Cisco Sourcefire SNORT vs Vectra AI comparison

Read 48 Vectra AI reviews

12,037 Views
4,333 Comparison Views

97% willing to recommend

Cisco Sourcefire SNORT

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 19, 2024

Cisco Sourcefire SNORT and Vectra AI compete in the cybersecurity space, offering distinct sets of features aimed at enhancing network security. Cisco Sourcefire SNORT leads in pricing and customer support, while Vectra AI excels in advanced threat detection, making it attractive despite higher costs.

Features: Cisco Sourcefire SNORT provides effective intrusion detection and prevention using a comprehensive rule-based system, ensuring robust security controls. It benefits from an open-source foundation allowing community-driven improvements. Vectra AI employs AI and machine learning to deliver automated threat detection and insightful threat responses, offering real-time visibility and reducing the manual workload.

Room for Improvement: Cisco Sourcefire SNORT could enhance its ease of use, as its rule customization requires significant technical expertise. The interface could also be more intuitive to streamline usability. Vectra AI might look at further improving its complexity reduction, as setting initial configurations requires significant time investment. Some users may benefit from enhanced documentation to better navigate advanced features.

Ease of Deployment and Customer Service: Cisco Sourcefire SNORT offers clear deployment paths with extensive documentation, yet requires more technical skills. Its open-source community provides added support. Conversely, Vectra AI's cloud-based infrastructure simplifies deployment, complemented by superior customer service for smoother system integration.

Pricing and ROI: Cisco Sourcefire SNORT is known for favorable pricing due to its open-source nature, offering potentially high ROI with customizable capabilities. Vectra AI, while more expensive, justifies its cost with advanced features that promise reduced long-term risks, appealing to those investing in comprehensive security solutions.

To learn more, read our detailed Cisco Sourcefire SNORT vs. Vectra AI Report (Updated: August 2026).

Cisco Sourcefire SNORT vs. Vectra AI

August 2026

Download the complete report

Helped 908,858 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cisco Sourcefire SNORT

Ranking in Intrusion Detection and Prevention Software (IDPS)

12th

Average Rating

7.8

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Vectra AI

Ranking in Intrusion Detection and Prevention Software (IDPS)

5th

Average Rating

8.6

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

Network Detection and Response (NDR) (3rd), Extended Detection and Response (XDR) (20th), Identity Threat Detection and Response (ITDR) (10th), AI-Powered Cybersecurity Platforms (10th)

Mindshare comparison

As of August 2026, in the Intrusion Detection and Prevention Software (IDPS) category, the mindshare of Cisco Sourcefire SNORT is 3.0%, up from 2.6% compared to the previous year. The mindshare of Vectra AI is 6.2%, down from 8.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Intrusion Detection and Prevention Software (IDPS) Mindshare Distribution
Product	Mindshare (%)
Vectra AI	6.2%
Cisco Sourcefire SNORT	3.0%
Other	90.8%

Intrusion Detection and Prevention Software (IDPS)

Featured Reviews

reviewer2772102

Cloud Architect at a consultancy with 1-10 employees

Logging and customizable rules have helped improve threat monitoring and detection

The logging is mainly what I consider one of the best features with Cisco Sourcefire SNORT. Being able to log and store it in a file allows you to push it to a centralized repository. The logging and reporting help improve incident response. You should always be logging threats, any sort of misconfiguration, and anything that could be an issue. It's important to at least log and monitor it. The basic rules provide a good baseline in assessing Cisco Sourcefire SNORT's ability in providing real-time analytics for threat detection, but as a professional, you should look to constantly modify that baseline. They provide extensive customizability so you can define your own rules. The customizability allows it to be adaptable in protecting against diverse network threats to the constant change.

