Try our new research platform with insights from 80,000+ expert users

Cisco Secure Network Analytics vs Fortinet FortiSandbox comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco Secure Network Analytics
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
61
Ranking in other categories
Network Monitoring Software (33rd), Network Traffic Analysis (NTA) (5th), Network Detection and Response (NDR) (7th), Cisco Security Portfolio (8th)
Fortinet FortiSandbox
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
38
Ranking in other categories
Advanced Threat Protection (ATP) (4th), Threat Deception Platforms (6th)
 

Mindshare comparison

While both are Network Security Systems solutions, they serve different purposes. Cisco Secure Network Analytics is designed for Network Monitoring Software and holds a mindshare of 1.2%, down 1.4% compared to last year.
Fortinet FortiSandbox, on the other hand, focuses on Advanced Threat Protection (ATP), holds 8.7% mindshare, down 9.7% since last year.
Network Monitoring Software Market Share Distribution
ProductMarket Share (%)
Cisco Secure Network Analytics1.2%
Zabbix11.7%
LibreNMS4.6%
Other82.5%
Network Monitoring Software
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Fortinet FortiSandbox8.7%
Palo Alto Networks WildFire10.7%
Microsoft Defender for Endpoint8.9%
Other71.7%
Advanced Threat Protection (ATP)
 

Featured Reviews

Muhammad Harun-Owr-Roshid - PeerSpot reviewer
Have streamlined network visibility and troubleshooting while seeing benefits from AI integration
In terms of improvements for Cisco Secure Network Analytics, from the implementation point of view, now that AI is in use, some other features need to be upgraded considering AI solutions. Proper management of the database is also important; it should be centralized for easier data collection from a single database. When precise manual analysis is needed, it's sometimes difficult, so having a centralized database will allow network admins to find actual scenarios more effectively, especially since some information may not be visible on the GUI. Cisco should upgrade their hardware part to run the database, because sometimes it cannot handle the load while all features are running in the network. The database management should indeed be centralized because while AI runs behind the systems, central management is essential. For example, in a network with 100 Cisco switches, a few routers, firewalls, and access points, all data generated should be preserved in a central database. This approach simplifies management and analysis for troubleshooting, as GUI interfaces may not always provide visible information. Centralizing the database will allow for better understanding of which information is preserved for each specific device.
Abdelhamid Saber - PeerSpot reviewer
Enhanced network security with adaptable integration and really good support
We use FortiSandbox for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues. The adapter is beneficial as it…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is integration."
"The most valuable feature of the solution is that it helps you gain visibility for your application."
"If you are using Darktrace or NAC solutions you can integrate Stealthwatch."
"It provides good visibility to the customers. People are still evaluating it, but it provides visibility and helps them to take action to remediate and mitigate the issues that are highlighted on the dashboard. It has good integration with the Cisco switching platform."
"Cisco Stealthwatch has predefined alerts for different types of security issues that might happen in the network. Whether it's PCs or servers that are used for botnets or Bitcoin mining we receive the alerts automatically. This functionality is what we receive from the solution out of the box."
"The feature most valuable for us is to gain visibility of what is actually floating through, so we can stop it based on whether it's good or bad traffic."
"The most valuable feature of this solution is the way the net flow is being merged together in a single pane. That's been extremely useful for us, because can see what's going on with traffic in one single place."
"This product alleviates the day-to-day headaches for us, in regards to metrics."
"Compared to other solutions, it's easy to configure and implement because of the templates. The timing of scanning files is faster."
"The technical support is very good."
"The main benefit of Fortinet FortiSandbox is that it allows organizations to detect and prevent unknown threats from entering an infrastructure."
"The scanner office document as well as PDF are useful. The most valuable thing is that you can emulate different operating systems without having the danger of getting something infected. It emulates several operating systems, and as a result, you either get the file or you don't get the file."
"The most valuable feature was the EDR, endpoint detection and response."
"he solution's GUI is good."
"It is a stable solution."
"The dynamic behavior analysis is excellent. We have many attacks caught by the FortiSandbox as zero-day attacks. Additionally, the administration is simple and can be customized to fit your companies needs."
 

