Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSandbox vs Rapid7 InsightIDR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 4, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortinet FortiSandbox
Ranking in Threat Deception Platforms
6th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
38
Ranking in other categories
Advanced Threat Protection (ATP) (4th)
Rapid7 InsightIDR
Ranking in Threat Deception Platforms
4th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
32
Ranking in other categories
Security Information and Event Management (SIEM) (15th), User Entity Behavior Analytics (UEBA) (6th), Endpoint Detection and Response (EDR) (23rd), Extended Detection and Response (XDR) (17th)
 

Mindshare comparison

As of January 2026, in the Threat Deception Platforms category, the mindshare of Fortinet FortiSandbox is 4.6%, up from 3.8% compared to the previous year. The mindshare of Rapid7 InsightIDR is 10.0%, down from 11.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Threat Deception Platforms Market Share Distribution
ProductMarket Share (%)
Rapid7 InsightIDR10.0%
Fortinet FortiSandbox4.6%
Other85.4%
Threat Deception Platforms
 

Featured Reviews

Abdelhamid Saber - PeerSpot reviewer
Senior Security & Infra Technology Systems Engineer at BARQ Systems
Enhanced network security with adaptable integration and really good support
We use FortiSandbox for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues. The adapter is beneficial as it…
SohailHyder - PeerSpot reviewer
Head of Cyber Security at Super Secure
Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration
If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Fortinet FortiSandbox is scalable."
"Integration is one of the solution's most valuable aspects. You can integrate even third-party solutions so that they can send the information or files they quarantine through the FortiSandbox"
"The most valuable features of Fortinet FortiSandbox are the analysis options, artificial intelligence, and the many interfaces it provides."
"The scanner office document as well as PDF are useful. The most valuable thing is that you can emulate different operating systems without having the danger of getting something infected. It emulates several operating systems, and as a result, you either get the file or you don't get the file."
"The solution has the highest stability...The solution's setup is not complex as they are already included in Fortinet."
"The technical support is very good."
"The most valuable features for me when it comes to Fortinet FortiSandbox are the integrity of the Sandbox and the power of the analyzing tool of the solution."
"The most valuable feature was the EDR, endpoint detection and response."
"I like the tool's user analysis feature."
"Great coverage of all systems within our network from endpoint to firewall."
"The platform offers unlimited storage and agent-based solutions."
"If you were on other solutions, you would notice that they use agents from third-party, from open-source, from a native OS, or from other tools. Here, however, it is an agent from Rapid7 itself. This adds to the solution's overall capabilities."
"I definitely recommend Rapid7 InsightIDR."
"The solution is very stable and works very well for what I need it to do."
"Integration with threat modeling from the Metasploit and InsightIDR repositories."
"InsightIDR’s ability to process millions of transactions per day, and to notify me of the most critical ones, is priceless. InsightIDR has the alerts tuned, and has the ability to quickly drill down to determine the threat level."
 

Cons

"There could be more templates and a higher number of simulated VMs to configure more use cases. Sometimes we need to configure many use cases in many different environments, and if the number of VMs that we configure is limited, we have to remove some and reconfigure the environment if we need another environment."
"The product is good but it could be speedier. In addition, it's quite complex."
"In general, maybe they are not updated to cover risks."
"Fortinet FortiSandbox can improve by decreasing the time of analysis response. Other solutions have a better response time, such as WildFire."
"In future releases, I would like to see more automation capabilities."
"The main area of concern in Fortinet FortiSandbox is its detection capabilities."
"If updated, Fortinet FortiSandbox could cover other risks."
"It should be easier to import custom virtual machines. Some of the VMs that are in FortiSandbox don't have the applications that we have in our environment. We need to import a VM with specific applications that we use in our environment. Have all the licenses because this is a real environment. You need a license for the Windows client you run on it. It's possible to import custom VMs, but it's a pain to do it. I would like a tool that simplifies the process."
"The ability to tune the collector for custom logs would greatly help."
"The main problem lies in the processes within the client's operating systems."
"It would be useful to import threat intelligence in YARA format along with known incorrect email addresses.​"
"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."
"Sometimes, it is hard to get the right queries to use. Currently, the tool lacks a pre-made set of queries."
"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."
"One thing that springs to mind is easier API integration with ITSMs. We are evaluating a new ITSM and I would like to have InsightIDR create a ticket when an attack is identified, and the ticket would be closed in InsightIDR when the ITSM resolution is completed. This would take out the "single point of failure" we currently have, if the email recipient is somehow absent, in recording the risk appetite for the incident and the actions taken to mitigate or not."
"The product allows us to make only 30 custom rules."
 

Pricing and Cost Advice

"The price of Fortinet FortiSandbox is expensive."
"We are on an annual license to use the solution. We have an additional feature that is integrated with S5, which is working well."
"There are additional costs, which isn't included in the licensing fee."
"I rate the product's pricing a five or six on a scale of one to ten, where one is low, and ten is high."
"The license for Fortinet FortiSandbox depends on the use case."
"The price is competitive."
"The solution is unavailable at a lower cost and can be difficult to deploy."
"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."
"The team is very willing to work with companies. My suggestion is to call the Rapid7 sales department and see how they can help.​"
"​Accurately predict your licensing counts as this is a subscription based product.​"
"​I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability.​"
"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
"The pricing of the solution depends on the user. But there is a yearly licensing cost."
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
"The pricing and licensing are competitive."
report
Use our free recommendation engine to learn which Threat Deception Platforms solutions are best for your needs.
879,371 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Government
10%
Computer Software Company
10%
Financial Services Firm
9%
Comms Service Provider
9%
Computer Software Company
12%
Financial Services Firm
9%
Manufacturing Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise13
Large Enterprise9
By reviewers
Company SizeCount
Small Business20
Midsize Enterprise5
Large Enterprise6
 

Questions from the Community

What do you like most about Fortinet FortiSandbox?
The real-time analysis capability of FortiSandbox is beneficial for email analysis.
What is your experience regarding pricing and costs for Fortinet FortiSandbox?
I think it's affordable. For the six to seven months of usage, the cost has been reasonable.
What needs improvement with Fortinet FortiSandbox?
We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, ...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about Rapid7 InsightIDR?
During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an applicati...
 

Also Known As

FortiSandbox
InsightIDR
 

Overview

 

Sample Customers

Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Fortinet FortiSandbox vs. Rapid7 InsightIDR and other solutions. Updated: December 2025.
879,371 professionals have used our research since 2012.