Read full review

RahulReddy

Consultant at a retailer with 5,001-10,000 employees

Threat detection has improved and malicious emails are now identified quickly

Vectra AI offers artificial intelligence capabilities with visibility that can be integrated into our day-to-day operations and other tools, including malware detection tools and cyber threat tools. Vectra AI has positively impacted my organization. Last year while using it, we received many malicious email threats and virus incidents, including a trojan virus that had reportedly been deployed by someone. Our company used Vectra AI to detect the malicious threats and viruses before they could cause more damage, and we successfully stopped the threats. Using Vectra AI, I notice that server downtime has decreased significantly. We now experience only two to three hours of downtime, whereas without Vectra AI and other tools, our downtime would exceed 48 to 72 hours.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"In general, the features are all great. However, if I need to take hardware for ASA, because they need to upgrade to Firepower, we want to create rules. For that, most of the time we go to the command line. Right now Firepower is working really hard on the grid. You can apply all those rules to the grid. Even if you want to monitor the logs, for example, the activity will tell you which particular user has been blocked because of that rule. Firepower's monitoring interface is very good, because you can see each and every piece. ASA also had it, but there you needed to type the command and be under the server to see all that stuff. In Firepower you have the possibility to go directly to the firewall. The way the monitoring is displayed is also very nice. The feature I appreciate most in Firepower is actually the grid. The grid has worked very well."

"The URL filtering is very good and you can create a group for customized URLs."

"Solid intrusion detection and prevention that scales easily in very large environments."

"Cisco Sourcefire SNORT is easy to configure and the reporting is great. It's also very user-friendly."

"The logging is mainly what I consider one of the best features with Cisco Sourcefire SNORT; being able to log and store it in a file allows you to push it to a centralized repository."

"This solution makes life a lot easier as there are fewer man-hours required and we no longer need too many resources to manage it."

"Cisco technical support is unbeatable. It offers a premium service every time."

"The solution is rather easy to use."

More Cisco Sourcefire SNORT pros

"Some valuable features of Vectra AI are that it is very intuitive and that there are only a small amount of false positives. Therefore, it's an effective solution."

"One of the most valuable features is all the correlation that it does using AI and machine learning. An example would be alerting on a host and then alerting on other things, like abnormal behavior, that it has noticed coming from the same host. It's valuable because we're a very lean team."

"The initial setup was pretty straightforward."

"It has helped us to organize our security. We get a better overview on what is happening on the network, which has helped us get quicker responses to users. If we see malicious activity, then we can quickly take action on it. Previously, we weren't getting an overview as fast as we are now, so we can now provide a quicker response."

"Vectra was the only tool that picked up almost all the red team penetration activities, helped us detect threats in their initial recon phase before they caused damage, and has significantly reduced the time it takes us to respond to attacks."

"It has to be up there with my favorite security tool set at the moment."

"After we deployed the solution it instantly began to add value to our security operations."

"With Vectra, we become more proactive than reactive, more often than not we pick things up before the actual damage can start, and it picks up things that none of our other tools pick up because it's designed to detect things before harm is done, at the initial stages."

More Vectra AI pros

Cons

"I want to see a better dashboard for the product. The dashboard can be a bit modified or enhanced."

"I would like to have analytics included in the suite."

"The pricing needs to be improved. We have lots of low-budget clients around us. Budget constraints are always a deterrent in our market."

"Cisco Sourcefire SNORT can scale, but if you have too much, you could fill up your log files, which I consider when discussing scalability."

"The customization of the rules can be simplified."

"I don't think this solution is a time-based control system, because one cannot filter traffic based on time."

"The utopia is to see everything from one dashboard, but sometimes that's not very possible."

"There are some bugs in this solution and troubleshooting them is complicated."

More Cisco Sourcefire SNORT cons

"The solution's ability to reduce false positives wasn't very good, initially, because it was picking up so much information."

"Cost-wise, they're not cheap. They were definitely the most expensive option, but you get what you pay for."

"What is most important for us is to have one place where we can manage a few brains because we are based on a zero-trust network. As a result, each customer needs to have a separate brain. For the SOC team, we need to have one place where the SOC analyst can go to visit the website and from that site manage all of the customers. Right now, Vectra AI doesn't have this capability, and I would really like to have this feature."

"We have had a few issues with the integration of Vectra AI with EDR. Some filters have not been working. We've also had issues with the brain not being powerful enough."

"For S&D account scans, it would be easier if Vectra AI could triage with users. If a client uses a lot of accounts, then it could indicate that these accounts are benign, for example. That would help a lot."

"If you hit a certain number of rules, triage filters, or groups, the UX responds more slowly. However, we have a complex network and a lot of rules. So, our setup might not be a typical implementation example. We even had UX engineers onsite, and they looked at issues, improvements, and user feedback. Since then, it has gotten a lot better, they even built in features that we specifically requested for our company."

