Try our new research platform with insights from 80,000+ expert users

Forescout Platform vs Mandiant Advantage comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 28, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Forescout Platform
Ranking in Extended Detection and Response (XDR)
21st
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
78
Ranking in other categories
Network Access Control (NAC) (5th), IoT Security (4th), Endpoint Compliance (4th)
Mandiant Advantage
Ranking in Extended Detection and Response (XDR)
27th
Average Rating
8.4
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Attack Surface Management (ASM) (10th)
 

Mindshare comparison

As of February 2026, in the Extended Detection and Response (XDR) category, the mindshare of Forescout Platform is 1.0%, up from 0.5% compared to the previous year. The mindshare of Mandiant Advantage is 1.2%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
Forescout Platform1.0%
Mandiant Advantage1.2%
Other97.8%
Extended Detection and Response (XDR)
 

Featured Reviews

AshishKumar Rai - PeerSpot reviewer
Security Consultant at a tech vendor with 10,001+ employees
Comprehensive visibility has strengthened endpoint control and automated threat response across networks
When it comes to improving Forescout Platform, I have faced some issues recently, particularly with the switch integration part. When integrating a switch, it asks for the vendor type, and often it does not match. For example, one series of HP switches may not be found in that vendor list. This leads to frustration because you have to check again with different HP models, and once you integrate a switch, you cannot edit the vendor list without removing it. Other issues are being worked on, particularly related to switch integration. I believe they will be fixed in the next upgrade or patch fix. There are no major issues, but the configuration changes needed for the switch model are necessary, and I think it would help if during integration, an admin user could check the password or credential used, as they currently cannot see the password after it is entered and saved.
SameepAgarwal - PeerSpot reviewer
Associate Consultant (IT Security) at Triune Digital Security
In-depth traffic analysis and proactive support reduce investigation time
The live IOC feed identifies the type, technique, and tactics used. This becomes handy since then I know what to refer to from the playbook. For instance, if I take a use case of someone with Mimikatz installed on their system, knowing the nature beforehand reduces investigation time. I can quickly apply the playbook to resolve incidents in less time.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We use the Forescout Platform for device visibility and control in our network. It's very helpful for tracking malicious or unusual activity. We use it to track which ports are open, which machines are running specific services, and to identify vulnerabilities. For example, there was a vulnerability related to SMB, and we could use the product to determine which machines inside our organization were allowing SMB traffic."
"The most valuable feature of the Forescout Platform it's highly customizable and flexible."
"Automated policy enforcement is particularly valuable as it significantly reduces the need for manual intervention, thus enhancing efficiency and security."
"The most valuable feature of Forescout Platform is that it has everything that Aruba has at significantly less cost."
"Forescout Platform's best feature is plug-in integration."
"Emergency response, risk assessment information to get a view of the of the vulnerability."
"The valuable feature of the product stems from the fact that it is easy to implement."
"The most valuable features of the Forescout Platform are ease of management and outstanding visibility. The visibility is simple to obtain."
"I have never faced stability issues."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"The live IOC feed identifies the type, technique, and tactics used."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
 

Cons

"The fact that Forescout Platform doesn't have a presence in the South African region is a weakness because of which you can't ask for help from them if you have any problems."
"For improvements, I think technical support could be enhanced. The time zone difference makes remote support difficult - I'm in Indonesia, and they're in the US. Maybe the Forescout Platform could provide engineers from Asia Pacific."
"We experienced some detection issues when checking compliance for the Sophos agent."
"The console is a fat client, and a web interface would be preferable."
"It's scalable, but not without a big investment. It doesn't do so well at the branch. At the home office, it does okay and not so well at the branch."
"The installation is not secure because it takes high admin privileges."
"The biggest disadvantage is the pricing."
"Other solutions have TACACS+, but Forescout does not. In the next release, I would like to see Forescout have accounting."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
 

Pricing and Cost Advice

"It is expensive because you have to pay for their CSM, the customer's access manager, and their professional services on top of that, and they charge you roughly $400 per hour, which is overhead."
"We went with the virtual appliance option. The biggest cost to running these types of appliances would be to either have multiple virtual appliances at every data center or running Remote SPAN hardware to provide you the real-time network visibility."
"You can have a flexible license depending on your environment."
"The solution is not priced low. There are no hidden costs."
"Forescout's pricing is noted for its attractiveness, with potential discounts depending on partnership levels."
"The fact that we were allowed to spin up as many servers as we had need of to support our geographic requirements while paying for licensing as an enterprise truly set Forescout apart from the crowd and improved the way we could design our access."
"The price of the solution is reasonable. We have paid for the license for five years. We have integration with Symantec AV for orchestration, and we have an additional license."
"It's about $160,000, but I'm not sure how long that is for or what it includes. Because we were a test base, we were provided with servers, but now, Forescout wants us to buy servers because those servers are now end-of-life or end-of-service. For our lifecycle management program, in order to get a refresh on those servers, we would have to buy servers or use our own network resources to house Forescout. Forescout takes up about 13 or 14 virtual CPUs."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
881,665 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
12%
Financial Services Firm
11%
Computer Software Company
9%
Government
7%
Financial Services Firm
16%
Computer Software Company
9%
Manufacturing Company
7%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business30
Midsize Enterprise10
Large Enterprise44
No data available
 

Questions from the Community

What advice do you have for others considering Forescout Platform?
Forescout is a very powerful NAC product that does not rely on port level configuration. It can detect and block unauthorized devices very quickly. But it has a lot of capabilities and really would...
What advice do you have for others considering Forescout Platform?
I would rate the Forescout Device and Visibility Control Platform at a six out of ten.
What advice do you have for others considering Forescout Platform?
I recommend doing a compression demo. If people use it, they will buy it. So they have to see the product in place. That's the main recommendation is to do a proof of concept. If they do, they will...
What needs improvement with Mandiant Advantage?
Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives. More fine-tuning is required to handle famous company names. It also handles alerts ...
What is your primary use case for Mandiant Advantage?
I use it for cyber threat intelligence. I gather information about newly created domains around the Internet that can be related to my managed company. I monitor these domains for any phishing acti...
What advice do you have for others considering Mandiant Advantage?
I would advise exploring multiple functions because there are many different capabilities of Mandiant Advantage. For small organizations, try every feature included in the package. Use known source...
 

Also Known As

Forescout Platform, CounterACT for Endpoint Compliance, ForeScout CounterACT
Mandiant Threat Intelligence
 

Overview

 

Sample Customers

NHS Sussex, SAP, SEGA, Vistaprint, Miami Children's Hospital, Pioneer Investments, New York Law School, OmnicomGroup, Meritrust
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Find out what your peers are saying about Forescout Platform vs. Mandiant Advantage and other solutions. Updated: December 2025.
881,665 professionals have used our research since 2012.