

Find out in this report how the two Intrusion Detection and Prevention Software (IDPS) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
The return on investment is satisfactory with Cisco products as they have long lifespans, and our customers are satisfied with them.
Corelight Investigator is sold as a software as a service license, and sensors are of course a one-time fee with their hardware maintenance.
I believe I have seen a return on my investment with Corelight Open NDR.
My impression is that the support quality has deteriorated over time.
I bring in hundreds of subnet variable definitions via an automated import process, enabling me to leverage all those variables in my Suricata alerts.
I would probably say we are at an eight or nine as far as the quality of support, which I think is very reasonable.
With Investigator itself, Corelight Open NDR is very easy to scale and manage as a business changes.
We find Cisco products stable and thoroughly tested before new software or firmware versions are released.
I find Cisco IOS Security to be a very stable product.
I cannot think of any time we have had a serious disruption to anything we have been doing due to some technical issue on their side.
Corelight Open NDR has been very stable as a solution.
Cisco changes their licensing policy quite frequently, which is becoming confusing and complicated.
I believe what they have done with it, taking an open-source engine and bundling it into an appliance with professional support, was a brilliant idea.
Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.
The cost of Cisco IOS Security for customers is on the higher end of pricing compared to the competition, depending on the targeted customers.
Corelight Investigator is sold as a software as a service license, and sensors are of course a one-time fee with their hardware maintenance.
There are higher-level systems such as intrusion prevention systems which detect intrusions within the system.
This solution, called Network Access Controller, handles authentication, authorization, and accounting for devices accessing the network.
The benefits include visibility, as the Suricata engine can scan huge volumes of traffic.
Corelight Open NDR is a really powerful platform. Pairing up the sensors with Investigator, you are getting incredibly rich data, which we are also able to further enrich with additional feeds such as CrowdStrike or CISAIAS.
| Product | Mindshare (%) |
|---|---|
| Cisco IOS Security | 2.2% |
| Corelight Open NDR | 1.3% |
| Other | 96.5% |

| Company Size | Count |
|---|---|
| Small Business | 20 |
| Midsize Enterprise | 14 |
| Large Enterprise | 18 |
| Company Size | Count |
|---|---|
| Small Business | 5 |
| Midsize Enterprise | 3 |
| Large Enterprise | 3 |
Cisco IOS Security integrates advanced VPN capabilities, IPsec security, and firewall features, ensuring scalable and reliable protection suitable for enterprise networks.
Cisco IOS Security offers comprehensive firewall integration, robust AAA capabilities, and encryption, empowering organizations with a reliable network environment. EEM provides flexibility and programmability, while integrated threat detection, intrusion prevention, and centralized management enhance its security profile. Despite its reliability, challenges include complexity in configuration, high pricing, and confusing licensing policies. Performance issues and the need for enhanced integration, automation, and better monitoring tools are areas for improvement.
What are the key features of Cisco IOS Security?Industries leverage Cisco IOS Security to protect against zero-day attacks, deploy secure VPNs, and facilitate network access control and compliance checks. Organizations utilize its features for firewalls, routing, and switching, integrating technologies like Cisco ICE and TrustSec to enhance security across enterprise environments.
Corelight Open NDR delivers rapid deployment, essential insight, and data for cybersecurity. Known for ease of use, cost-effectiveness, and open-source Zeek code, it enhances security by streamlining traffic monitoring and integrating with threat feeds.
Corelight Open NDR offers organizations enhanced network security and visibility, utilizing physical sensors in addition to cloud, virtual, and software variants. It supports incident response with packet capture sampling, monitoring internet, data center, and LAN traffic while facilitating east-west traffic identification. Despite its complexity, users suggest architectural simplifications and a graphical interface to boost usability and reduce costs. Features like Smart PCAP and service catalogs contribute positively, but an interactive interface with more seamless feature access is desired.
What Are Corelight Open NDR's Key Features?
What Benefits Should Users Consider?
Primarily utilized by organizations to bolster network security, Corelight Open NDR is deployed in various sectors to increase visibility and streamline incident response. Its deployment spans physical, cloud, virtual, and software models, focusing on comprehensive packet capture sampling for effective traffic monitoring. Across industries, it serves managed services by identifying lateral network traffic, optimizing internet, data center, and LAN performance.
We monitor all Intrusion Detection and Prevention Software (IDPS) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.