"The reporting from Cognito Detect is very limited and doesn't give you too many options. If I want to prepare a customized report on a particular host, even though I see the data, I have to manually prepare the report. The reporting features that are built into the tool are not very helpful."

"One area where there's room for improvement is the absence of a comprehensive TCP recording and replay feature."

More Vectra AI cons

Pricing and Cost Advice

"Licensing for this solution is paid on a yearly basis."

"I don't know the exact amount, but most of the time when I go to a company with a proposition, they will say, "This thing that you are selling is good, but it's expensive. Why don't you propose something like FortiGate, Check Point, or Palo Alto?" Cisco device are expensive compared to other devices."

"We have a three-year license for this solution."

"If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five."

"The cost is per port and can be expensive but it does include training and support for three years."

"The license is based on the concurrent IP addresses that it's investigating. We have 9,800 to 10,000 IP addresses."

"From a licensing perspective, the Vectra detect platform is pretty doable. Also, the hardware prices are nothing that we're not used to. The stream part is a little overpriced compared to the detect part. The reason is that you need to stream data to detect events anyway, so the data is in there. The only thing that's not available is the UI to be able to look at the stream data, which is also on the appliances but is just not activated. That's mainly the thing that we want to improve on."

"Vectra is a bit on the higher side in terms of price, but they have always been transparent. The reason that they are this good is that they invest, so they need to charge accordingly."

"At the time of purchase, we found the pricing acceptable. We had an urgency to get something in place because we had a minor breach that occurred at the tail end of 2016 to the beginning of 2017. This indicated we had a lack of ability to detect things on the network. Hence, why we moved quickly to get into the tool in place. We found things like Bitcoin mining and botnets which we closed quickly. In that regard, it was worth the money."

"We have a desire to increase our use. However, it all comes down to budget. It's a very expensive tool that is very difficult to prove business support for. We would like to have two separate networks. We have our corporate network and PCI network, which is segregated due to payment processing. We don't have it for deployed in the PCI network. It would be good to have it fully deployed there to provide us with additional monitoring and control, but the cost associated with their licensing model makes it prohibitively expensive to deploy."

"We are running at about 90,000 pounds per year. The solution is a licensed cost. The hardware that they gave us was pretty much next to nothing. It is the license that we're paying for."

"My company pays for the Vectra AI licensing fee yearly. I know the figure because my company recently renewed the license, and it's okay, at least for the financial sector."

"From a pricing perspective, they are very commercially competitive. From a licensing perspective, just be conscious that some of their future cloud solutions come with additional subscriptions. Also, if you're outside of the US, you will get charged freight for the device back to your country."

More Vectra AI pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.

See recommendations

908,858 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

13%

Financial Services Firm

Comms Service Provider

Outsourcing Company

Manufacturing Company

Financial Services Firm

Computer Software Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	9
Large Enterprise	7

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	10
Large Enterprise	29

Questions from the Community

What is your experience regarding pricing and costs for Cisco Sourcefire SNORT?

If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five. There are some other tools in the market that are more expensive than Cisco. There are no additional c...

What needs improvement with Cisco Sourcefire SNORT?

I have not had much experience with the community-driven rule set while utilizing Cisco Sourcefire SNORT. I don't have experience with recognizing zero-day vulnerabilities, but based on my knowledg...

What is your primary use case for Cisco Sourcefire SNORT?

Endpoint protection is the main use case. The main aspect involves specifying different rules, and when network traffic hits these rules, it will try to block the traffic or at least log the traffi...

What is your experience regarding pricing and costs for Vectra AI?

I find the pricing of Vectra AI to be one of the best we have seen as feedback from customers and partners indicates it is very competitive for an EDR solution.

What needs improvement with Vectra AI?

I think one area that could be improved about Vectra AI is their marketing. One of the aspects that Darktrace excels at is their marketing, and I do not feel Vectra AI is on that level yet, leading...

What is your primary use case for Vectra AI?

I primarily use Vectra AI for customers, and I only provide Vectra AI.

