus?

  • Seller: Zoho
  • Year Founded: 1996
  • HQ Location: Austin, TX
  • Twitter: @Zoho
    137,880 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    30,913 employees on LinkedIn®
  • Phone: +1 (888) 900-9646

Who Uses This Product?

  • Top Industries: Hospital & Health Care, Information Technology and Services
  • Company Size: 61% Medium, 31% Large

What Do G2 Reviewers Say About ManageEngine ADAudit Plus?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the depth of visibility and reporting options provided by ManageEngine ADAudit Plus for Active Directory.
  • Users appreciate the user-friendly dashboard of ManageEngine ADAudit Plus, enhancing navigation and providing valuable insights.
  • Users appreciate the easy setup and extensive reporting options of ManageEngine ADAudit Plus for efficient Active Directory management.
  • Users appreciate the intuitive overview provided by ADAudit Plus's dashboard, enhancing their Active Directory management experience.
  • Users value the insightful dashboard of ADAudit Plus, which offers extensive reporting options and useful auditing features.
Cons
  • Users find the limited alert levels in ADAudit Plus restricting, wishing for more options to fine-tune notifications.
  • Users find the data overload challenge due to many reporting options, though a search feature helps alleviate this issue.
  • Users note the high cost of ManageEngine ADAudit Plus, which some feel isn't justified by its support quality.
  • Users find that false positives can be overwhelming, but a search feature helps manage report navigation.
  • Users are concerned about the high resource usage of ManageEngine ADAudit Plus, impacting overall system performance.

What Are Recent G2 Reviews of ManageEngine ADAudit Plus?

What Are G2 Users Discussing About ManageEngine ADAudit Plus?

Heimdal

Accommodate all your cybersecurity needs under one convenient roof with the Heimdal® Unified Cybersecurity Platform. Our cybersecurity solutions can be used as standalone products or integrated into one another as part of a cohesive and unified XDR platform. Whether you’re a reseller, distributor, MSSP, or an organization committed to bolstering your online security, we provide an array of cutting-edge products to make your mission smoother. Heimdal® is a fast-growing cybersecurity company focused on continuous technological innovation. Since its establishment in 2014 in Copenhagen, based on the winning idea of CTF World Champions, Heimdal has experienced spectacular growth by proactively building products that anticipate threatscape trends. The company offers a multi-layeredand unified security suite that combines threat prevention, patch and asset management, endpoint rights management, antivirus and mail security which together secure customers against cyberattacks and keep critical information and intellectual property safe. Heimdal has been recognized as a thought leader in the industry and has won multiple international awards both for its solutions and for its educational content creation. The Heimdal line of products currently consists of 10 products and 2 services. The former category encompasses DNS Security for Endpoints & Network, Patch & Asset Management, Privileged Access Management, Application Control, Next-Gen Endpoint Antivirus, Ransomware Encryption Protection, Email Security, Email Fraud Prevention, and Remote Desktop. The latter is represented by Endpoint Detection & Response, as well as eXtended Detection & Response, or EDR and XDR for short. Currently, Heimdal’s cybersecurity solutions are deployed in more than 45 countries and supported regionally from offices in 15+ countries, by 175+ highly qualified specialists. Heimdal is ISAE 3000 certified and secures more than 2 million endpoints for over 10,000 companies. The company supports its partners without concessions on the basis of predictability and scalability. The common goal is to create a sustainable ecosystem and a strategic partnership.

Average Rating: 4.4/5.0

Total Reviews: 80

How Do G2 Users Rate Heimdal?

  • Quality of Support: 9.5/10 (Category avg: 8.9/10)

Who Is the Company Behind Heimdal?

  • Seller: Heimdal®
  • Company Website:
  • Year Founded: 2014
  • HQ Location: Copenhagen, Denmark
  • Twitter: @HeimdalSecurity
    5,086 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    284 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer & Network Security, Construction
  • Company Size: 56% Medium, 30% Small

What Do G2 Reviewers Say About Heimdal?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the simple and straightforward interface of Heimdal, making it easy for all security personnel to navigate.
  • Users commend Heimdal's exceptional customer support, experiencing prompt responses and thorough solutions that exceed expectations.
  • Users value the reliable security and user-friendly interface of Heimdal, enhancing overall satisfaction and support.
  • Users value the reliability of Heimdal, consistently delivering expected security solutions and dependable support.
  • Users praise Heimdal for its reliable security solutions and responsive 24x7 support, ensuring consistent performance.
Cons
  • Users face access issues navigating Heimdal's complex admin portal, making it challenging to find essential options and downloads.
  • Users find the complex interface of Heimdal difficult to navigate, complicating their overall experience and functionality.
  • Users find the limited customization options frustrating, making navigation and usability of the admin portal challenging.
  • Users find the admin portal complex and illogical, making navigation frustrating and cumbersome for essential tasks.
  • Users find the customer support lacking during initial setup, which causes issues with product deployment and upgrades.

