IBM Security QRadar vs Netsurion comparison

Comparison Buyer's Guide

Executive Summary

We performed a comparison between IBM Security QRadar and Netsurion based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed IBM Security QRadar vs. Netsurion Report (Updated: July 2024).

Buyer's Guide

IBM Security QRadar vs. Netsurion

July 2024

Download the complete report

Helped 793,295 peers since 2012

Categories and Ranking

Binary Defense MDR

Featured Reviews

Paul Farley

Corporate Vice President | Deputy Chief Information Security Officer at NCR Voyix

Jul 1, 2024

Saves money, helps reduce false positives, and has excellent customization capabilities

Sometimes, something may not install right; however, whenever we have challenges, they are very solution-oriented and ready to figure things out. While my understanding is that they're working on this, I would like to see some more of the quantification or reporting. They're working on better detecting the impact they're having and what they're working on. That's an area they should continue to focus on. Having those metrics will be valuable. They just need to continue to be focused on Open MDR, and on being open to many tools and being broadly compatible across tool sets if possible. That's unique, and it is a differentiator in the marketplace.

Read full review

reviewer1974018

Technical Analyst at a manufacturing company with 10,001+ employees

Sep 30, 2022

Real-time detection is quite efficient but the dashboard lacks important visibility for threat hunting

Our company includes 20 senior engineers and analysts who use the solution to detect viruses on Windows servers and critical assets. We also track user activity such as connections during travel. We have many use cases and playbooks in our portfolio. Our company uses the solution as our main CM…

Read full review

Kevin Lohan

Head of IT at a venture capital & private equity firm with 11-50 employees

Aug 22, 2023

Provides real-time alerting, a dedicated team, and around-the-clock monitoring

The most valuable feature is definitely real-time alerting, especially in situations where someone might attempt to exploit or hack into our network. For instance, if there's an unusual activity with user accounts, like a sudden surge in login attempts, the system promptly sends notifications via email, text, and even phone calls if our initial response is lacking. This holds true regardless of the time, even if it's as late as two in the morning. This capability provides me with a sense of security. Apart from this, my colleagues and I lack the time to meticulously sift through extensive logs and data. Having someone else handle the task of comprehensively analyzing the information we generate, not only pinpointing potential risks for us to counteract but also alerting us in real-time, is immensely valuable. It's truly impressive. Our workload prevents us from achieving this level of vigilance, even if we were to hire more staff. Their performance in this regard is unparalleled.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Binary Defense has a human service department that provides live monitoring for our systems."

"The most valuable feature is reviewing tickets and the notes added by technicians."

"The most valuable features are the SIEM and the ticketing function; the latter is very smooth and easy to read and understand. We don't have any issues looking at the ticketing information when we're trying to identify what's going on."

"The speed at which their services are reactive is valuable. Nowadays, when a threat hits an endpoint, you've got minutes, not hours or days. Their average response time is about four minutes on an alert. For anything that needs to be sent to us, it's about fourteen minutes, which is pretty good. They're the third SOC that I've used in fifteen years. By far, they are the quickest ones to act. When you're looking at prevention, that's a key factor."

"One of the main benefits of Binary Defense MDR is the ability to easily meet with their support team to discuss any issues we encounter."

"With Binary Defense, we don't just get an alert, but also a detailed rundown of why they're alerting us on it. They tell us what was executed, or the username, script, or IP. That way, we're not wasting time investigating."

"The most valuable part of Binary Defense is its team of cybersecurity analysts. Their analysts filter out the noise and only forward the critical threats that require a response instead of false positives."

"The case interface is Binary Defense MDR's most valuable feature."

More Binary Defense MDR pros

"When it comes to QRadar, they can do the correlation and not only in networks but also endpoints. This is one of the good features that we have noticed."

"QRadar shows very effective correlations. If you combine all the logins plus user behavior and the current intelligence, it gives a very good correlation for business. I think it reduces the false positives in user activity monitoring because there is a lot of social information to correlate with other data."

"IBM QRadar User Behavior Analytics has easy architecture, has a good portfolio and integration."

"Customer service is very good and very helpful."

"It is suitable for large companies with critical infrastructure. For our clients, robustness, availability at a high level, and the level of references and experiences connected to the solution are important."

