McAfee ePolicy Orchestrator vs NetWitness NDR comparison

McAfee and NetWitness are both solutions in the Security Orchestration Automation and Response (SOAR) category. McAfee is ranked #17 with an average rating of 8.8, while NetWitness is ranked #25. McAfee holds a 1.3% mindshare in SOAR, compared to NetWitness’s 1.3% mindshare. Additionally, 82% of McAfee users are willing to recommend the solution, compared to 87% of NetWitness users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 5, 2024

McAfee ePolicy Orchestrator and NetWitness NDR compete in security management and network traffic analysis. McAfee is favored for its cost-effectiveness and support, while NetWitness stands out for its advanced capabilities, offering substantial long-term value.

Features: McAfee ePolicy Orchestrator supports centralized security management, robust policy enforcement, and compliance reporting. NetWitness NDR excels in real-time threat detection, comprehensive network analysis, and high configurability with advanced analytical capabilities for superior network traffic insights.

Room for Improvement: McAfee ePolicy Orchestrator could enhance its real-time threat detection and expand configurability options. NetWitness NDR might benefit from simplifying deployment, lowering initial setup costs, and improving ease of integration with existing systems.

Ease of Deployment and Customer Service: McAfee ePolicy Orchestrator is praised for straightforward deployment and dependable customer support, highlighting ease of integration. NetWitness NDR provides comprehensive customer service with personalized setup assistance, although its complex deployment can pose challenges.

Pricing and ROI: McAfee ePolicy Orchestrator is seen as cost-effective with a lower setup cost and solid ROI from its pricing model. NetWitness NDR requires a higher initial investment but offers a substantial ROI through enhanced security capabilities, justifying the expense for advanced security analysis.

To learn more, read our detailed McAfee ePolicy Orchestrator vs. NetWitness NDR Report (Updated: March 2026).

Buyer's Guide

McAfee ePolicy Orchestrator vs. NetWitness NDR

March 2026

Download the complete report

Helped 885,311 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Torq

Mindshare comparison

As of March 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 4.2%, down from 5.1% compared to the previous year. The mindshare of McAfee ePolicy Orchestrator is 1.3%, up from 0.5% compared to the previous year. The mindshare of NetWitness NDR is 1.3%, up from 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Mindshare Distribution
Product	Mindshare (%)
Torq	4.2%
McAfee ePolicy Orchestrator	1.3%
NetWitness NDR	1.3%
Other	93.2%

Security Orchestration Automation and Response (SOAR)

Featured Reviews

Nimrod Vardi

Global IT Director at OpenWeb

Automation workflows have transformed our IT, enabling secure just-in-time access control

We work with them quite often, so we have a direct line regarding areas in Torq that have room for improvement. If we have a feature request, we can request it. I do not have anything in mind at the moment. We were a design partner for a short while, so we feel that they listen and that users of the system have an impact on the way the system is designed for the better. They have a new community, which is something that I personally suggested years ago. There are many people like me in different places and they might have already built the workflow that I need. Having the option to share workflows or to jump on a thread and say I have this need, did anyone ever build a workflow for it, is amazing. Someone would jump in and say yes, sure, here, take this workflow. I think this is an amazing thing and I really hope that the community will come alive because I think this is really powerful. This is something that I already suggested and it did happen eventually, and I am quite happy with it. I do not have any specific feature in mind that I have a need for at the moment.

Read full review

Binu Haneef

System Administrator at Sky News Arabia

Comprehensive security management enabled through efficient integration and automation

McAfee ePolicy Orchestrator helps automate routine security tasks. We created customized automation. For example, when we did not have an EDR or XDR solution, we created tasks exclusively for detection and response automation and automatic segregation of infected PCs. The ability to customize the dashboard in McAfee ePolicy Orchestrator helps us significantly. The main feature is automation for auto-segmentation and segregation. As we are in an AI era, McAfee can focus on AI tools. Instead of putting manual effort into each security-related task, it can implement more advanced automation using AI. This enhancement could improve cybersecurity significantly. Regarding the reporting area in McAfee ePolicy Orchestrator, we are satisfied with what we currently have. Our cybersecurity team needs customized reports beyond the default ones. We have more than 20 separate reports for identifying threats, managing, and understanding the security posture of our company and assets.

Read full review

reviewer1799727

Manager, IT Security Operations at a non-profit with 11-50 employees

Reliable and good support but can be expensive

I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"What I appreciate most about Torq is that it is an essential part of our system."

"Since we started working with Torq, I am handling much fewer alerts, it is becoming really easy for me to handle an alert, I have all the information that I need, I do not need to connect to different vendors to receive this information, and the main thing I got from Torq is time, which now helps me to build another automated system and learn."

"Any request that comes in, regardless of how complex it is, I can accomplish it with Torq."

"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."

"Once I started to use the system and I saw the potential, it changed all of our work in IT."

"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."

"Torq's unified platform approach to AI, SOAR, automation, and case management is superior compared to my experience managing multiple point solutions."