What Are Recent G2 Reviews of Heimdal?

Verizon Network Detection and Response

Network Detection and Response is a cloud-delivered network security platform that helps you take action against threats and identify future threats with speed, accuracy and scale.

Average Rating: 3.6/5.0

Total Reviews: 16

How Do G2 Users Rate Verizon Network Detection and Response?

  • Metadata Enrichment: 8.3/10 (Category avg: 8.5/10)
  • Quality of Support: 9.0/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 8.5/10 (Category avg: 8.6/10)
  • Network Visibility: 8.7/10 (Category avg: 8.9/10)

Who Is the Company Behind Verizon Network Detection and Response?

  • Seller: Verizon
  • Year Founded: 1983
  • HQ Location: Basking RIdge, NJ
  • Twitter: @Verizon
    1,486,564 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    101,991 employees on LinkedIn®
  • Ownership: NYSE:VZ

Who Uses This Product?

  • Company Size: 44% Small, 31% Large

What Are Recent G2 Reviews of Verizon Network Detection and Response?

Cisco Secure Network Analytics

Stealthwatch is the only solution that detects threats across your private network, public clouds, and even in encrypted traffic.

Average Rating: 4.4/5.0

Total Reviews: 31

How Do G2 Users Rate Cisco Secure Network Analytics?

  • Metadata Enrichment: 8.9/10 (Category avg: 8.5/10)
  • Quality of Support: 8.9/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 10.0/10 (Category avg: 8.6/10)
  • Network Visibility: 9.7/10 (Category avg: 8.9/10)

Who Is the Company Behind Cisco Secure Network Analytics?

  • Seller: Cisco
  • Year Founded: 1984
  • HQ Location: San Jose, CA
  • Twitter: @Cisco
    720,366 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    95,294 employees on LinkedIn®
  • Ownership: NASDAQ:CSCO

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 52% Large, 33% Small

What Are Recent G2 Reviews of Cisco Secure Network Analytics?

NetWitness Platform

NetWitness is a comprehensive threat detection, investigation and response platform that combines visibility, analytics, insight, and automation into a single solution. It collects and analyzes data across all capture points (logs, packets, netflow, endpoint and IoT) and computing platforms (physical, virtual and cloud), enriching data with threat intelligence and business context.

Average Rating: 3.9/5.0

Total Reviews: 23

How Do G2 Users Rate NetWitness Platform?

  • Metadata Enrichment: 8.3/10 (Category avg: 8.5/10)
  • Quality of Support: 7.6/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 6.7/10 (Category avg: 8.6/10)
  • Network Visibility: 8.3/10 (Category avg: 8.9/10)

Who Is the Company Behind NetWitness Platform?

  • Seller: NetWitness
  • Year Founded: 1997
  • HQ Location: Bedford, MA
  • Twitter: @Netwitness
    1,621 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    204 employees on LinkedIn®

Who Uses This Product?

  • Company Size: 54% Large, 33% Medium

What Do G2 Reviewers Say About NetWitness Platform?

AI-generated summary from verified user reviews

Pros
  • Users value the centralized management of NetWitness Platform, which simplifies threat hunting across various data sources.
  • Users appreciate the centralized threat hunting capabilities of the NetWitness Platform, reducing tool sprawl and enhancing security efficiency.
  • Users value the packet capture and replay capabilities of NetWitness Platform for in-depth forensic investigations.
  • Users value the ability to capture full network packets for deep forensic investigation, enhancing their analytic capabilities.
  • Users appreciate the centralized view of the Management Console, simplifying threat hunting across diverse data sources.
Cons
  • Users find the complex implementation of NetWitness Platform challenging, needing expert skills for initial setup and upgrades.
  • Users face complexity in initial setup and upgrades with NetWitness Platform, requiring significant technical expertise and stability concerns.
  • Users face a complex setup for the NetWitness Platform, often needing extensive technical expertise for deployment and upgrades.
  • Users face deployment difficulties with the NetWitness Platform, often requiring advanced technical skills and experiencing upgrade instability.
  • Users find the expertise required for initial setup and upgrades complex, leading to deployment challenges.

What Are Recent G2 Reviews of NetWitness Platform?

What Are G2 Users Discussing About NetWitness Platform?