"It is a scalable solution."

"The ability to add extensions is the most valuable feature. For example, extensions that provide valuable test ports."

"The most valuable feature is the machine learning module."

More IBM Security QRadar pros

"Netsurion was easy to deploy. I have worked with other systems that were a little less complex, but they weren't quite as easy to deploy."

"The SIEMs and managed service are its most valuable features. We get a weekly report from them which provides a culmination of them combing through millions of events which are triggered across our network every day and minute. Their information security experts basically boil that down to a report which I get emailed once a week. It identifies potential threats and the remediation that I should take to be able to quell those threats."

"Expediting incident response is really great."

"They have a number of integrations with different products. Google Workspace is one of them, and Microsoft Azure is another one. They integrate with a number of other things, such as Duo for multi-factor authentication. They can pull the logs from Duo to see if users are coming from bad repeatable IPs or if there are malicious known IPs that may be popping up in the logs. They are able to see that, and they can identify that. Some of the other integrations they do are from inside your network. For firewalls, they can integrate with SonicWall, Cisco, Fortinet, etc. They have a pretty wide variety of things to integrate with and be able to pull the logins from those devices."

"Their SOC team manages vulnerability management and IOC reviews. They stop bad processes when they happen. The best thing is their weekly reviews of what has been going on in the infrastructure as well as the things that they see and what we should look out for."

"The real-time alerting for things such as people getting dropped into a VPN group or the domain admin group — things like that which really shouldn't happen without proper change management, but we all know the reality, they do from time to time — gives me real-time visibility into what's going on."

"When it comes to threat detection and response, it does a very good job detecting and blocking on its own. And the SOC is a nice added value because they're doing analysis on things that aren't as obvious, on things that you can't just detect with a signature or behavior. Also, any SIEM will come with a lot of noise, so having them do a lot of the initial analysis to find out what's critical and what issues are false alarms is very good."

"I like the UI, overall. I like the main page and there are aspects of the search page that I like. When you bring it up on the left-hand side of the page, as you look at the events, the ability to simply hit and click the plus/minus to pull events in and out of the overall view is well done and is very effective from a threat-hunting and an analysis perspective. I like the detail it shows."

More Netsurion pros

Cons

"It's sometimes difficult to know when to engage Binary Defense or TrustedSec, their sister company. TrustedSec is more focused on offensive security, as opposed to the defensive security that the MDR solution provides. It would be awesome if there were a better bridge between that relationship for when we need to get more proactive services or when we need to do a penetration test."

"I don't find any downside to them, but if I have to put one, it would be consistent manpower or staffing. The only area where the solution can be improved is going to be with people. As they grow, they are struggling with the same thing that every other company is, which is getting talent and getting that talent to stay, but they've just revised their tiering system to go from a flat analyst and manager to a three-tier solution where it goes through two or three before it gets elevated. That seems to have worked out well, so if one level misses it, the next one picks it up, and it works out fine."

"We should be able to isolate devices faster. They should shorten the time between clicking on a device to contain it and carrying out the action. That would be a welcome improvement."

"Binary Defense MDR could be even better with additional features, like automatic scans and file quarantine."

"The current reporting system could benefit from improvement."

"We found that an earlier version of the agent had high memory usage and that was a bit concerning, but we raised the concern with their support team and they immediately replied that they had noticed the same thing and had a candidate fix already available... it totally fixed the issue."

"I would like to get more reports from Binary Defense about what they're blocking."

"While my understanding is that they're working on this, I would like to see some more of the quantification or reporting."

More Binary Defense MDR cons

"The architecture could be improved. I got stuck for a long time trying to understand the architecture, as it is quite challenging."

"It doesn't have a SOAR system by default. You need to purchase it additionally, which is the main problem with QRadar."

"You can scale IBM QRadar User Behavior Analytics, but it has room for improvement."

"The solution is expensive compared to other products."

"GUI needs to be improved."

"Search capability and indexing still lag behind competitors. We also need to see improved rule based access controls and rule/event tuning."

"It's resource-intensive."

"The reporting system could use some upgrading."

