Cisco Sourcefire SNORT vs Vectra AI comparison

Read 45 Vectra AI reviews

8,365 Views
3,513 Comparison Views

97% willing to recommend

Cisco Sourcefire SNORT

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 19, 2024

Cisco Sourcefire SNORT and Vectra AI compete in the cybersecurity space, offering distinct sets of features aimed at enhancing network security. Cisco Sourcefire SNORT leads in pricing and customer support, while Vectra AI excels in advanced threat detection, making it attractive despite higher costs.

Features: Cisco Sourcefire SNORT provides effective intrusion detection and prevention using a comprehensive rule-based system, ensuring robust security controls. It benefits from an open-source foundation allowing community-driven improvements. Vectra AI employs AI and machine learning to deliver automated threat detection and insightful threat responses, offering real-time visibility and reducing the manual workload.

Room for Improvement: Cisco Sourcefire SNORT could enhance its ease of use, as its rule customization requires significant technical expertise. The interface could also be more intuitive to streamline usability. Vectra AI might look at further improving its complexity reduction, as setting initial configurations requires significant time investment. Some users may benefit from enhanced documentation to better navigate advanced features.

Ease of Deployment and Customer Service: Cisco Sourcefire SNORT offers clear deployment paths with extensive documentation, yet requires more technical skills. Its open-source community provides added support. Conversely, Vectra AI's cloud-based infrastructure simplifies deployment, complemented by superior customer service for smoother system integration.

Pricing and ROI: Cisco Sourcefire SNORT is known for favorable pricing due to its open-source nature, offering potentially high ROI with customizable capabilities. Vectra AI, while more expensive, justifies its cost with advanced features that promise reduced long-term risks, appealing to those investing in comprehensive security solutions.

To learn more, read our detailed Cisco Sourcefire SNORT vs. Vectra AI Report (Updated: September 2025).

Cisco Sourcefire SNORT vs. Vectra AI

September 2025

Download the complete report

Helped 871,408 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cisco Sourcefire SNORT

Ranking in Intrusion Detection and Prevention Software (IDPS)

16th

Average Rating

7.6

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Vectra AI

Ranking in Intrusion Detection and Prevention Software (IDPS)

5th

Average Rating

8.6

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Network Detection and Response (NDR) (2nd), Extended Detection and Response (XDR) (16th), Identity Threat Detection and Response (ITDR) (9th), AI-Powered Cybersecurity Platforms (6th)

Mindshare comparison

As of October 2025, in the Intrusion Detection and Prevention Software (IDPS) category, the mindshare of Cisco Sourcefire SNORT is 2.7%, up from 2.3% compared to the previous year. The mindshare of Vectra AI is 8.0%, up from 7.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Intrusion Detection and Prevention Software (IDPS) Market Share Distribution
Product	Market Share (%)
Vectra AI	8.0%
Cisco Sourcefire SNORT	2.7%
Other	89.3%

Intrusion Detection and Prevention Software (IDPS)

Featured Reviews

Jack Poon

Treasury Specialist at Dah Sing Bank

Offers ease of setup and good documentation

When it comes to the product's deployment phase, we have a lot of vendor support. We have a lot of skills here in Hong Kong. Our company doesn't find any problem deploying Cisco solutions. The solution is deployed on an on-premises version. Speaking about the time required to deploy the solution, I would say that we have quite a lot of previous experience with deploying Cisco products. We have our company's standard design document, which we need to follow. We have a standard testing procedure for all those features. We just take out some appropriate parts and then compile them into one document for an individual project. It is actually quite easy for us to do the documentation, so it just takes one or two hours, and we can do the implementation because all the materials and testing procedures are already in our company standard documents, so it is not that difficult for us.

