G2

F F.

Information Security Engineer

Mid-Market (51-1000 emp.)

8/21/2026

"Real Threats, Real Fixes, Near Zero Noise"

4.5/5

What do you like best about Sweet Security?

The team's pedigree shows immediately... Palo Alto / Aqua / Wiz caliber DNA and it comes through in how fast the product has matured since we got in early. Two things stand out most: the EDR like telemetry lets us take raw behavioral data and turn it into an actual detection rule in a couple of clicks, no separate workflow for writing rules bolted on but it's there if that's your thing. And their AI driven incident triage is some of the best I've used... it doesn't just flag an alert and leave you to figure out what it means, it explains the context behind it in plain terms. If someone on the team isn't deep in cloud attack TTPs, they're not left guessing what a given technique actually is or why it matters, the triage walks you through it. That matters a lot when you're trying to get a whole team, not just your most senior person, moving fast on the right things.

What really sold me was watching their SweetAttack red teaming live in a demo. If it finds an RCE, it patches the exploit in place without breaking the underlying app, then layers a network block on top so it can't be reused. And if there's the all too common crypto miner that snuck in during that window, it kills the process automatically, no manual cleanup, no waiting for someone to notice CPU spiking. They've designed a thing of beauty.

It's not noticeable in terms of resource consumption. Like, at all.Any security guy will tell you what a joy it is to not hear a peep from the infrastructure side of the house blaming their tools for all their problems. It's great to forget it's even there. That's a point of pride I hope they take, because a lot of vendors in this space cannot say the same.

I've been doing my own AI red teaming work on the side across a range of agent architectures and role setups... single agent tool calling loops, orchestrator and worker patterns, layered sub agent delegation, peer to peer agent swarms, you name it, I've tried the combo. So I've got a real basis for comparison, and I can say confidently: a lot of tools in this space show you a plausible looking attack path. Sweet actually runs the exploit and proves it's real. That's a meaningfully different posture than the Wiz/Upwind style tools, which mostly show static theoretical paths.

The UI itself is easy to navigate, not a black hole you get lost in trying to find where something is. It's fun and friendly to use, and yes, it has dark mode.

On integrations, we've had it working across our GreyMatter/ReliaQuest pipeline and Azure environment side by side, cloud and on prem both covered, so it's not just a point tool that only talks to itself. And the support side has been genuinely good, the team is quick to hop on a call, and patiently go through troubleshooting, and they bring their technical lead into demos when the questions get specific instead of leaving you with a someone who is just "going to get back to you". Its done properly the first time around. Review collected by and hosted on G2.com.

What do you dislike about Sweet Security?

Still maturing in a few spots you'd expect from a company growing this fast some integration docs needed extra clarification with support to get right and one lower-severity alert type could use better default tuning so triage time stays low even before customization. But they took that feedback and its not an issue anymore. For the sake of transparency im including it.

My one bigger wish is that the offering felt a little more unified instead of broken into separate modules/add-ons but once I thought it through, it makes sense given how they likely have to account for token usage under the hood for the AI-driven pieces. If you're pricing or metering based on token consumption, breaking it out is the sane way to do it. Review collected by and hosted on G2.com.

What problems is Sweet Security solving and how is that benefiting you?

We're using it for cloud and runtime detection and response across our environment, and it's actually catching real things, not just noise. Credential access attempts against domain controllers, anomalous IMDS connections, directory traversal attempts, all flagged in near real time with enough context that my team doesn't have to stop and figure out what the alert even means first. Before this we were leaning on a patchwork of tools that each saw a slice of the picture and none of them talked to each other well.

The API logging is an excellent feature in case the documentation is lacking or the Swagger files are out of date. Real time vulnerability context is probably the most important piece in terms of prioritizing remediations. This can get out of hand quick, but the mere presence of a library doesn't mean it's vulnerable, especially if it's not even being called. Sweet can take a vulnerability rated a 9 and confidently tell us it's actually more of a 3 or 4, so we're not burning time on meaningless work. It has a direct impact on our real time risk and exposure.

The NHI's are in one location nice and neat instead of spread out over 15 different dashboards.

The behavior to detection workflow and the AI triage together mean my team and I spend less time drowning in alerts and more time actually responding to what matters. And because we got in early, we've gotten to shape some of what they're building with our own feedback, which is rare for a vendor this size to actually act on instead of just nodding along to. Review collected by and hosted on G2.com.