"If I review about 100 vendors that I might work with, Torq is definitely in the top five that gave me personally investment back, just because every bit of effort I put into Torq eventually became a workflow that gave it back to me."

"McAfee ePolicy Orchestrator has a built-in advanced pattern, which is very useful because it can detect any pattern."

"Their support is really good. I would rate it a nine out of ten. I have never any issues with their support. They always reply and follow our queries on time."

"We implemented data transfer protection, which allows transfer in one direction only. Users can copy from the PC to the USB but not from the USB to the PC. That way, if someone is carrying a virus on a USB, it will not be transferred to the PC."

"This is a solution that I recommend and would suggest for others to use."

"McAfee ePolicy Orchestrator has a built-in advanced pattern, which is very useful because it can detect any pattern."

"The graphical interface of the solution is its most valuable aspect."

"What I like the most is the ability to manage centrally, to manage the various devices, the platform, and the endpoint, all from one console."

"The policy auditing, policy management, and device auditing are all valuable features. Our customers appreciated the ability to get alerts to system-wide events from a single view."

More McAfee ePolicy Orchestrator pros

"We use it for IT security purposes; this is our central log management solution, so we incorporate all of our servers and PCs into this software and can monitor the logs from there."

"The solution is scalable; it creates 3,000 lab logs per second, and I think the solution is suitable for large companies or medium to large companies."

"The log correlation is good."

"The detection rate and tracking features including historical tracking, tracking of the fires on the desk, and tracking of the file last monitored are all quite valuable for us."

"The solution is stable."

"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."

"I would highly recommend the solution. Just go ahead and get it."

"This solution allows us to locate the malware in real-time."

More NetWitness NDR pros

Cons

"Regarding the pricing of Torq, I would say it is expensive."

"The initial deployment of Torq was not easy."

"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."

"Even now, we have workflows that are in production that use AI steps and I get different results, making it unusable to some degree."

"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."

"We have MCP that we are working with our cloud security platform, and we wanted to connect this MCP to the case management."

"There are some issues relating to the automation of reports. Sometimes it does not work even though all the configuration words are right."

"There is a problem when it comes to agent communication and duplicate records, where the rebooting of a machine leads to the installation of a new agent and you get a lot of duplicate records that ultimately affect your compliance monitoring."

"The installation process is quite difficult and requires technical support."

"As for improvements, I think that putting everything on a cloud and one console would be a great idea and would be useful for customers."

"Although it has the ability to auto create service tickets, it needs to expand to allow more products this ability."

"There is no built-in or easy upgrade of the system."

"McAfee should improve in terms of customer support and assigning a knowledgeable TAM to customers."

"The solution could improve the EDR component in many areas, such as the zero-day and persistent threats. The implementation is also complex for this feature."

More McAfee ePolicy Orchestrator cons

"The solution lacks a reporting engine."

"The problem with this product is that it's a bit slow."

"One of the drawbacks of using this product is that when you deploy, you have to create MSI files."

"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."

"The integration of the solution needs to be improved. The dashboard needs lots of updates as well."

"Threat detection could be better."

"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."

"The initial setup requires a high level of skill."

More NetWitness NDR cons

Pricing and Cost Advice

Information not available

"Compared to other Antivirus products, the cost of this solution is a bit high."

"This solution is priced in the mid-range."

"$The price of McAfee ePolicy Orchestrator is expensive, it is approximately $6,000 to $9,000 per license annually."

"McAfee ePolicy Orchestrator is not an expensive solution."

"On a scale from one to ten, where one is cheap, and ten is expensive, I rate the solution's pricing a three out of ten."

"There is a license required to use this solution. If we use the additional components, such as DLP encryption, there is an additional cost. However, it is similar to a separate product altogether. If you want to use that or not, it is optional, but when you use it, it will cost you additional pricing."

"McAfee ePolicy Orchestrator is a cheaply priced product, meaning it is not expensive since McAfee provides a free version of ePO, which includes phone support as well."

"McAfee tries to package different things into different products, then sell them as different products with different licenses. They just split everything up into multiple things. That's just their sales pitch and how they do it."

More McAfee ePolicy Orchestrator pricing and cost advice

"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."

"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."

"It is highly scalable. It can be bought based on your requirements."

"It is an expensive product."

"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."

"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."

"We are on a three-year contract to use RSA NetWitness Network."

More NetWitness NDR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

885,311 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Manufacturing Company

Comms Service Provider

Construction Company

Manufacturing Company

University

Marketing Services Firm

Performing Arts

Computer Software Company

Financial Services Firm

Manufacturing Company

Outsourcing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Midsize Enterprise	3
Large Enterprise	4

By reviewers
Company Size	Count
Small Business	13
Midsize Enterprise	11
Large Enterprise	19

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	2
Large Enterprise	5

Questions from the Community

What needs improvement with Torq?

We do not utilize the AI features that much. When it comes to general AI features of Torq, we are just slowly startin...

See all answers

What is your primary use case for Torq?

Torq markets itself as a security tool, and we do use them for security, but not in the traditional sense they market...

