No more typing reviews! Try our Samantha, our new voice AI agent.

Cisco Secure Network Analytics vs Corelight Open NDR comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
6.7
Cisco Secure Network Analytics improves visibility and detection, aiding IT collaboration; value varies by environment and enhances security posture.
Sentiment score
7.0
Corelight Open NDR provides cost-effective, enhanced visibility and ROI through strategic pricing, on-premises hosting, and competitive partnerships.
I have seen a return on investment, specifically in terms of money saved in storage costs on our cloud because this is hosted on-premises and is utilizing most of the on-prem available storage.
Head of Business Operations at a computer software company with 501-1,000 employees
Corelight Investigator is sold as a software as a service license, and sensors are of course a one-time fee with their hardware maintenance.
Growth And Strategy Lead at a computer software company with 51-200 employees
I believe I have seen a return on my investment with Corelight Open NDR.
Principle Security Architect at Eversource Energy
 

Customer Service

Sentiment score
6.1
Cisco Secure Network Analytics receives praise for its knowledgeable international support, despite occasional challenges with local expertise.
Sentiment score
7.1
Corelight Open NDR's customer service is praised for responsiveness and expertise, despite occasional reports of poor service quality.
There is a lack of adequate local support from the Indian side.
Group Head at Stpi
For technical support of Cisco, the support they provide depends on how the client procures it, and so far, it's understandable.
CEO at BRIGHT-i SYSTEMS LIMITED
Support is most important when dealing with complex security incidents
Cyber Security Professional at a tech services company with 11-50 employees
I would probably say we are at an eight or nine as far as the quality of support, which I think is very reasonable.
Growth And Strategy Lead at a computer software company with 51-200 employees
Corelight support was very helpful in showing me some tool sets they have under the covers that allow me to automate that process.
Principle Security Architect at Eversource Energy
 

Scalability Issues

Sentiment score
6.3
Cisco Secure Network Analytics scales well for enterprises, though high costs and outdated hardware can limit effectiveness.
Sentiment score
7.2
Corelight Open NDR offers scalable, flexible sensor solutions for diverse businesses, simplifying network traffic management and expansion, especially in Kubernetes.
The scope of the load balancing work was a team effort where we used three tools for load balancing.
Senior Developer at Atlas Laboratory
With Investigator itself, Corelight Open NDR is very easy to scale and manage as a business changes.
Growth And Strategy Lead at a computer software company with 51-200 employees
 

Stability Issues

Sentiment score
8.3
Cisco Secure Network Analytics is praised for stability, minimal downtime, and reliability despite initial setup challenges and infrastructure complexity.
Sentiment score
8.4
Corelight Open NDR offers reliability and stability, leveraging Zeek technology and effective fleet management for consistent performance.
Cisco products are incredibly stable, boasting a 200% stability.
Group Head at Stpi
Once resolved, the system works well, and overall I think it's good.
CEO at BRIGHT-i SYSTEMS LIMITED
I cannot think of any time we have had a serious disruption to anything we have been doing due to some technical issue on their side.
Growth And Strategy Lead at a computer software company with 51-200 employees
Corelight Open NDR has been very stable as a solution.
Principle Security Architect at Eversource Energy
 

Room For Improvement

Cisco Secure Network Analytics needs better integration, user interface, AI features, and simplified setup with improved training and database management.
Corelight Open NDR users desire an interactive interface, better customer support, simplified querying, enhanced documentation, and more transparent pricing.
The solution should have the ability to analyze security events not only at the network layer but also at the application and OS layers.
Group Head at Stpi
Proper management of the database is also important; it should be centralized for easier data collection from a single database.
CEO at BRIGHT-i SYSTEMS LIMITED
Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.
Growth And Strategy Lead at a computer software company with 51-200 employees
I believe what they have done with it, taking an open-source engine and bundling it into an appliance with professional support, was a brilliant idea.
Principle Security Architect at Eversource Energy
The product should improve how these workflows are designed and provide more documentation about them.
Cyber Security Professional at a tech services company with 11-50 employees
 

Setup Cost

Cisco Secure Network Analytics is costly with complex licensing, though valued for features; pricing strategy adjustments are suggested.
Corelight Open NDR's pricing is mixed, with affordable options for experts but costly for new adopters, despite communication issues.
Cisco solutions are considered to be very expensive.
Group Head at Stpi
Regarding cost, for the Bangladesh context, Cisco Secure Network Analytics is a little bit high-priced because we are a developing country, making it tough to manage affordable solutions.
CEO at BRIGHT-i SYSTEMS LIMITED
Corelight Investigator is sold as a software as a service license, and sensors are of course a one-time fee with their hardware maintenance.
Growth And Strategy Lead at a computer software company with 51-200 employees
My experience with pricing, setup cost, and licensing is that it is quite reasonable when it is open source.
Head of Business Operations at a computer software company with 501-1,000 employees
 

Valuable Features

Cisco Secure Network Analytics offers comprehensive visibility and enhanced threat detection, improving security and reducing investigation times effectively.
Corelight Open NDR provides cost-effective, efficient network threat detection and management with machine learning to reduce alert fatigue.
The most valuable features include encrypted traffic analytics and the ability to fulfill requirements at the network level.
Group Head at Stpi
Every solution is gradually integrated with AI, and Cisco has already implemented AI building features in their solution.
CEO at BRIGHT-i SYSTEMS LIMITED
The best feature of Cisco Secure Network Analytics is its reliability, which I find to be the one that gets used the most.
Senior Developer at Atlas Laboratory
The benefits include visibility, as the Suricata engine can scan huge volumes of traffic.
Principle Security Architect at Eversource Energy
The lightweight aspect and the easy deployment of Corelight Open NDR stand out to me the most because it helps save compute and storage requirements on our side.
Head of Business Operations at a computer software company with 501-1,000 employees
It can identify unusual network behavior and suspicious connections, as well as indicators of compromise that might otherwise go unnoticed.
Cyber Security Professional at a tech services company with 11-50 employees
 