Corelight

Corelight's Open Network Detection and Response (NDR) Platform improves network detection coverage, accelerates incident response, and reduces operational costs by consolidating NDR, intrusion detection (IDS), and PCAP functionality in a single solution and by providing security analysts with machine learning-assisted investigations and one-click-pivots from prioritized alerts to the evidence needed to investigate and remediate them. Network Detection and Response platforms monitor and analyze network traffic, delivering telemetry into existing SIEM, XDR, or SaaS-based solutions. Corelight’s platform is unique because our detections and visibility engineering are community driven—with continuous content creation from Zeek®, Suricata IDS, and other Intel communities. And our integration with CrowdStrike XDR enables cross platform (EDR+NDR) analytics. This provides you with the most complete network visibility, powerful analytics, and threat hunting capabilities, and accelerates investigation across your entire kill chain. Corelight also delivers a comprehensive suite of network security analytics that help organizations identify more than 75 adversarial TTPs across the MITRE ATT&CK® spectrum including Exfiltration, Command and Control (C2), and Lateral Movement. These detections reveal known and unknown threats via hundreds of unique insights and alerts across machine learning, behavioral analysis, and signature-based approaches. CORELIGHT PRODUCTS + SERVICES Open NDR Platform Appliance, Cloud, Software, Virtual and SaaS Sensors IDS Fleet Manager Investigator Threat Hunting Platform Smart PCAP Corelight Training CERTIFICATIONS FIPS 140-2

Average Rating: 4.6/5.0

Total Reviews: 20

How Do G2 Users Rate Corelight?

  • Metadata Enrichment: 8.6/10 (Category avg: 8.5/10)
  • Quality of Support: 9.1/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 9.0/10 (Category avg: 8.6/10)
  • Network Visibility: 9.1/10 (Category avg: 8.9/10)

Who Is the Company Behind Corelight?

  • Seller: Corelight
  • Year Founded: 2013
  • HQ Location: San Francisco, CA
  • Twitter: @corelight_inc
    4,227 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    483 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 50% Large, 50% Medium

What Do G2 Reviewers Say About Corelight?

AI-generated summary from verified user reviews

Pros
  • Users value Corelight for its comprehensive security, offering exceptional network event insights and threat detection capabilities.
  • Users praise Corelight for its superior network telemetry, enhancing security detection and event clarity.
  • Users praise Corelight for its effective network telemetry, making security events easy to understand and actionable.
  • Users value the exceptional network security offered by Corelight, enabling easy detection of threats and efficient event analysis.
  • Users value the great network telemetry of Corelight, which simplifies security event analysis and enhances threat detection.
Cons
  • Users find the complex coding of Corelight challenging, especially for those without specialized knowledge.
  • Users find the complex configuration of Corelight difficult, especially for those without specialized knowledge or training.
  • Users find Corelight's complexity challenging, often requiring specialized knowledge and costly training for effective use.
  • Users find the complex setup of Corelight challenging, often requiring specialized knowledge and personalized training.
  • Users find the learning curve steep, making Corelight challenging for novice security analysts to navigate effectively.

What Are Recent G2 Reviews of Corelight?

Blumira Automated Detection & Response

Blumira is an integrated security operations platform built for growing teams and the partners supporting them to gain complete visibility into their environment, identify and address risk faster, and deliver advanced security and compliance. The platform includes: - Managed Detections for automated threat hunting to identify attacks early - AI Investigation with 98.5% accurate, human-in-the-loop triage validated against real cases - Rapid Response with automation and 1-click actions to contain and block threats immediately - One Year of Data Retention with unlimited log ingestion to satisfy compliance requirements - Advanced Reporting and dashboards for forensics and easy investigation - Endpoint & Identity Protection (EDR/ITDR) for real-time remediation across devices and users - 24/7 Security Operations support for critical priority issues

Average Rating: 4.6/5.0

Total Reviews: 122

How Do G2 Users Rate Blumira Automated Detection & Response?

  • Metadata Enrichment: 6.7/10 (Category avg: 8.5/10)
  • Quality of Support: 9.5/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 8.9/10 (Category avg: 8.6/10)
  • Network Visibility: 7.9/10 (Category avg: 8.9/10)

Who Is the Company Behind Blumira Automated Detection & Response?

