Try our new research platform with insights from 80,000+ expert users

Cybereason Endpoint Detection & Response vs Darktrace comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cybereason Endpoint Detecti...
Average Rating
8.0
Reviews Sentiment
7.9
Number of Reviews
21
Ranking in other categories
Endpoint Protection Platform (EPP) (35th), Endpoint Detection and Response (EDR) (24th)
Darktrace
Average Rating
8.2
Reviews Sentiment
7.2
Number of Reviews
82
Ranking in other categories
Email Security (9th), Intrusion Detection and Prevention Software (IDPS) (1st), Network Traffic Analysis (NTA) (1st), Network Detection and Response (NDR) (1st), Extended Detection and Response (XDR) (6th), Cloud Security Posture Management (CSPM) (15th), Cloud-Native Application Protection Platforms (CNAPP) (11th), Attack Surface Management (ASM) (4th), AI-Powered Cybersecurity Platforms (2nd)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Cybereason Endpoint Detection & Response is designed for Endpoint Detection and Response (EDR) and holds a mindshare of 0.9%, down 1.1% compared to last year.
Darktrace, on the other hand, focuses on Network Detection and Response (NDR), holds 23.6% mindshare, down 25.5% since last year.
Endpoint Detection and Response (EDR)
Network Detection and Response (NDR)
 

Featured Reviews

AtulChaurasia - PeerSpot reviewer
Scalable platform with intuitive features for detecting malicious files
The initial setup process is straightforward. We have to install the agent, create a package, and deploy it on servers. It has a prebuilt console managed by the cloud team of Cybereason. We don't have to worry about the console and concentrate on endpoint implementation. It takes ten days to deploy it on 10,000 devices.
Malebo Lethoba Group - PeerSpot reviewer
Have found the AI analyst and detection functions highly valuable for network operations while managing complexity in initial setup
The functions I find most valuable in Darktrace ( /products/darktrace-reviews ) are the AI analyst as well as the detection.The autonomous response capabilities of Darktrace are not crucial for me because it doesn't work in a network where there are no core switches. In a modern network, the autonomous response doesn't work, especially when sitting in a shared data center.If I'm running a traditional network where I am not in a shared data center with a layer two dedicated for my resources, then it can work for me. However, if I am in a data center where I don't have layer two, it becomes an issue because the autonomous response is reliant on sending spoofed TCP resets to my core switch to block traffic, which is a major issue.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Immediately we can pick up the computers in the network if any malicious operation that is triggered."
"Their EDR solution, the ability to mitigate issues through their command line, is probably the best feature that we've had. We use that all the time. It's very useful for doing investigations."
"For me, the technical support is good."
"The initial setup was straightforward."
"The solution is efficient."
"I haven't had any issues with the solution. Stability-wise, I rate the solution a ten out of ten."
"What I like most about Cybereason Endpoint Detection & Response is the support because the support is good. The solution is also easy to use, and it has a dashboard. Everything is good, and there's no problem with it."
"What I find most valuable is the clarity of the platform. It is very straightforward."
"It is a very simple product to use."
"Implementing this solution has given us confidence that we are secure."
"I find it very good in the way that they show the past events, including the attack history."
"Darktrace's most valuable features are that it understands the network environment and is able to trace the traffic and alert on anomalies."
"The most valuable feature of Darktrace is its ability to detect and counter threats before they occur."
"Technical support is helpful and responsive."
"t was pretty as far as the granularity of what you were getting out of it."
"In terms of features, the data or information they collect and unsupervised machine learning are very valuable. Its unsupervised machine learning has reduced our team's effort. Both Darktrace and Vectra work on unsupervised machine learning that learns the behavior or develops a profile on its own, which allows our security team to do some other tasks rather than spending time on Darktrace or Vectra. Because of unsupervised machine learning, its detection capability is quite good. Along with that, if we utilize the integration feature properly, the automated incident response capability of Darktrace is quite useful."
 