Categories and Ranking

Cisco Secure Network Analytics
Ranking in Network Traffic Analysis (NTA)
3rd
Ranking in Network Detection and Response (NDR)
6th
Average Rating
8.2
Reviews Sentiment
6.6
Number of Reviews
62
Ranking in other categories
Network Monitoring Software (30th), Cisco Security Portfolio (8th)
Corelight Open NDR
Ranking in Network Traffic Analysis (NTA)
5th
Ranking in Network Detection and Response (NDR)
7th
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
9
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (19th), AI-Powered Cybersecurity Platforms (12th)
 

Mindshare comparison

As of October 2026, in the Network Detection and Response (NDR) category, the mindshare of Cisco Secure Network Analytics is 5.4%, down from 6.8% compared to the previous year. The mindshare of Corelight Open NDR is 4.3%, down from 5.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Network Detection and Response (NDR) Mindshare Distribution
ProductMindshare (%)
Cisco Secure Network Analytics5.4%
Corelight Open NDR4.3%
Other90.3%
Network Detection and Response (NDR)
 

Featured Reviews

Muhammad Harun-Owr-Roshid - PeerSpot reviewer
CEO at BRIGHT-i SYSTEMS LIMITED
Have streamlined network visibility and troubleshooting while seeing benefits from AI integration
In terms of improvements for Cisco Secure Network Analytics, from the implementation point of view, now that AI is in use, some other features need to be upgraded considering AI solutions. Proper management of the database is also important; it should be centralized for easier data collection from a single database. When precise manual analysis is needed, it's sometimes difficult, so having a centralized database will allow network admins to find actual scenarios more effectively, especially since some information may not be visible on the GUI. Cisco should upgrade their hardware part to run the database, because sometimes it cannot handle the load while all features are running in the network. The database management should indeed be centralized because while AI runs behind the systems, central management is essential. For example, in a network with 100 Cisco switches, a few routers, firewalls, and access points, all data generated should be preserved in a central database. This approach simplifies management and analysis for troubleshooting, as GUI interfaces may not always provide visible information. Centralizing the database will allow for better understanding of which information is preserved for each specific device.
reviewer2834367 - PeerSpot reviewer
Growth And Strategy Lead at a computer software company with 51-200 employees
Network visibility has transformed how we detect nation state threats and protect critical industry
Before Corelight recently started pushing some of the agentic features, querying at times could be a little difficult, depending on your mastery of log scale. However, I think with a lot of the artificial intelligence that they are building in, it is getting a lot easier to query in the platform. I would definitely encourage them to continue down that path where anybody can hop into the platform and start running queries, whether it is a simple instruction like I want this, and an artificial intelligence process can actually build the query and do it. I think that would be super powerful. Cyber skill sets are in high demand, and there is a huge backlog in cyber talent. We cannot fill all the positions we need. The easier we can make these cyber systems for people to pick up and be effective on, I think is really key. Explainability of data is hyper important. In the past few artificial intelligence related updates we have gotten from Corelight, that has been one of the first questions our team has asked every time or that I have asked: show me what the model is doing, show me how it came to this analysis. Within Investigator platform, they are able to walk through and see exactly what data the artificial intelligence pulled from where and why it did what it did as far as making its suggestions. They have definitely built their system with artificial intelligence in mind up front, and having that openness as one of the key features of any of their artificial intelligence and machine learning processes in the platform is important. The issue with black boxes is obviously hallucinations from artificial intelligence and just not being able to trace to ground truth. When we are talking about these cyber incidents and being able to do forensics, you need to be able to pinpoint and tie everything together, and black boxes really obscure that and prevent you from doing so. Corelight has done a really good job of making sure that everything is explainable and everything is mapped when it comes to leveraging any of their artificial intelligence features.
report
Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.
918,970 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
10%
Financial Services Firm
10%
Construction Company
9%
Outsourcing Company
8%
Financial Services Firm
12%
Government
8%
Real Estate/Law Firm
7%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise7
Large Enterprise52
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise3
Large Enterprise2
 

Questions from the Community

What is your experience regarding pricing and costs for Cisco Stealthwatch?
Regarding cost, for the Bangladesh context, Cisco Secure Network Analytics is a little bit high-priced because we are a developing country, making it tough to manage affordable solutions. However, ...
What needs improvement with Cisco Stealthwatch?
Several features often look very promising during evaluation or implementation but end up being used only lightly in day-to-day operations. Advanced reporting and scheduled compliance reports look ...
What is your primary use case for Cisco Stealthwatch?
My main use case for Cisco Secure Network Analytics has been network visibility and anomaly-based threat detection within the enterprise environment. In security operations and VAPT-related activit...
What is your experience regarding pricing and costs for Corelight?
I have a fortunate experience with pricing, setup costs, and licensing of Corelight Open NDR, as being a principal architect, I get to sit outside of that conversation and just choose the best prod...
What needs improvement with Corelight?
Corelight Open NDR does not need any improvements or additional features in the next releases. The product is excellent at what it does, and I believe what they have done with it, taking an open-so...
What is your primary use case for Corelight?
I have been using Corelight Open NDR solution for approximately three years. I leverage the Suricata engine heavily for alerting on indicators of compromise as my main use case for this solution.
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
Corelight Open NDR
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
CarrefourEdnonGrand Canyon EducationSektorCERTTietoevryVolkswagen Financial Services
Find out what your peers are saying about Cisco Secure Network Analytics vs. Corelight Open NDR and other solutions. Updated: September 2026.
918,970 professionals have used our research since 2012.