Rapid7 InsightIDR vs Trellix Active Response comparison

Rapid7 and Trellix are both solutions in the Endpoint Detection and Response (EDR) category. Rapid7 is ranked #22 with an average rating of 7.8, while Trellix is ranked #45 with an average rating of 8.0. Rapid7 holds a 1.2% mindshare in EDR, compared to Trellix’s 0.4% mindshare. Additionally, 96% of Rapid7 users are willing to recommend the solution, compared to 50% of Trellix users who would recommend it.

Rapid7 InsightIDR

Read 32 Rapid7 InsightIDR reviews

6,636 Views
1,924 Comparison Views

96% willing to recommend

Trellix Active Response

Read 5 Trellix Active Response reviews

561 Views
550 Comparison Views

50% willing to recommend

Rapid7 InsightIDR

Trellix Active Response

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

Rapid7 InsightIDR and Trellix Active Response are robust cybersecurity solutions with distinct advantages. Trellix Active Response offers superior features, but users find better pricing and support with Rapid7 InsightIDR.

Features: Rapid7 InsightIDR users value its comprehensive threat detection and response capabilities. Trellix Active Response excels with its automated threat intelligence and integration with other security tools. Users appreciate Trellix’s advanced analytics and real-time monitoring features. In this regard, Trellix Active Response has the upper hand.

Room for Improvement: User reviews indicate that Rapid7 InsightIDR requires improved scalability and more seamless integration with third-party tools. Trellix Active Response users suggest enhancing its user training resources and streamlining complex configurations. Rapid7’s areas for improvement seem more pressing compared to Trellix’s.

Ease of Deployment and Customer Service: Rapid7 InsightIDR users report a straightforward deployment process and responsive customer support. Trellix Active Response reviews highlight a more complex deployment but praise its dedicated support team. Rapid7 InsightIDR is easier to deploy, while Trellix offers slightly better customer service.

Pricing and ROI: Users note that Rapid7 InsightIDR has competitive pricing and a good return on investment. Trellix Active Response, despite higher setup costs, delivers high ROI due to its advanced capabilities. Although Rapid7 is more budget-friendly, Trellix’s features justify its higher cost.

To learn more, read our detailed Rapid7 InsightIDR vs. Trellix Active Response Report (Updated: December 2025).

Buyer's Guide

Rapid7 InsightIDR vs. Trellix Active Response

December 2025

Download the complete report

Helped 881,114 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Rapid7 InsightIDR

Ranking in Endpoint Detection and Response (EDR)

22nd

Average Rating

8.4

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (15th), User Entity Behavior Analytics (UEBA) (7th), Threat Deception Platforms (4th), Extended Detection and Response (XDR) (18th)

Trellix Active Response

Ranking in Endpoint Detection and Response (EDR)

45th

Average Rating

7.0

Reviews Sentiment

5.1

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of January 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Rapid7 InsightIDR is 1.2%, up from 0.9% compared to the previous year. The mindshare of Trellix Active Response is 0.4%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Market Share Distribution
Product	Market Share (%)
Rapid7 InsightIDR	1.2%
Trellix Active Response	0.4%
Other	98.4%

Endpoint Detection and Response (EDR)

Featured Reviews

SohailHyder

Head of Cyber Security at Super Secure

Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Read full review

Ezzard De Lange

Senior Manager Operational Technology and Cyber Security at Eskom Ltd

Operational efficiencies increase with immediate threat alerts for endpoints

We use Trellix Active Response primarily for our endpoints, including desktop computers. It monitors all the tools that our users use for their day-to-day work The alerts provided by Trellix Active Response are its most valuable feature. They notify us immediately of any vulnerabilities on the…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Dashboards, including the main screen, provide much-needed information at a glance, without hours of coding and sifting through logs to find it. In case of an actual security incident, I have faith that insightIDR has retained all logs in a secure manner that prevents log tampering as well."

"The solution provides satisfying native integration features"

"I have seen that Rapid7 InsightIDR provides security to the networks and endpoints in the company."

"The alerting to drive investigations and remediation has been its most valuable feature."

"The log aggregation and storage provided by InsightIDR has shown no issues with scalability; aggregating over one hundred millions events daily."

"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."

"The platform offers unlimited storage and agent-based solutions."

"Enables the use of honey pots, honey users, and honey files to monitor for suspicious patterns."

More Rapid7 InsightIDR pros

"The alerts provided by Trellix Active Response are its most valuable feature."

"The solution is scalable."

"We are hoping to automate detection and response and take advantage of user behavior analytics, given that we are working from home. About half of our workers are still remote, so Active Response gives us that visibility and lets us automate a number of those events."

"The continuous monitoring component of this solution allows Trellix to launch the MDR solution, which correlates all incidents and provides investigation reports within a short period of time, hence offering an advantage to the customers using Trellix Active Response and its integrated products."

"The alerts provided by Trellix Active Response are its most valuable feature."

"It's a little lighter compared to the older version, which was mostly signature-based."