More IBM Security QRadar cons

"Probably the biggest thing is just: Can I search for this and what's the best way to do it? If I'm looking for two events versus a singular event, I just throw it back at them. They're the experts on it."

"The system requirements are very, very high. So I need a pretty powerful server to run. If they could lighten that load so that the on-premise part of their product didn't impact my systems as much that would be ideal."

"The MITRE ATT&CK framework could be faster when identifying and understanding sophisticated threats. Whenever something happens, we usually get notified a couple hours later."

"I would like to see the dashboard come up more quickly."

"Communication is always something that can be improved, but I feel that any time we've had a communication issue, it's quickly addressed when we bring those up at the monthly meetings. Usually, it's an individual that wasn't clear in the communication, it's not the process per se. You always have to be able to segregate if the process didn't work or an individual either didn't say the right thing or my people didn't understand what they were being told."

"The weekly reporting could use some improvement. For example, when we handed them our landscape document, it took longer than I would have liked for those details to become noticeable within the reports."

"They have their programs and tools that you have to put into your own environment. We basically ingest all the log data and then push it out to them. I wish it was a little bit different than that where we just push directly towards them. I do not know if that is a function that they thought would be better in terms of security, but I wish that instead of doing that, it should go from the device to them and not from the device to another system and then out to them. There seem to be some drawbacks to doing that."

"I'd like to see improvement in the ease of generating reports. It seems fairly cumbersome whenever you decide to start tracking new categories of events. It seems a little kludgy when trying to generate those reports."

More Netsurion cons

Pricing and Cost Advice

"From the initial cost that Binary Defense came in with, we pared it down quite a bit over the course of 30 or 60 days. My leadership would say that their cost was high, but realistically, they were in line with the market."

"Binary Defense has changed its pricing model from being primarily based on the volume of data to one based on escalations and incidents they handle."

"Binary Defense MDR is priced competitively and may be slightly lower than CrowdStrike."

"After we acquired this platform, we met with a number of different vendors. Binary Defense came in with a proposal that was surprisingly affordable. In fact, we were able to recoup the cost of their services within a short period of time. This is because Binary Defense is able to provide the same level of security as a team of two or three in-house analysts but at a fraction of the cost. As a result, Binary Defense is saving us an estimated $250,000 to $300,000 per year."

"The pricing is very good. They are definitely competitive and they were lower at the time that we went with them."

"It's valued at the right price. Even with the number of endpoints we have, we don't feel that it's a lot more than any competitor. In fact, it might be less expensive when you look at the fact that you're getting a full flex SOC out of it along with the tools."

"The solution's price is spot on; if anything, it's slightly below the norm for most services. Compared to building the same team internally, it would cost more to create the same amount of capability than what we get from an external team. Price-wise, Binary Defense is in a great spot."

"The pricing isn't that bad, it's very competitive. I don't feel that it's over-priced and I don't feel that it's under-priced."

More Binary Defense MDR pricing and cost advice

"There is a license required for this solution. There are some limitations depending on what license you purchase."

"The cost of this product is expensive."

"Most of the time, it is easier and cheaper to buy a new product or the QRadar box."

"IBM's Qradar is not for small companie. Unfortunately, it would be 'overkill' to place it plainly. The pricing would be too much."

"An X-Force feed is free with QRadar."

"The solution has a licensing model that is based on events per second so it scales to need and budget."

"QRadar's price is reasonable compared to LogRhythm."

"It's too expensive. The licensing is also a little bit difficult to understand because you have to license it per event and per number of flows."

More IBM Security QRadar pricing and cost advice

"You are paying for different levels, especially as far as the monitoring goes and how often you review it with the team. The other factor that figures in is how many nodes are on your network, such as clients, network equipment, servers, etc. There are some additional pieces on top of that, but it's laid out pretty simply, as far as how much you're going to pay for a node."

"Netsurion's pricing is competitive. At the same time, they're the only ones who do what we want to do the way we want it. I can't say we would've paid more, but we would've had to have come up with our own solution if they weren't providing that."

"EventTracker's subscription-based model is interesting as far as yearly license type stuff. It's nice because you know what it's going to be next year. We haven't really looked at any other solutions. The pricing at the time compared to the other solutions was a lot less. A couple of years ago, we actually looked at Splunk. The amount in Splunk's licensing model is based on 20 gigs a day, or something like that. Based on our number of logs and stuff that we were already generating, the costs would be substantially more for the amount of logs that we would be getting."