Read full review

Mohammad Alkurdi

Owner at Fortibits

Innovative detection features enhance monitoring

The advantages of the integration are not entirely out-of-the-box. You have to do it manually. When I'm doing tier response, an out-of-the-box solution is not available. You need to have a Linux server, and from the Linux server, you must perform AI tasks, and there is a lot to be handled in the back end. This is a major consideration about them. The recall feature, if it can be placed in some areas instead of the cloud, and charged for, would be better. Recall the storage where you watch all the traffic, and you can recall it and try to analyze it in the back end. It’s cloud-based. If they offer it on-prem, it would be better. I think they have a solution, but I have never tested it, to be honest with you.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Solid intrusion detection and prevention that scales easily in very large environments."

"The solution can be integrated with some network electors like Cisco Stealthwatch, Cisco ISE, and Active Directory to provide the client with authentication certificates."

"The solution is stable."

"The most valuable features of Cisco Sourcefire SNORT are the dashboard for monitoring events."

"It has a huge rate of protection. It's has a low level of positives and a huge rate of threat protection. It's easy to deploy and easy to implement. It has an incredible price rate compared to similar solutions."

"The most valuable feature of this solution is the filtering."

"The solution is rather easy to use."

"It is quite an intelligent product."

More Cisco Sourcefire SNORT pros

"The administrative privilege detection feature is the most valuable feature. The admin accounts are often highly accessible to the high-risk component of the environment. If those accounts are compromised or are being used in a suspicious manner, that's high-fidelity events for us to look into."

"It's important for us that the user interface is easy to understand and that is the biggest benefit we see from Vectra AI."

"It is doing some artificial intelligence. If it sees a server doing a lot of things, then it will assume that is normal. So, it is looking for anomalous behavior, things that are out of context which helps us reduce time. Therefore, we don't have to look in all the logs. We just wait for Vectra to say, "This one is behaving strange," then we can investigate that part."

"The dashboard gives me a scoring system that allows me to prioritize things that I should look at. I may not necessarily care so much about one event, whereas if I have a single botnet detection or a brute force attack, I really want to get on top of those."

"The solution's ability to reduce alerts, by rolling up numerous alerts to create a single incident or campaign, helps in that it collapses all the events to a particular host, or a particular detection to a set of hosts. So it doesn't generate too many alerts. By and large, whatever alerts it generates are actionable, and actionable within the day."

"The fact that we get the visualization of what's happening on our network, which is a way of improving our security in-depth is most valuable."

"It has reduced the time it takes to respond to attacks. That comes back to the proactive point. It makes us able to lower down in the kill chain, we can react now, rather than reacting to incidents that happened, we can see an instant, in some cases, as it's being implemented, or as it's being launched."

"The solution provide visibility into behaviors across the full lifecycle of an attack in our network, beyond just the Internet gateway. It makes our security operations much more effective because we are now looking not just at traffic on the border, but we're looking at east-west internal traffic. Now, not only will we see if an exploit kit is being downloaded, but we would be able to see then if that exploit kit was then laterally distributed into our environment."

More Vectra AI pros

Cons

"Integration with other components — even Cisco's own products — can be enhanced to improve administrative experience."

"To be frank, the product is not really stable, although they're working on that. Whenever I go to the technical community with an issue, they will usually say that it is not there yet, but the technical team are working on it. The issues are not insolvable. I think they should just keep working on the product to make sure that the product can become very stable. The technical support is great. I appreciate that. We have a lot of communities supporting Firepower now, so you can find help for whatever issue you have."

"I don't think this solution is a time-based control system, because one cannot filter traffic based on time."

"I did not experience any pain points that required improvement. Maybe a couple of false-positives, but that's about it."

"The initial setup is a little difficult compared to other products in the market. It depends on the environment. If we are doing any migration, it might take months in a brown-field environment."

"We are unhappy with technical support for this solution, and it is not as professional as what we typically expect from Cisco."

"I want to see a better dashboard for the product. The dashboard can be a bit modified or enhanced."

"While the alerts they offer are good, it could improve it in the sense that they should be more detailed to make the alerts more useful to us in general. Sometimes the solution will offer up false positives. Due to the fact that the alerts aren't detailed, we have to go dig around to see why is it being blocked. The solution would be infinitely better if there was just a bit more detail in the alert information and logging we receive."

