No more typing reviews! Try our Samantha, our new voice AI agent.

NetWitness NDR vs ReversingLabs comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness NDR
Ranking in Threat Intelligence Platforms (TIP)
34th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (48th), Endpoint Detection and Response (EDR) (58th), Security Orchestration Automation and Response (SOAR) (23rd), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (39th)
ReversingLabs
Ranking in Threat Intelligence Platforms (TIP)
28th
Average Rating
9.2
Reviews Sentiment
7.0
Number of Reviews
4
Ranking in other categories
Application Security Tools (38th), Anti-Malware Tools (40th), Container Security (50th), Software Composition Analysis (SCA) (25th), Software Supply Chain Security (18th)
 

Mindshare comparison

As of June 2026, in the Threat Intelligence Platforms (TIP) category, the mindshare of NetWitness NDR is 1.3%, up from 1.0% compared to the previous year. The mindshare of ReversingLabs is 2.1%, up from 1.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
ReversingLabs2.1%
NetWitness NDR1.3%
Other96.6%
Threat Intelligence Platforms (TIP)
 

Featured Reviews

reviewer1799727 - PeerSpot reviewer
Manager, IT Security Operations at a non-profit with 11-50 employees
Reliable and good support but can be expensive
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.
TC
Forensic Lead, Global Security Fusion Center at a insurance company with 10,001+ employees
Very good malware and goodware repository and enables us to look more deeply at indicators of compromise
The automated static analysis of malware is the most valuable feature. Its detection abilities are very good. It hits all of the different platforms out there, platforms that see the items in the wild. Also, the solution’s object and file analysis provide us with actionable insights. Its malware and goodware repository is very good. It's very robust. It gets all of the different repositories that are out there that do analysis and brings them under one roof where we can statically analyze for those indicators of compromise and look at them more deeply. If we need to go deeper into things, we can do that.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The stability of the RSA NetWitness Endpoint is very good."
"We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues."
"It is stable. We have been using it for some time, without any issues."
"It is very easy to use, and its usability is great."
"I would highly recommend the solution. Just go ahead and get it."
"I would recommend others to use RSA NetWitness Endpoint at this time because they have evolved from an MD to an EDR solution to an XDR solution."
"This solution allows us to locate the malware in real-time."
"We use it for IT security purposes; this is our central log management solution, so we incorporate all of our servers and PCs into this software and can monitor the logs from there."
"We have complete faith that it can do that for us, and can do it at scale."
"As far as the availability of the content is generally concerned and the number of malicious programs that can be looked up in the repository, these are very extensive."
"We had nothing in the environment to do such analysis, so it's been a savior in many ways."
"ReversingLabs has a large sample size."
"The automated static analysis of malware is the most valuable feature. Its detection abilities are very good. It hits all of the different platforms out there, platforms that see the items in the wild."
"It offers reports on a great many more file types than the other analysis solutions we have. It can give us a more in-depth analysis and better reporting on a larger number of file types. It also gives us a more comprehensive score on a number of things as well, and that's why we're using it as a front-end filter. It gives us more information... It's valuable because of its depth of information, as well as the breadth it gives us. There aren't a lot of tools that cover all of the different file types."
"As far as the malware repository is concerned, it's extensive. It's a good source for finding samples, where we are unable to find them on other channels or by leveraging other sources."
"As far as static analysis information is concerned, we use most of the information that is available in order to determine whether or not we might be dealing with a malware variant. This includes information that is related to Java rules. This is also related to malware families indicated or specific malicious software variants that are labeled by name."
 

Cons

"The contamination feature could be improved."
"The initial setup requires a high level of skill, then the setup is good and smooth."
"One of the drawbacks of using this product is that when you deploy, you have to create MSI files."
"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."
"The solution doesn't have a reporting engine which would be helpful."
"RSA NetWitness Network could improve on integration with non-native application integration."
"The problem with this product is that it's a bit slow."
"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."
"The product support could be better at times. Sometimes, the resources that they provide could be of higher quality."
"The solution needs to improve integrations."
"While the company is very helpful, it would be very much appreciated to have extensive proof of concept scripts for the different APIs available, though not for all the APIs that we have purchased. Respective scripts are available, but those scripts which are available are typically not of very high quality."
"I would like to see if we could do a little bit more of bulk uploading of hash sets. Right now, I can only do them individually."
"We would really like further integration with our threat intelligence platform, which is called ThreatConnect. We would also really like further integrations with an endpoint protection product we use called Tanium. The reason I mentioned both of these is that ReversingLabs claims to have extensive integrations with both of them, but they did not work for us."
 

Pricing and Cost Advice

"We are on a three-year contract to use RSA NetWitness Network."
"It is highly scalable. It can be bought based on your requirements."
"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
"I do not have any opinion on the pricing or licensing of the product."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"We have a yearly contract based on the number of queries and malicious programs which can be processed."
"Currently, the license number of lookups that we purchased has not been reached yet, because the integration has only recently been completed. However, our usage is expected and planned to increase over the next couple of months."
report
Use our free recommendation engine to learn which Threat Intelligence Platforms (TIP) solutions are best for your needs.
902,270 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Manufacturing Company
9%
Construction Company
8%
Computer Software Company
8%
Construction Company
16%
Financial Services Firm
12%
Computer Software Company
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise6
No data available
 

Also Known As

RSA ECAT, NetWitness Network
ReversingLabs Titanium, ReversingLabs secure.software
 

Overview

 

Sample Customers

ADP, Ameritas, Partners Healthcare
Financial services, healthcare, government, manufacturing, oil & gas, telecommunications, information technology
Find out what your peers are saying about NetWitness NDR vs. ReversingLabs and other solutions. Updated: June 2026.
902,270 professionals have used our research since 2012.