"The pricing and licensing seem very reasonable. The managed service part of it feels like it gives me the equivalent of a full-time engineer for a lot less money. So, I feel it's a good value."

"I don't know if the pricing is by the seat but we're paying about $20,000 to 25,000 a year. On top of that, we pay for the managed support services. That runs us about another $35,000 or $40,000 a year."

"We have seen time and cost savings. It prevents us from having to hire specialized people for this type of work. We would need to hire six staff members to accommodate the same service."

"The solution is fairly expensive, but in my experience, all of the SIEM applications that I've evaluated or looked at cost about the same."

"It is a bit expensive as compared to some of the other products that have come out in recent years. Expense-wise, the only downside is that it is not cheap."

More Netsurion pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

793,295 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Jun 28, 2015

Qradar vs. ArcSight

Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…

Read full review

Top Industries

By visitors reading reviews

Computer Software Company

18%

Healthcare Company

Manufacturing Company

Financial Services Firm

Educational Organization

20%

Computer Software Company

15%

Financial Services Firm

10%

Government

Computer Software Company

28%

Manufacturing Company

12%

Government

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Binary Defense MDR?

The most valuable feature is reviewing tickets and the notes added by technicians.

See all answers

What is your experience regarding pricing and costs for Binary Defense MDR?

Binary Defense is reasonably priced, considering that it saves us from hiring personnel and deters threats that could...

See all answers

What needs improvement with Binary Defense MDR?

The only area I see for improvement with Binary Defense is their service portal. It could benefit from some enhanceme...

See all answers

What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?

It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

See all answers

What do you like most about IBM QRadar?

The event collector, flow collector, PCAP and SOAR are valuable.

See all answers

What do you like most about Netsurion Managed Threat Protection?

Expediting incident response is really great.

See all answers

What is your experience regarding pricing and costs for Netsurion Managed Threat Protection?

Their pricing is high. I don't know if it's a barrier. The quality speaks to the price. The price is the price. They ...

See all answers

What needs improvement with Netsurion Managed Threat Protection?

There is one area that needs improvement and that is with the agents and the server that's on-site. The system requir...

See all answers

Comparisons

Darktrace vs Binary Defense MDR

Compared 32% of the time

SentinelOne Singularity Complete vs Binary Defense MDR

Compared 21% of the time

CrowdStrike Falcon vs Binary Defense MDR

Compared 19% of the time

Cortex XDR by Palo Alto Networks vs Binary Defense MDR

Compared 15% of the time

Arctic Wolf Managed Detection and Response vs Binary Defense MDR

Compared 13% of the time

More Binary Defense MDR Competitors

Splunk Enterprise Security vs IBM Security QRadar

Compared 15% of the time

Microsoft Sentinel vs IBM Security QRadar

Compared 14% of the time

Wazuh vs IBM Security QRadar

Compared 7% of the time

LogRhythm SIEM vs IBM Security QRadar

Compared 6% of the time

Elastic Security vs IBM Security QRadar

Compared 5% of the time

More IBM Security QRadar Competitors

Arctic Wolf Managed Detection and Response vs Netsurion

Compared 49% of the time

CyberHat CYREBRO vs Netsurion

Compared 26% of the time

Sumo Logic Security vs Netsurion

Compared 25% of the time

More Netsurion Competitors

Product Reports

Buyer's Guide

Binary Defense MDR

July 2024

Download Binary Defense MDR product report

Buyer's Guide

IBM Security QRadar

July 2024

Download IBM Security QRadar product report

Buyer's Guide

Netsurion

July 2024

Download Netsurion product report

Also Known As

Binary Defense Vision, Binary Defense Managed Detection and Response, Binary Defense Managed Detection & Response

IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar, IBM QRadar User Behavior Analytics, IBM QRadar Advisor with Watson

Netsurion Managed Threat Protection, Netsurion EventTracker

Learn More

Binary Defense

IBM

Video not available

Netsurion

Overview

Binary Defense provides a Managed Detection and Response service using an Open XDR strategy that detects and isolates threats early in the attack lifecycle. Expert security analysts in the Binary Defense Security Operations Center leverage an attacker’s mindset, monitoring your environments for security events 24x7x365 and acting as an extension of your security teams. When a security event occurs, Binary Defense analysts triage, disposition, and prioritize the event. Analysts conduct full kill chain analysis and supply tactical and strategic mitigation recommendations to your security team with the goal of increasing your organization’s security posture against the latest adversary threats.