More Cisco Sourcefire SNORT cons

"I would like to see data processed onshore. Right now, the cloud components, like Office 365, must be processed on servers outside of Australia. I would like to see a future adoption of onshore processing."

"One of the things I am not so happy about when it comes to Vectra is the scoring board."

"In education as a sector, we are looking at AI a lot in terms of how it can be used as part of the teaching and learning side of things. It would be great to have Vectra AI look at a better way to enhance the security posture related to the AI tools in our portfolio."

"I think Vectra AI's automation, reporting, and integration could be improved."

"The main improvement I can see would be to integrate with more external solutions."

"The solution has not reduced the security analyst workload in our organization because we still need to SIEM. Unfortunately, while Vectra, for us, is a brilliant tool for network investigations, giving wonderful visibility, it doesn't go the whole way to replace our SIEM that is needed for compliance. So, I still have the same amount of alerting and logging that I did before. It gives us more defined ability to see incidents, but it doesn't give us enough information to satisfy a PCI or 27001 audit."

"The false positives and the tuning side of it is something that could use improvement. But that could be from our side."

"The solution's marketing is not good."

More Vectra AI cons

Pricing and Cost Advice

"Licensing for this solution is paid on a yearly basis."

"The cost is per port and can be expensive but it does include training and support for three years."

"We have a three-year license for this solution."

"If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five."

"I don't know the exact amount, but most of the time when I go to a company with a proposition, they will say, "This thing that you are selling is good, but it's expensive. Why don't you propose something like FortiGate, Check Point, or Palo Alto?" Cisco device are expensive compared to other devices."

"The solution is low-cost and affordable."

"Vectra's pricing is too high. All schools will not be able to afford it. Vectra will only end up targeting higher education and higher value independence purely because of the price. A lot of schools would love to have a product like Vectra AI, but they simply can't because they struggle to even pay the high E5 licensing from Microsoft. When you're up against that, Vectra AI is never going to be within the sector's price range."

"My company pays for the Vectra AI licensing fee yearly. I know the figure because my company recently renewed the license, and it's okay, at least for the financial sector."

"From a pricing perspective, they are very commercially competitive. From a licensing perspective, just be conscious that some of their future cloud solutions come with additional subscriptions. Also, if you're outside of the US, you will get charged freight for the device back to your country."

"From a licensing perspective, the Vectra detect platform is pretty doable. Also, the hardware prices are nothing that we're not used to. The stream part is a little overpriced compared to the detect part. The reason is that you need to stream data to detect events anyway, so the data is in there. The only thing that's not available is the UI to be able to look at the stream data, which is also on the appliances but is just not activated. That's mainly the thing that we want to improve on."

"There are additional features that can be purchased in addition to the standard licensing fee, such as Cognito Recall and Stream."

"It's relatively on the pricier side, but when compared to other solutions. It's not the most budget-friendly option, but it can be considered somewhat more cost-effective in comparison to other alternatives."

"Vectra AI is not a cheap solution."

More Vectra AI pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.

See recommendations

871,408 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

10%

Financial Services Firm

10%

University

10%

Manufacturing Company

Financial Services Firm

11%

Computer Software Company

11%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	8
Large Enterprise	7

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	10
Large Enterprise	27

Questions from the Community

What do you like most about Cisco Sourcefire SNORT?

The product is inexpensive compared to leading brands such as Palo Alto or Fortinet.

What is your experience regarding pricing and costs for Cisco Sourcefire SNORT?

If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five. There are some other tools in the market that are more expensive than Cisco. There are no additional c...

What needs improvement with Cisco Sourcefire SNORT?

Cisco offers the Cisco DNA Center, which is a source that provides crucial information for us to monitor performance, and see whether there is any trouble. We are using Cisco DNA center, but again,...

