We performed a comparison between Cynet and Wazuh based on real PeerSpot user reviews.
Find out in this report how the two Extended Detection and Response (XDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The ability to integrate and observe a more cohesive narrative across the products is crucial."
"It has been great for us. Previously, we didn't have a solution to protect us, especially from malware, whereas now, we are getting protection up front, especially from the malware attacks coming through emails or endpoints."
"The most valuable feature of all is the full integration with the rest of the software in the operating system and Office 365, as well as Microsoft SCCM. It is quite easy for us to work with the whole instance of Microsoft products. This integration improves the benefits of the whole suite of products."
"From the perspective of Microsoft 365 XDR, the main benefit is a single, centralized dashboard offering the holistic visibility organizations crave."
"The ability to hunt that IM data set or the identity data set at the same time is valuable. As incident response professionals, we are very used to EDRs and having device process registry telemetry, but a lot of times, we do not have that identity data right there with us, so we have to go search for it in some other silo. Being able to cross-correlate via both datasets at the same time is something that we can only do in Def"
"Microsoft 365 Defender is simple to upgrade."
"The EDR features are valuable. By getting the EDR features, we have more control over the device. We have information about events in real-time and more protection against zero-day threats and zero-day vulnerabilities. We can monitor every event or action that a device is going through. We can get an idea if it is something malicious or if we have to take any actions."
"We also use Microsoft Sentinel, Defender for Cloud, Defender for Identity, and Microsoft Defender for Cloud Apps. They are all integrated and it was very easy to integrate them. In my experience with the integrations, it was just a click of a button and things were integrated. It's just a button."
"The product has valuable front-end features."
"This solution requires less management and is very easy to use."
"The feature that I have found most valuable is that the configuration and the usage of the product are not so complicated. For people responsible for using this infrastructure for the first line of workstation monitoring, it's quite easy to use."
"The visibility it gives is excellent."
"Advanced detection and protection against ransomware paired with SOC monitoring are the most valuable features. They have 24/7 SOC monitoring and file activity. It is a very robust tool."
"We are very satisfied with the level of performance we get."
"It can be deployed in autonomous mode, and then it automatically blocks malware threats."
"I have found the continued support and pretty much all the features to be valuable. They all stand out as being positive. It continues to detect unusual activity when it's supposed to, and so far we haven't had any issues."
"It has efficient SCA capabilities."
"It's stable."
"Its cost-effectiveness is the most valuable aspect."
"Wazuh offers an enhanced HDR version that outperforms its competitors."
"Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases."
"Wazuh is simple to use for PCI compliance."
"The most valuable feature of Wazuh is the ELK for doing an investigation."
"The main thing I like about it is that it has an EDR."
"At times, when we have an incident email and we click on the link for that incident, it opens a pop-up, but there is nothing. It has happened a couple of times."
"Defender also lacks automated detection and response. You need to resolve issues manually. You can manage multiple Microsoft security products from a single portal, and all your security recommendations are in one place. It's easy to understand and manage. However, I wouldn't say Defender is a single pane of glass. You still need to switch between all of the available Microsoft tools. You can see all the alerts in one panel, but you can't automate remediation."
"This solution could be improved if it included features such as those offered by Malwarebytes."
"In the Microsoft Azure Portal, in Active Directory, if there is anything on the user it will provide you with the information, but you still have to go through it a bit. And sometimes, I have experienced difficulties in understanding the information, especially because the synchronization between Microsoft Intune and the devices that are connected to the user in Azure Active Directory takes a lot of time."
"While the XDR platform offers valuable functionalities, it falls short of other solutions in its ability to deliver a cohesive identity experience."
"The message trace feature for investigating mail flow issues should add more detailed information to the summary report... if they could extend the summary report a little bit, make it more descriptive, ordinary administrators could understand what happened and that the emails failed at this or that point. That way they would know the location to go to try to correct it and to prevent it from occurring again."
"There is definitely scope for improvement in the automation area. Because the solution is a SaaS platform, we don't have the overall ability to automate stuff.... There is no direct way to go ahead because it's a SaaS platform."
"There should be better information for experts on features in the solution. What I see when reading about features in Microsoft 365 Defender is that it is always general information. If Microsoft could go deeper into details for the experts about how to use the tools, usage of it would be more familiar and it would be easier to use."
"SIEM - Although with their Centralised Log Management Cynet has created the basis for SIEM functionality, this is to be expanded in the near future."
"One thing to note is that I highly recommend adding a deep learning-based prevention environment as an additional layer to Cynet. However, I always advise my customers to start with Cynet or XDR, for example, and then focus on the people, technology, and processes involved. This is the best approach to ensure that you are not breached with ransomware. While Cynet can prevent most attacks, there have been cases where ransomware has been quicker than Cynet's detection capabilities. In these situations, an additional tool is necessary to ensure complete protection, and that is what I sell as well."
"Linux servers are not supported."
"Management of the console could be simplified and made more user-friendly because right now it's not very easy to use."
"Automation could be improved, and orchestration could be added to the features."
"We'd like something that makes it easier to manage specific points."
"A support center in Asia is needed."
"They have some things in the pipeline, we understand, and they're going to be able to support Android and all these other devices soon. The key is the devices - which is an aspect that is lacking right now. Every company has that problem, not just Cynet."
"I think that the next release should be more suitable for large enterprises, because currently they are not because large companies do not rely on open source solutions."
"A lack of certain features creates limitations."
"Adding the flexibility to integrate various plug-ins or modules into its core system would enhance functionality."
"It would be better if they had a vulnerability assessment plug-in like the one AlienVault has. In the next release, I would like to have an app with an alerting mechanism."
"The biggest part that's missing is threat intelligence. It isn't inbuilt, and if a sudden incident occurs, we don't get that feedback inside the SIEM tool. That's a big gap, I see. It would be better if we could get the threat intelligence feeds integrated with the SIEM tools. That would help us push value solutions to the clients in a big way."
"The implementation is very complex."
"Wazuh has a drawback with regard to Unix systems. The solution does not allow us to do real-time monitoring for Unix systems. If usage increases, it would be a heavy fall on the other SIEM solutions or event monitoring solutions."
"Log data analysis could be improved. My IT team has been looking for an alternative because they want better log data for malware detection. We are also doing more container implementation also, so we need better container security, log data analysis, auditing and compliance, malware detection, etc."
Cynet is ranked 8th in Extended Detection and Response (XDR) with 35 reviews while Wazuh is ranked 4th in Extended Detection and Response (XDR) with 38 reviews. Cynet is rated 8.8, while Wazuh is rated 7.4. The top reviewer of Cynet writes "Provides memory protection, device control, and vulnerability management". On the other hand, the top reviewer of Wazuh writes "It integrates seamlessly with AWS cloud-native services". Cynet is most compared with CrowdStrike Falcon, SentinelOne Singularity Complete, Microsoft Defender for Endpoint, ESET Endpoint Protection Platform and Intercept X Endpoint, whereas Wazuh is most compared with Elastic Security, Security Onion, Splunk Enterprise Security and AlienVault OSSIM. See our Cynet vs. Wazuh report.
See our list of best Extended Detection and Response (XDR) vendors and best Endpoint Detection and Response (EDR) vendors.
We monitor all Extended Detection and Response (XDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