  • Seller: Blumira
  • Company Website:
  • Year Founded: 2018
  • HQ Location: Ann Arbor, Michigan
  • Twitter: @blumira
    1 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    55 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: IT Manager
  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 51% Medium, 36% Small

What Do G2 Reviewers Say About Blumira Automated Detection & Response?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the easy setup of Blumira Automated Detection & Response, enabling quick integration and efficient use.
  • Users appreciate the responsive customer support of Blumira, finding it reliable and personal for their IT needs.
  • Users praise the setup ease of Blumira, appreciating its quick integration and automated alert features.
  • Users appreciate the reliable real-time alerting of Blumira, valuing its clarity and ease of use for all techs.
  • Users value the reliable real-time alerting of Blumira, appreciating its ease of use and helpful implementation.
Cons
  • Users find limited customization with detection filters, relying on support for creating necessary custom detections.
  • Users express concern over false positives that can disrupt business functions and lead to frustration with repeated alerts.
  • Users find Blumira's pricing expensive, citing inflexible models and insufficient features in lower tiers.
  • Users express frustration over false positives that waste time and complicate the overall experience with Blumira.
  • Users express concern over insufficient information, desiring better data accessibility and clearer deployment status.

What Are Recent G2 Reviews of Blumira Automated Detection & Response?

What Are G2 Users Discussing About Blumira Automated Detection & Response?

Cisco Adaptive Wireless IPS Software

Cisco Adaptive Wireless Intrusion Prevention System (IPS) offers advanced network security for dedicated monitoring and detection of wireless network anomalies, unauthorized access, and RF attacks. Fully integrated with the Cisco Unified Wireless Network, this solution delivers integrated visibility and control across the network, without the need for an overlay solution.

Average Rating: 4.3/5.0

Total Reviews: 16

How Do G2 Users Rate Cisco Adaptive Wireless IPS Software?

  • Metadata Enrichment: 8.5/10 (Category avg: 8.5/10)
  • Quality of Support: 8.2/10 (Category avg: 8.9/10)
  • Multi-Network Monitoring: 8.3/10 (Category avg: 8.6/10)
  • Network Visibility: 8.7/10 (Category avg: 8.9/10)

Who Is the Company Behind Cisco Adaptive Wireless IPS Software?

  • Seller: Cisco
  • Year Founded: 1984
  • HQ Location: San Jose, CA
  • Twitter: @Cisco
    720,366 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    95,294 employees on LinkedIn®
  • Ownership: NASDAQ:CSCO

Who Uses This Product?

  • Company Size: 63% Medium, 25% Large

What Are Recent G2 Reviews of Cisco Adaptive Wireless IPS Software?

Brandon Summers-Miller
BS
Researched and written by Brandon Summers-Miller
Updated October 3, 2024

Network Detection and Response (NDR) Topics

Expand/Collapse

Learn More About Network Detection and Response (NDR) Software

What is Network Detection and Response (NDR) Software?

Network detection and response (NDR) software documents a company’s network activity while automating threat remediation and reporting cyber threats to IT and security teams. NDR enables an organization to consolidate IT security services into one solution and simplifies network protection.

NDR is critical because it provides an end-to-end view of network activity. For example, certain malicious activity may not be reflected in network logs but will be visible by network tools as soon as they interact with systems throughout the network. 

Since NDR software uses artificial intelligence (AI) and machine learning (ML) to analyze network traffic, it is highly adept at detecting malicious behavior as well as reporting and remediating such activity in real time. 

What are the Common Features of Network Detection and Response (NDR) System?

NDR system usually includes the following:

AI and ML: NDR uses AI and ML in its software solution. IT and security professionals can use the data to develop streamlined discovery and response workflows across an organization’s network.

Automated threat detection: When traffic behavior deviates from normal functionality, an NDR solution detects the issue and automatically assists in an investigation. NDR software includes or integrates with other solutions that automate incident response processes to minimize the threat’s impact.

What are the Benefits of Network Detection and Response (NDR)  Software?

There are several benefits to using NDR software.

Automatically detects anomalies: NDR software automatically detects anomalies in network traffic by applying non-signature-based detection techniques and using behavioral analytics, AI, and ML.

Monitors all traffic flows: NDR solutions monitor all traffic entering or exiting the network so there is visibility to identify and mitigate security incidents, regardless of where a threat comes from. Giving this end-to-end view of the network offers IT and security teams greater visibility across the network to mitigate traffic threats.

Analyzes network in real time: NDR analyzes an organization’s network for threats in real time or near real time. It provides timely alerts for IT and security teams, improving incident response times.

Narrows down incident response: NDR solutions attribute malicious behavior to specific IP addresses and perform forensic analyses through AI and ML to determine how threats have moved across a network environment. This leads to faster, more efficient incident response. 

Who Uses Network Detection and Response (NDR) Software?

Network IT and cybersecurity staff: These workers use NDR software to observe network traffic and detect anomalies related to user behavior.

Industries: Organizations in all industries, especially technology or highly sensitive data-oriented sectors like financial services, seek NDR solutions to help protect their networks.

What Are Alternatives to Network Detection and Response (NDR) Software?

