Try our new research platform with insights from 80,000+ expert users

NetWitness NDR vs Varonis Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 7, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness NDR
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Threat Intelligence Platforms (41st), Endpoint Detection and Response (EDR) (60th), Security Orchestration Automation and Response (SOAR) (25th), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (40th)
Varonis Platform
Average Rating
8.2
Reviews Sentiment
6.4
Number of Reviews
14
Ranking in other categories
Email Security (20th), Data Loss Prevention (DLP) (9th), User Entity Behavior Analytics (UEBA) (6th), Data Governance (4th), SaaS Security Posture Management (SSPM) (5th), Data Security Posture Management (DSPM) (3rd), Compliance Management (7th), Ransomware Protection (10th), Identity Threat Detection and Response (ITDR) (7th)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. NetWitness NDR is designed for Network Detection and Response (NDR) and holds a mindshare of 2.4%, up 1.7% compared to last year.
Varonis Platform, on the other hand, focuses on Data Loss Prevention (DLP), holds 5.9% mindshare, up 4.1% since last year.
Network Detection and Response (NDR) Market Share Distribution
ProductMarket Share (%)
NetWitness NDR2.4%
Darktrace22.7%
Vectra AI15.6%
Other59.300000000000004%
Network Detection and Response (NDR)
Data Loss Prevention (DLP) Market Share Distribution
ProductMarket Share (%)
Varonis Platform5.9%
Microsoft Purview Data Loss Prevention13.0%
Forcepoint Data Loss Prevention9.0%
Other72.1%
Data Loss Prevention (DLP)
 

Featured Reviews

SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.
Frederic  Delos - PeerSpot reviewer
Offers the ability to identify sensitive areas, allowing you to drill down into the sensitive data
The most effective feature for me is its ability to identify sensitive areas, allowing you to drill down into the sensitive data, provided you have access, to determine whether it's a false positive or a true positive. That's the best thing for me, out of all of it. It's got everything, like other ones, but I like to be able to look at something if I'm doing forensics on the alert and say, "Okay, do I really need to do something with this?" For example, we don't want sensitive data in our OneDrive. So it identifies the sensitive data that's possibly in the OneDrive. And what I can do is look at it and identify whether it's actually sensitive data in Datalert or whether it looks like sensitive data, but I know it's a false positive. If it is a false positive, I can basically say ignore this pattern based on X, Y, and Z, you know, whether it's Redjax or keyword proximity. So I like that. With other tools, I gotta go through a whole process because it's a little bit more complex. Here, I can tag it and bag it in one shot. And the next good time I scan, it slips over it. So it helps in that.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"This solution allows us to locate the malware in real-time."
"The log correlation is good."
"Technical support is knowledgeable."
"The interface of this solution is very flexible and easy to use."
"Varonis Platform is transparent and captures everything in the environment without impacting the performance. The tool helps us unify data feeds into a single reporting system."
"Technical support from Varonis is rated as nine out of ten."
"The analytics would have to be our most valuable feature."
"That alerting and reporting service is great."
"The 24/7 support is the most valuable feature. They have been able to answer support questions pretty quickly."
"I also appreciate the reporting feature, which allows for the extraction of various reports based on specific needs. These reports can be used for audit purposes, such as tracking changes in file locations or deletions."
"It can easily identify unusual behavior or access patterns that may pose a potential threat, while operating as a unified reporting system."
"The solution's classification engine is highly configurable and efficient."
 

Cons

"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."
"The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"Threat detection could be better."
"This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
"We have Microsoft Office 365. I just saw an article today which says that they're actually getting integrated with Microsoft Office 365, which would be a useful feature. For user-based reports, log on activity, and stuff like that, it doesn't seem to really be present like Log360. That could just be my inexperience with it. I've been dealing with it for only about two and a half months."
"The solution's areas of improvement are the interface and the dependency on on-premises deployment for some components."
"Varonis requires more access permissions for its core functions compared to competitors, which can be a concern for companies about data safety."
"I'd like to see automatic updates for this solution. Currently, it's a manual process to update all the keywords"
"The GUI should be more functional. There should be a process for connecting through Chrome, Internet Explorer, etc."
"The remediation process can be improved. There will be no existing permission group for the McAfee channel domains. We can create a new permissions group for the required folder."
"I would like it to have cloud integration."
"For unstructured data monitoring, it's one of the top ones, if not the top one, due to its usability."
 

Pricing and Cost Advice

"I do not have any opinion on the pricing or licensing of the product."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"It is an expensive product."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"We are on a three-year contract to use RSA NetWitness Network."
"The platform is expensive. I rate the pricing a nine out of ten."
"I would rate the pricing an eight out of ten, with ten being the most expensive."
"You could do a subscription, where you pay yearly, or you could purchase it outright. The licensing cost is based on the number of users on the system that you are monitoring."
"It's expensive, kind of, really expensive."
"Licensing is on an annual basis. Maintenance and renewal fees are separate. Varonis Datalert is quite expensive."
"The pricing is good. It neither expensive nor cheap. It is average."
"Varonis Platform wasn't certainly the cheapest solution."
report
Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.
867,445 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
9%
Government
7%
Financial Services Firm
15%
Manufacturing Company
9%
Computer Software Company
9%
Insurance Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise5
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise11
 

Questions from the Community

Ask a question
Earn 20 points
What do you like most about Varonis Platform?
The solution has significantly improved data security and compliance posture by allowing us to track and monitor activities. We can see who accesses data and when files are created and understand w...
What needs improvement with Varonis Platform?
Varonis started as an on-premises solution and is transitioning to cloud. It hasn't fully moved yet, which is an area for improvement. Varonis requires more access permissions for its core function...
What is your primary use case for Varonis Platform?
The primary use case for Varonis Platform is data discovery, specifically for discovering sensitive data in our organization to protect it. We are looking for a solution that can scan our repositor...
 

Also Known As

RSA ECAT, NetWitness Network
SlashNext Complete
 

Overview

 

Sample Customers

ADP, Ameritas, Partners Healthcare
Nottingham Building Society
Find out what your peers are saying about Darktrace, Vectra AI, Trend Micro and others in Network Detection and Response (NDR). Updated: August 2025.
867,445 professionals have used our research since 2012.