Cons

"It should be more stable, and the sensor needs improvement in terms of connectivity."
"They need to improve their technical support services."
"I would like to see improvements on the operational side, specifically in grouping."
"There is room for improvement in the product features related to device control, particularly USB management."
"Compared to our previous endpoint, we have a lot more false positives and a lot more duplication of alerts. So we're chasing more alerts."
"While the product is very good, there are still some areas for improvement. The initial triage area could be a bit simpler. They get into the weeds real fast; it gets very detailed very fast. I am still looking for an easier triage layer on top with the ability to dig deeper."
"I feel that the product lacks reporting features and needs improvement."
"Reporting could be a bit more granular so that we had the ability to check regions and countries. I just noticed that, for instance, if I look at our servers, it's either "contained" or it's "not contained". I don't have the option, for instance, to look at countries. It only allows me to look at users as one big group."
"In a shared environment, it doesn't work, and there are still some integration issues."
"The solution would benefit from automation. Currently, you have to know what you are searching for."
"The program is quite expensive."
"It's quite expensive to have."
"There are still some issues with the network capturing or blocking traffic even after implementing exceptions. It requires more learning in this area."
"One thing that I would like to look at going forward is to have a fully automated network infrastructure that is monitored automatically real-time, and that gives me this kind of capability where I would be able to look at my network at any given time and see the state of my network. With Darktrace, at the moment, I have to almost put in a date and tell them that want you to give me data from this date to this date. I don't want that. I want a fast solution in which it doesn't matter when I log into the application. Whenever I log in, I must be able to see my network and run a report. In other words, if I go in now and I say, "Give me a full report of what happened today, it must be able to give me that. It mustn't just be limited to a seven-day period, for argument's sake. It must be able to give me real-time and day-to-day tracking of what has happened within my network."
"The dashboard and reporting for this solution could be improved as it is currently complex. The GUI for this solution could also be improved."
"There is no dedicated salesperson in Egypt, and having one would help to improve focus on this market."
 

Pricing and Cost Advice

"We considered a few other solutions. Some were ridiculously overpriced, while others didn't have solutions for Mac endpoints. That was a deal-breaker because most of our organization is on Mac. It came down to two vendors: Cybereason and another. They had similar pitches and almost identical approaches, but in the end, Cybereason gave us the best value for our money."
"I do not have experience with the licensing of the product."
"On a scale of one to ten, where one is cheap and ten is expensive, I rate the pricing an eight."
"In terms of pricing, it's a good solution."
"I had to go through a third-party to purchase it, which I wasn't really pleased about."
"In terms of cost, this is a good choice for our needs."
"This product is somewhat expensive and should be cheaper."
"Though it is not the cheapest solution but it fits our budget. We pay an annual licensing fee."
"The pricing is expensive. It costs over $100,000 a year."
"Our customers feel that the price of Darktrace is quite high compared to other solutions."
"Darktrace is pricey, but the price is reasonable for what the solution does, and it's comparable to other products."
"It is expensive."
"The pricing is very flexible for Darktrace. Sometimes, a customer does not have the appropriate budget, but Darktrace can handle that. They offer monthly payments, so the customer can acquire the solution very easily."
"The pricing is a little high compared to the competition."
"The product is expensive."
"It is pretty expensive, but it is worth it. Its licensing is yearly."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
862,514 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
11%
Manufacturing Company
8%
Government
6%
Computer Software Company
13%
Manufacturing Company
9%
Financial Services Firm
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for Cybereason Endpoint Detection & Response?
Comparison with other products showed it be cheaper than some larger competitors. Set up cost for us were cheaper as we already had users experienced with the product in other business units. Initi...
What is your primary use case for Cybereason Endpoint Detection & Response?
We use it to improve detection in the whole industrial sector. We are a big energy company. Across multiple endpoints, we deploy the EDR to secure all, improve detection, and also attempt to automa...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing user interface that makes setup easy and seamless. CrowdStrike Falcon offers a cl...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is meant for smaller to medium-sized businesses. It is also a good option for organ...
What do you like most about Darktrace?
A very useful feature in Darktrace for real-time threat analysis is the packet inspection that analyzes the packet traffic in real time.
 

Also Known As

Cybereason EDR, Cybereason Deep Detect & Respond
No data available
 

Overview

 

Sample Customers

Lockheed Martin, Spark Capital, DocuSign, Softbank Capital
Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
862,514 professionals have used our research since 2012.