See all answers

What advice do you have for others considering Torq?

I would rate Torq an eight overall. I feel that Torq is as good as the effort you put into it. The limitations are ve...

See all answers

Which is better - Mcafee's MVision ePO or ePolicy Orchestrator?

Our organization ran comparison tests to determine whether Mcafee's MVision ePO or ePolicy Orchestrator network secur...

See all answers

What do you like most about McAfee MVISION ePO?

McAfee ePolicy Orchestrator's performance is good.

See all answers

What is your experience regarding pricing and costs for McAfee MVISION ePO?

It's an expensive solution.

See all answers

Ask a question

Earn 20 points

Comparisons

Tines vs Torq

Compared 35% of the time

Splunk SOAR vs Torq

Compared 14% of the time

Blink Ops vs Torq

Compared 13% of the time

Palo Alto Networks Cortex XSOAR vs Torq

Compared 9% of the time

Swimlane vs Torq

Compared 7% of the time

More Torq Competitors

Splunk SOAR vs McAfee ePolicy Orchestrator

Compared 16% of the time

Palo Alto Networks Cortex XSOAR vs McAfee ePolicy Orchestrator

Compared 14% of the time

Symantec Data Loss Prevention vs McAfee ePolicy Orchestrator

Compared 10% of the time

GTB Technologies Inspector vs McAfee ePolicy Orchestrator

Compared 10% of the time

Elastic Security vs McAfee ePolicy Orchestrator

Compared 9% of the time

More McAfee ePolicy Orchestrator Competitors

Trellix Endpoint Security Platform vs NetWitness NDR

Compared 6% of the time

Darktrace vs NetWitness NDR

Compared 6% of the time

ServiceNow Security Operations vs NetWitness NDR

Compared 4% of the time

ExtraHop Reveal(x) vs NetWitness NDR

Compared 4% of the time

Wazuh vs NetWitness NDR

Compared 4% of the time

More NetWitness NDR Competitors

Product Reports

Buyer's Guide

Torq

March 2026

Download Torq product report

Buyer's Guide

McAfee ePolicy Orchestrator

March 2026

Download McAfee ePolicy Orchestrator product report

Buyer's Guide

NetWitness NDR

March 2026

Download NetWitness NDR product report

Also Known As

No data available

McAfee ePO, ePolicy Orchestrator, Intel Security ePolicy Orchestrator, McAfee MVISION ePO

RSA ECAT, NetWitness Network

Overview

Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation to handle critical threats efficiently. It manages threat lifecycles, swiftly moving from triage to response, ensuring effective risk management.

Torq is designed to streamline security operations by aggregating telemetry across your security stack. It investigates significant risks and manages threats from triage to containment and remediation. This AI-driven tool enhances the capabilities of your SecOps team, allowing them to achieve more impactful results without introducing complicated processes.

What are the key features of Torq?

Adaptive Agentic Insights: Provides real-time threat intelligence tailored to specific security challenges.
Automation: Automates responses to security incidents, minimizing manual intervention requirements.
Threat Lifecycle Management: Comprehensive handling of threats from detection to remediation.
Telemetry Aggregation: Integrates data across platforms for a unified security overview.

Why consider Torq based on reviews?

Efficiency: Users notice significant reductions in time spent managing threats.
Risk Reduction: Enhanced ability to identify and address critical threats promptly.
Resource Optimization: Allows teams to allocate effort to other critical tasks by reducing manual security operations.
Scalability: Adaptable to meet the demands of growing or changing infrastructures.

In industries like finance and healthcare, Torq shows effectiveness by adapting to specific risk scenarios often encountered in these fields. Its integration with existing infrastructures makes it a valuable asset for maintaining stringent security standards, essential for protecting critical data and operations in diverse high-stakes environments.

Torq

McAfee ePolicy Orchestrator (McAfee ePO) is the most advanced, extensible, and scalable centralized security management software in the industry. Unifying security management through an open platform, McAfee ePO makes risk and compliance management simpler and more successful for organizations of all sizes.

McAfee

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

NetWitness

Sample Customers

Information Not Available

Brelje & Race, Cognizant, Sutherland Global Services, Eagle Rock Energy, Arab National Bank, Bank Central Asia, Kleberg Bank, Leading Mexican Bank, SF Police Credit Union, Macquarie Telecom, Seagate Technology, Blackburn & Darwen Council, California Department of Corrections & Rehabilitation, IRCEP, Major U.S. State Government, State of Alaska, State of Colorado, Cemex, Deutsche Edelstahlwerke

ADP, Ameritas, Partners Healthcare

Buyer's Guide

McAfee ePolicy Orchestrator vs. NetWitness NDR

March 2026

Free Report: McAfee ePolicy Orchestrator vs. NetWitness NDR

Find out what your peers are saying about McAfee ePolicy Orchestrator vs. NetWitness NDR and other solutions. Updated: March 2026.

DOWNLOAD NOW

885,311 professionals have used our research since 2012.

See our McAfee ePolicy Orchestrator vs. NetWitness NDR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.