ExtremeCloud IQ vs Cisco Sourcefire SNORT

Comparisons

Compared 9% of the time

Splunk User Behavior Analytics vs Cisco Sourcefire SNORT

Compared 9% of the time

TrendAI Tipping Point vs Cisco Sourcefire SNORT

Compared 8% of the time

Fortra's Tripwire Enterprise vs Cisco Sourcefire SNORT

Compared 8% of the time

Check Point IPS vs Cisco Sourcefire SNORT

Compared 5% of the time

More Cisco Sourcefire SNORT Competitors

Darktrace vs Vectra AI

Compared 13% of the time

Rapid7 InsightIDR vs Vectra AI

Compared 5% of the time

Cisco Secure Network Analytics vs Vectra AI

Compared 4% of the time

ExtraHop Reveal(x) vs Vectra AI

Compared 4% of the time

ExtraHop Reveal(x) 360 vs Vectra AI

Compared 3% of the time

More Vectra AI Competitors

Product Reports

Download Cisco Sourcefire SNORT product report

Cisco Sourcefire SNORT

August 2026

Download Vectra AI product report

July 2026

Also Known As

Sourcefire SNORT

Vectra Networks, Vectra AI NDR

Overview

Cisco Sourcefire SNORT is a versatile cybersecurity tool offering threat detection, scalability, and integration with Cisco tools. It is recognized for ease of configuration and comprehensive protection, making it suitable for intrusion prevention and firewall applications.

Cisco Sourcefire SNORT provides advanced malware protection and integrates seamlessly with Cisco products. It enables automatic IPS tuning, real-time visibility, and intelligent security automation, which together enhance network security. Users benefit from its URL filtering, email spam elimination, and it delivers low false positives. Though highly effective, feedback highlights a desire for improvements in stability, dashboard effectiveness, traffic blocking customizations, and integration with Cisco DNA Center. Cost concerns and calls for cloud-based deployments also emerge in user feedback. Technical support and performance are also discussed, with VPN configuration posing challenges.

What are the key features of Cisco Sourcefire SNORT?

Threat Detection: Identifies and mitigates network threats efficiently.
Scalability: Easily adapts to growing network demands.
Cisco Integration: Works smoothly with existing Cisco infrastructure.
Advanced Malware Protection: Provides comprehensive security against sophisticated threats.
Real-Time Visibility: Offers live insights into network activity.
Automatic IPS Tuning: Adjusts security policies dynamically.

What benefits can be found in user reviews?

Ease of Configuration: Streamlined setup process.
Comprehensive Protection: Low false positive rates ensuring broader security.
Robust Support: Access to extensive Cisco support network.

Organizations primarily deploy Cisco Sourcefire SNORT for network security in sectors like finance and healthcare. Used extensively in data centers with Cisco Firepower, it provides intrusion prevention, URL filtering, and VPN security. Pre-configured settings make it practical for on-premises deployment, ensuring secure user-to-server and server-to-server interactions.

Cisco

Vectra AI offers advanced hybrid network and identity security, detecting threats traditional tools miss. It uses AI to identify lateral attacks and credential misuse, providing a proactive defense for enterprises.

Vectra AI enhances security by using AI-driven detection across network, cloud, and identity layers, surpassing EDR and SIEMs by offering real-time threat detection. It ensures continuous observability and automates SOC workflows to minimize manual efforts, creating an efficient security environment. Its AI-powered approach significantly reduces noise, focusing on true threats, and provides insights into complex threat landscapes, with seamless integration into environments like EDR and Office 365.

What are Vectra AI's key features?

AI-driven detection: Identifies lateral movement and credential misuse across networks.
Continuous observability: Monitors data centers, cloud, SaaS, and OT environments.
SOC automation: Reduces manual processes, lowering analyst fatigue.
Attack Signal Intelligence: Filters noise to deliver relevant alerts quickly.
Network visibility: Provides insight into encrypted traffic and unmanaged assets.

What benefits should users expect?

Improved threat detection: Faster identification of potential threats.
Efficiency in response: Automated processes free resources for high-impact tasks.
Reduced alert fatigue: Intelligent alerts reduce false positives.
Operational integration: Works seamlessly with existing platforms and tools.

Vectra AI is utilized across industries for comprehensive network and anomaly detection. Organizations deploy it for threat hunting and incident response, monitoring both on-premises and cloud activities. By placing sensors across sites, they optimize security practices and streamline their detection processes.

Sample Customers

CareCore, City of Biel, Dimension Data, LightEdge, Lone Star College System, National Rugby League, Port Aventura, Smart City Networks, Telecom Italia, The Department of Education in Western Australia

Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association