Network traffic analysis (NTA) software and endpoint detection response (EDR) software are alternatives to NDR software.

Network traffic analysis (NTA) software: NTA software is similar to NDR tools in that it monitors network traffic and looks for suspicious activity while providing real-time analysis and alerting IT administrators. The main difference is that it also analyzes network performance and pinpoints reasons for slow downloads. 

Endpoint detection & response (EDR) software: EDR tools are similar to NDR solutions, focusing on network activity. It detects, investigates, and removes malicious software penetrating a network’s devices. These tools give greater visibility of a system’s overall health, including each specific device’s state. Companies use these tools to mitigate endpoint penetrations quickly and prevent data loss, theft, or system failures. 

Challenges with Network Detection and Response (NDR) Software

There are some challenges IT teams can encounter with NDR software.

Sophisticated hackers: With high volumes of data traveling across an organization’s network, hackers create more sophisticated threats that can hide their tracks and avoid detection by blending in with traffic patterns. Attackers can also make threats move in small and infrequent batches to avoid detection.

Budget constraints: As hackers become more sophisticated, organizations must keep their NDR solutions up-to-date to keep up with the latest threats. Budget constraints could prevent IT and security teams from doing so.

How to Buy Network Detection and Response (NDR) Software

Requirements Gathering (RFI/RFP) for Network Detection and Response (NDR) Software 

If an organization is just starting and looking to purchase NDR software, G2 can help.

The manual work necessary in security and compliance causes multiple pain points. If the company is large and has a lot of networks, data, or devices in its organization, it may need to shop for scalable NDR  solutions. Users should think about the pain points in their security to help create a checklist of criteria. Additionally, the buyer must determine the number of employees who will need to use this software and if they currently have the skills to administer it. 

Taking a holistic overview of the business and identifying pain points can help the team springboard into creating a checklist of criteria. The list is a detailed guide that includes necessary and nice-to-have features, including budget features, number of users, integrations, security staff skills, cloud or on-premises solutions, and more.

Depending on the deployment scope, producing an RFI, a one-page list with bullet points describing what is needed from NDR software, might be helpful.

Compare Network Detection and Response (NDR) Software Products

Create a long list

Vendor evaluations are essential to the software buying process, from meeting the business functionality needs to implementation. For ease of comparison, after all demos are complete, it helps to prepare a consistent list of questions regarding specific needs and concerns to ask each vendor.

Create a short list

From the long list of vendors, it is helpful to narrow the list of vendors and come up with a shorter list of contenders, preferably no more than three to five. With this list, businesses can produce a matrix to compare the features and pricing of the various solutions.

Conduct demos

To ensure a comprehensive comparison, the user should demo each solution on the short list with the same use cases. This allows the business to evaluate like for like and see how each vendor stacks up against the competition. 

Selection of Network Detection and Response (NDR) Software

Choose a selection team

Before getting started, creating a winning team that will work together throughout the process, from identifying pain points to implementation, is crucial. The selection team should include organization members with the right interests, skills, and participation time. 

A good starting point is to aim for three to five people who fill roles such as the primary decision maker, project manager, process owner, system owner, or staffing subject matter expert, as well as a technical lead, head administrator, or security administrator. The vendor selection team in smaller companies may have fewer participants who will multitask and take on more responsibilities.

Compare notes

The selection team should compare notes, facts, and figures noted during the process, such as costs, security capabilities, and alert and incident response times.

Negotiation

Just because something is written on a company’s pricing page does not mean it's final. It is crucial to open up a conversation regarding pricing and licensing. For example, the vendor may be willing to give a discount for multi-year contracts or for recommending the product to others.

Final decision

After this stage, and before going all in, it is recommended to roll out a test run or pilot program to test adoption with a small sample size of users. If the tool is well used and received, the buyer can be confident that the selection was correct. If not, it might be time to return to the drawing board.

What Does Network Detection and Response (NDR) Software Cost?

NDR software is considered a long-term investment. This means there must be a careful evaluation of vendors, and the software should be tailored to each organization's specific requirements. Once NDR software is purchased, deployed, and integrated into an organization’s security system, the cost could be high, so the evaluation stage of selecting the right tool is crucial. 

The chosen NDR vendor should continue to provide support for the platform with flexibility and open integration. Pricing can be pay-as-you-go, and costs may also vary depending on whether unified threat management is self-managed or fully managed.

Return on Investment (ROI)

As organizations consider recouping the money spent on the software, it is critical to understand the costs that will be saved in terms of efficiency. In the long run, the investment must be worth preventing downtime, loss of revenue, and any reputation damage that a security breach would cause.