Try our new research platform with insights from 80,000+ expert users

Rapid7 InsightIDR vs Sophos UTM comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Rapid7 InsightIDR
Average Rating
8.4
Reviews Sentiment
7.4
Number of Reviews
32
Ranking in other categories
Security Information and Event Management (SIEM) (14th), User Entity Behavior Analytics (UEBA) (5th), Endpoint Detection and Response (EDR) (25th), Threat Deception Platforms (4th), Extended Detection and Response (XDR) (17th)
Sophos UTM
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Unified Threat Management (UTM) (5th)
 

Mindshare comparison

While both are Network Security Systems solutions, they serve different purposes. Rapid7 InsightIDR is designed for Security Information and Event Management (SIEM) and holds a mindshare of 2.4%, down 2.6% compared to last year.
Sophos UTM, on the other hand, focuses on Unified Threat Management (UTM), holds 7.7% mindshare, up 5.6% since last year.
Security Information and Event Management (SIEM) Market Share Distribution
ProductMarket Share (%)
Rapid7 InsightIDR2.4%
Wazuh10.2%
Splunk Enterprise Security9.2%
Other78.2%
Security Information and Event Management (SIEM)
Unified Threat Management (UTM) Market Share Distribution
ProductMarket Share (%)
Sophos UTM7.7%
Fortinet FortiGate35.1%
WatchGuard Firebox10.9%
Other46.3%
Unified Threat Management (UTM)
 

Featured Reviews

Asim Naeem - PeerSpot reviewer
Providing comprehensive insight into alerts while working towards AI enhancement
I definitely recommend Rapid7 InsightIDR. It is becoming better, with improvements being continuously made to the product. Right now, I do not have any advice about Rapid7 for other users because every organization or user has different criteria or multiple use cases, so I refrain from commenting on that. I rate the overall solution seven out of ten.
Samaila Yusuf - PeerSpot reviewer
Network protection strengthens through effective threat management features and secure access control
The zero-day protection and firewall rules are some of the most effective features for threat management. I can set the rules and features, and also use IPsec to connect all my on-premises servers and link them to Sophos UTM so that they are protected even when in the cloud. Additionally, I use it to control access into the building through a captive portal integrated across all the PCs we have, ensuring secure access only for authenticated users.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is easy to use, and the interface is intuitive."
"The solution provides satisfying native integration features"
"The ability to ingest Office 365 log files, then process them into events and display them on a map."
"Simple configuration and automatically syncs to the cloud platform."
"InsightIDR helps us investigate an environment to discover information about incidents."
"I like the tool's user analysis feature."
"Very intuitive and easy to set up."
"Great coverage of all systems within our network from endpoint to firewall."
"It does not take much effort or thinking to understand how it works.​"
"The zero-day protection and firewall rules are some of the most effective features for threat management."
"The intrusion prevention is great, and I like dual virus scanning on the network layer because we scan it through Avira and Sophos. Web filtering is also a fantastic option for clients who want to really lock down internet access."
"The packet filtering's great. You get out what you put into it. It works great as long as you know your security and configure everything adequately. If you just pop one in and it's not configured, then it's basically wide open. It kind of depends on the admin skill, but it's an excellent product."
"This is a very stable product."
"The most valuable feature is the IPS. It also protects us from malware."
"The initial setup is pretty straightforward."
"It is a very good product. The threat monitoring process is the most valuable feature."
 

Cons

"InsightIDR is only available in a cloud version. Some of our customers prefer an on-prem solution because they want to manage the security within their environment."
"I would like the ability to adjust the threshold of certain existing alerts. Currently the only option is to change the notifications or create my own alert."
"The main problem lies in the processes within the client's operating systems."
"I feel it would greatly benefit from more supported log sources."
"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."
"Inability to get access to compliance reports within the solution."
"The ability to tune the collector for custom logs would greatly help."
"The integration capabilities of the solution have certain shortcomings where improvements are required."
"The support could be better."
"​This product could use some improvement with web filtering. It takes a lot of time and effort to set up and maintain.​"
"Sophos UTM's firewall is a bit weak, and some of its features lack depth compared to other products like F5."
"We didn’t find any issues but I know there have been some in the last few years."
"I would prefer to see additional features in the next release of Sophos UTM because cyber crime increases every day, so we also need to improve our game to prevent any chances for intrusion."
"Sophos UTM could be simplified, and they can improve on the many other features, like SD-WAN and load balancing. Sophos UTM is missing a few features that their competitors have. For example, if you have multiple branches you would like to connect, the load balancing features aren't available on multilink. If we create a VPM for multiple LAN links, we cannot load balance the traffic."
"Support for IKEv2 is needed in this solution."
"The initial setup was straightforward. The full deployment takes approximately two days which could be simplified to reduce the time. The major part of the process is the configuration and the policy setup."
 

Pricing and Cost Advice

"The pricing and licensing are competitive."
"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."
"​I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability.​"
"The pricing is good, and it is not very expensive."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
"​Accurately predict your licensing counts as this is a subscription based product.​"
"The licensing model is very straightforward, it's a bit pricey, but for what you get, it's well worth it."
"I would recommend to follow Sophos’ sizing guidelines for choosing which license and model to use. Sophos has their own way of going about this and supplies partners with all the information required. If you follow their documentation and guidelines, there should be zero questions about licensing and sizing."
"The product pricing and licensing are higher, but they offer good value for the features and stability provided."
"You cannot really say that the solution is expensive, given the protection it gives."
"Sophos UTM has very reasonable pricing."
"The solution is very low cost compared to competitors. You have a good firewall, a lot of functions for less than the price of some omni firewall competitors."
"​In the case of a software/virtual appliance subscription, you pay by protecting user/IP addresses. You can do this to as much hardware resources as you like.​​"
"It is the cheapest product available. It's good if you have a low budget."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
869,760 professionals have used our research since 2012.
 

Comparison Review

it_user216600 - PeerSpot reviewer
Jan 3, 2016
Sophos UTM vs. Fortinet FortiGate
I have used both Sophos and Fortinet products in production and I have found the Sophos UTM appliances (hardware and virtual) to be a better fit most of the time -- with a few caveats which I will touch on below. In both instances, the transition from TMG will be mostly straightforward. The main…
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Financial Services Firm
8%
Manufacturing Company
7%
Government
7%
Computer Software Company
13%
Comms Service Provider
9%
Manufacturing Company
8%
Educational Organization
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business20
Midsize Enterprise5
Large Enterprise6
By reviewers
Company SizeCount
Small Business71
Midsize Enterprise27
Large Enterprise26
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about Rapid7 InsightIDR?
During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an applicati...
What are the biggest technical differences between Sophos UTM and Fortinet FortiGate?
As a solution, Sophos UTM offers a lot of functionality, it scales well, and the stability and performance are quite good. The most valuable features for me are their web and email filtering. I wou...
What do you like most about Sophos UTM?
The most valuable feature of Sophos UTM is the endpoint protection feature.
What is your experience regarding pricing and costs for Sophos UTM?
The value between what I receive and what I pay is the best in the industry.
 

Also Known As

InsightIDR
Astaro
 

Overview

 

Sample Customers

Liberty Wines, Pioneer Telephone, Visier
One Housing Group
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: September 2025.
869,760 professionals have used our research since 2012.