Cons

"The dashboard is an area that could be simplified."

"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."

"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."

"I would like the ability to adjust the threshold of certain existing alerts. Currently the only option is to change the notifications or create my own alert."

"If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is."

"Lacks a mobile application."

"Cloud risk assessment is one area where I think they need a lot of improvement."

"The reporting is the weakest aspect. There needs to be multi-level grouping for events (for example, group by user and destination). Right now, we can do a group by user and a separate table or group by destination. But I'd be more interested in where a person was logging into instead of who was logging in or where he was logging in."

More Rapid7 InsightIDR cons

"The only area for improvement is regarding operational technology devices, specifically the engineering automation systems."

"I would rate technical support from Trellix Active Response as a seven because sometimes we face difficulties finding engineers quickly, leading to customer frustration."

"While the product is good, we are currently facing support issues."

"I also expected Active Response 's user interface to be much more analytical."

"There are some components on the cloud that should also reside in the on-prem deployment models but don't."

Pricing and Cost Advice

"Accurately predict your licensing counts as this is a subscription based product."

"Rapid7 InsightIDR charges us based on the endpoints we connect to."

"I rate Rapid7 InsightIDR's price a four on a scale of one to ten, where one is cheap, and ten is expensive."

"It is a reasonably priced solution."

"It is more reasonably priced than other vendors."

"The pricing is good, and it is not very expensive."

"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."

"Rapid7 InsightIDR is priced very well and is cost-effective."

More Rapid7 InsightIDR pricing and cost advice

"Our costs were somewhere around $600K in Trinidad dollars, which might be about $100K US. We have the ETP plus the EDR. Our recent renewal was 1800 licenses as opposed to the full amount. Our transaction cost was about $600K Trinidad dollars, which is somewhere around $90-100K US."

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

881,114 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

11%

Financial Services Firm

Manufacturing Company

Government

No data available

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	5
Large Enterprise	6

No data available

Questions from the Community

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What do you like most about Rapid7 InsightIDR?

During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an applicati...

See all answers

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

The product pricing is very cheap.

See all answers

What is your experience regarding pricing and costs for McAfee Active Response?

Based on our evaluations, Trellix Active Response's pricing was the most feasible from a cost perspective. I rate the pricing between a six and an eight. It is justified.

See all answers

What needs improvement with McAfee Active Response?

For Trellix Active Response, there is room for improvement in the platform area and security area to make the dashboard visibility clearer and easier for customers to monitor malicious activities o...

See all answers

What is your primary use case for McAfee Active Response?

The typical use case for Trellix Active Response is to provide quick incident response, as the product collects and correlates logs with the ePO dashboard, allowing customers to get visibility of t...

See all answers

Comparisons

Rapid7 InsightVM vs Rapid7 InsightIDR

Compared 6% of the time

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 5% of the time

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 5% of the time

CrowdStrike Falcon vs Rapid7 InsightIDR

Compared 4% of the time

Darktrace vs Rapid7 InsightIDR

Compared 4% of the time

More Rapid7 InsightIDR Competitors

Trellix Endpoint Security Platform vs Trellix Active Response

Compared 29% of the time

Trellix Endpoint Detection and Response (EDR) vs Trellix Active Response

Compared 23% of the time

CrowdStrike Falcon vs Trellix Active Response

Compared 17% of the time

Microsoft Defender for Endpoint vs Trellix Active Response

Compared 13% of the time

Tanium vs Trellix Active Response

Compared 9% of the time

More Trellix Active Response Competitors

Product Reports

Buyer's Guide

Rapid7 InsightIDR

January 2026

Download Rapid7 InsightIDR product report

Buyer's Guide

Endpoint Detection and Response (EDR)

December 2025

Download Trellix Active Response product report

Also Known As

InsightIDR

McAfee Active Response

Overview

Parsing hundreds of trivial alerts. Managing a mountain of data. Manually forwarding info from your endpoints. Forget that. InsightIDR instantly arms you with the insight you need to make better decisions across the incident detection and response lifecycle, faster.

Rapid7

Continuous Visibility into Your Endpoints:
Capture and monitor events, files, host flows, process objects, context, and system state changes that may be indicators of attack or dormant attack components.

Identify and Remediate Breaches Faster:
Access tools you need to quickly correct security issues. Send intelligence to analytics, operations, and forensic teams.

Target Critical Threats:
Get preconfigured and customizable actions when triggered, so you can target and eliminate threats.

Trellix

Sample Customers

Liberty Wines, Pioneer Telephone, Visier

Liquor Control Board of Ontario

Buyer's Guide

Rapid7 InsightIDR vs. Trellix Active Response

December 2025

Free Report: Rapid7 InsightIDR vs. Trellix Active Response

Find out what your peers are saying about Rapid7 InsightIDR vs. Trellix Active Response and other solutions. Updated: December 2025.

DOWNLOAD NOW

881,114 professionals have used our research since 2012.

See our Rapid7 InsightIDR vs. Trellix Active Response report.

See our list of best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.