Cons

"It is time-consuming to set it up and understand how the tool works."
"One area that could be improved in SNA is the integration with Cisco ISE for user and session details, which currently requires additional setup."
"One update I would like to see is an agent-based client. Currently StealthWatch is network based."
"The initial setup was complex."
"Many of these tools require extensive on-premises hardware to run."
"We would like the solution to make more advances in the way that Extreme Networks has been doing."
"At my company, we might not be using it enough with other applications that we have that can integrate with it."
"We determined that Stealthwatch wouldn't provide the machine learning model that we required."
"Something that needs to improve, is the end-point protection."
"The main area of concern in Fortinet FortiSandbox is its detection capabilities."
"The reporting tools could be improved in Fortinet FortiSandbox."
"The use cases in Fortinet FortiSandbox are not good. It is difficult to upload a custom VM for Fortinet FortiSandbox. The integration of Fortinet FortiSandbox with other Fortinet or FortiGate firewalls is not good. VMs are already installed in the hardware and are working fine, but we tried to approve the custom VM many times but did not succeed."
"The initial setup is not too complex but could be easier."
"For the MSSPs, it would be great if the product could display all the threat chains on a dashboard since it is an area where the tool is currently lacking."
"The initial setup of Fortinet FortiSandbox is complex. You cannot only deploy Fortinet FortiSandbox without deploying the stack of Fortinet solutions. The implementation and integration are challenging tasks with the device and placement in the network. We needed to do POC and offloading testing."
"There could be more templates and a higher number of simulated VMs to configure more use cases. Sometimes we need to configure many use cases in many different environments, and if the number of VMs that we configure is limited, we have to remove some and reconfigure the environment if we need another environment."
 

Pricing and Cost Advice

"One of the things which bugs me about Lancope is the licensing. We understand how licensing works. Our problem is when we bought and purchased most of these Lancope devices, we did so with our sister company. Somewhere within the purchase and distribution, licensing got mixed up. That is all on Cisco, and it is their responsibility. They allotted some of our sister company's equipment to us, and some of our equipment to them. To date, they have never been able to fix it."
"The solution is expensive. It costs several hundred thousand dollars per year (depending on how many flows you are collecting)."
"The licensing costs are outrageous."
"Today, we are part of the big Cisco ELA, and it is a la carte. We can get orders for whatever we want. At the end of the day, we have to pay for it in one big expense, but that is fine. We are okay with that."
"This is an expensive product. We have quit paying for support because we don't want to have to upgrade it and keep paying for it."
"There are additional licenses needed for the number of so-called network flows. It's hard to plan the number of flows you need in the network, this is a problem. The price of the Cisco Stealthwatch is relatively inexpensive"
"It has a subscription model. There is yearly support, and there is also three-year support. It depends on what the customers want."
"Pricing is much higher compared to other solutions."
"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."
"It is an expensive solution."
"The solution is not expensive at all."
"The license for Fortinet FortiSandbox depends on the use case."
"There is a license to use this solution."
"The solution is affordable."
"The solution is unavailable at a lower cost and can be difficult to deploy."
"Altogether, it is about €10,000 for the Sandbox and Email Gateway."
report
Use our free recommendation engine to learn which Network Monitoring Software solutions are best for your needs.
867,676 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
22%
Government
10%
Financial Services Firm
9%
Manufacturing Company
9%
Computer Software Company
13%
Government
11%
Financial Services Firm
9%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise7
Large Enterprise52
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise13
Large Enterprise9
 

Questions from the Community

What do you like most about Cisco Stealthwatch?
The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration.
What is your experience regarding pricing and costs for Cisco Stealthwatch?
Regarding cost, for the Bangladesh context, Cisco Secure Network Analytics is a little bit high-priced because we are a developing country, making it tough to manage affordable solutions. However, ...
What needs improvement with Cisco Stealthwatch?
In terms of improvements for Cisco Secure Network Analytics, from the implementation point of view, now that AI is in use, some other features need to be upgraded considering AI solutions. Proper m...
What do you like most about Fortinet FortiSandbox?
The real-time analysis capability of FortiSandbox is beneficial for email analysis.
What is your experience regarding pricing and costs for Fortinet FortiSandbox?
I think it's affordable. For the six to seven months of usage, the cost has been reasonable.
What needs improvement with Fortinet FortiSandbox?
We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, ...
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
FortiSandbox
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG
Find out what your peers are saying about Zabbix, Auvik, SolarWinds and others in Network Monitoring Software. Updated: September 2025.
867,676 professionals have used our research since 2012.