What is the biggest difference between Corelight and Vectra AI?

The two platforms take a fundamentally different approach to NDR. Corelight is limited to use cases that require the eventual forwarding of events and parsed data logs to a security team’s SIEM or ...

What do you like most about Vectra AI?

The solution is currently used as a central threat detection and response system.

What is your experience regarding pricing and costs for Vectra AI?

It is very acceptable when you compare it with Darktrace, for example.

Fortinet FortiGate vs Cisco Sourcefire SNORT

Comparisons

Compared 18% of the time

Palo Alto Networks Advanced Threat Prevention vs Cisco Sourcefire SNORT

Compared 17% of the time

Cisco Secure IPS (NGIPS) vs Cisco Sourcefire SNORT

Compared 17% of the time

ExtremeCloud IQ vs Cisco Sourcefire SNORT

Compared 9% of the time

Trend Micro TippingPoint Threat Protection System vs Cisco Sourcefire SNORT

Compared 7% of the time

More Cisco Sourcefire SNORT Competitors

Darktrace vs Vectra AI

Compared 28% of the time

ExtraHop Reveal(x) vs Vectra AI

Compared 11% of the time

Corelight vs Vectra AI

Compared 7% of the time

Cisco Secure Network Analytics vs Vectra AI

Compared 5% of the time

Arista NDR vs Vectra AI

Compared 4% of the time

More Vectra AI Competitors

Product Reports

Download Cisco Sourcefire SNORT product report

Cisco Sourcefire SNORT

October 2025

Download Vectra AI product report

September 2025

Also Known As

Sourcefire SNORT

Vectra Networks, Vectra AI NDR

Overview

Snort is an open-source, rule-based, intrusion detection and prevention system. It combines the benefits of signature-, protocol-, and anomaly-based inspection methods to deliver flexible protection from malware attacks. Snort gained notoriety for being able to accurately detect threats at high speeds.

Cisco

Vectra AI enhances security operations by pinpointing attack locations, correlating alerts, and providing in-depth visibility across attack lifecycles, ultimately prioritizing threats and improving incident responses.

Vectra AI integrates AI and machine learning to detect anomalies early and supports proactive threat response. Its features like risk scoring, alert correlation, and streamlined SOC efficiency are supplemented by integration with tools like Office 365. Users highlight integration, reporting, and customization challenges, alongside limitations in syslog data and false positive management. They seek enhancements in visualization, UI, TCP replay, endpoint visibility, and tool orchestration, with requests for improved documentation, licensing, and cloud processing innovation.

What are the key features of Vectra AI?

Attack Location Identification: Pinpoints specific locations of security breaches.
Alert Correlation: Combines multiple alerts into a single incident for efficiency.
Visibility Across Attack Lifecycle: Offers detailed insight through different attack stages.
Risk Scoring: Aggregates risk scores to prioritize imminent threats.
AI and Machine Learning: Detects anomalies early to aid in proactive threat response.
Integration with Office 365: Seamlessly consolidates data for enriched investigations.

What benefits should users look for?

Enhanced SOC Efficiency: Reduces alert fatigue and improves operational efficiency.
Threat Prioritization: Focuses on the most critical threats with risk scoring.
Proactive Threat Response: Early anomaly detection aids in swift response.
Operational Overhead Reduction: Seamless integration minimizes extra workload.
Compliance and Policy Support: Assists in adhering to policies and regulations.

In industries like finance, healthcare, and critical infrastructure, Vectra AI is crucial for threat detection and network monitoring. Entities use it for identifying anomalous behaviors and enhancing cybersecurity by responding to network activities and analyzing traffic for potential breaches. It operates on-premises and in hybrid cloud settings, enabling threat detection without endpoint agents and supporting compliance and policy enforcement.

Sample Customers

CareCore, City of Biel, Dimension Data, LightEdge, Lone Star College System, National Rugby League, Port Aventura, Smart City Networks, Telecom Italia, The Department of Education in Western Australia

Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association