Visit us online at https://www.binarydefense.com

IBM Security QRadar is a security and analytics platform designed to defend against threats and scale security operations. This is done through integrated visibility, investigation, detection, and response. QRadar empowers security groups with actionable insights into high-priority threats by providing visibility into enterprise security data. Through centralized visibility, security teams and analysts can determine their security stance, which areas pose a potential threat, and which areas are critical. This will help streamline workflows by eliminating the need to pivot between tools.

IBM Security QRadar is built to address a wide range of security issues and can be easily scaled with minimal customization effort required. As data is ingested, QRadar administers automated, real-time security intelligence to swiftly and precisely discover and prioritize threats. The platform will issue alerts with actionable, rich context into developing threats. Security teams and analysts can then rapidly respond to minimize the attackers' strike. The solution will provide a complete view of activity in both cloud-based and on-premise environments as a large amount of data is ingested throughout the enterprise. Additionally, QRadar’s anomaly detection intelligence enables security teams to identify any user behavior changes that could be indicators of potential threats.

IBM QRadar Log Manager

To better help organizations protect themselves against potential security threats, attacks, and breaches, IBM QRadar Log Manager gathers, analyzes, preserves, and reports on security log events using QRadar Sense Analytics. All operating systems and applications, servers, devices, and applications are converted into searchable and actionable intelligent data. QRadar Log Manager then helps organizations meet compliance reporting and monitoring requirements, which can be further upgraded to QRadar SIEM for a more superior level of threat protection.

Some of QRadar Log Manager’s key features include:

Data processing and capture on any security event
Disaster recovery options and high availability
Scalability for large enterprises
SoftLayer cloud installation capability
Advanced threat protection

Reviews from Real Users

IBM Security QRadar is a solution of choice among users because it provides a complete solution for security teams by integrating network analysis, log management, user behavior analytics, threat intelligence, and AI-powered investigations into a single solution. Users particularly like having a single window into their network and its ability to be used for larger enterprises.

Simon T., a cyber security services operations manager at an aerospace/defense firm, notes, "The most valuable thing about QRadar is that you have a single window into your network, SIEM, network flows, and risk management of your assets. If you use Splunk, for instance, then you still need a full packet capture solution, whereas the full packet capture solution is integrated within QRadar. Its application ecosystem makes it very powerful in terms of doing analysis."

A management executive at a security firm says, "What we like about QRadar and the models that IBM has, is it can go from a small-to-medium enterprise to a larger organization, and it gives you the same value."

Our open XDR platform unifies your existing security telemetry to deliver wider attack surface coverage and deeper threat analytics resulting in greater security visibility. Our SOC does the heavy lifting for you of proactive threat hunting, event correlation and analysis, and provides you with guided remediation. The result is a force multiplier that allows your IT team to be confident and in control again while also maximizing all of your cybersecurity investments.

Sample Customers

Securitas USA, Black Hills Energy, Lincoln Electric,The J.M. Smuckers Company, New York Community Bank, State of Connecticut, NCR

Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.

The Salvation Army, The FRESH Market, Pacific Western Bank, NASA, American Academy of Orthopaedic Surgeons (AAOS), and Talbot’s Stores

Buyer's Guide

IBM Security QRadar vs. Netsurion

July 2024

Free Report: IBM Security QRadar vs. Netsurion

Find out what your peers are saying about IBM Security QRadar vs. Netsurion and other solutions. Updated: July 2024.

DOWNLOAD NOW

793,295 professionals have used our research since 2012.

See our IBM Security QRadar vs. Netsurion report.

See our list of best Security Information and Event Management (SIEM) vendors, best Managed Detection and Response (MDR) vendors, and best Extended Detection and Response (XDR) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.