ExtraHop Reveal(x) 360 Reviews

I have been using ExtraHop Reveal(x) 360 for two years.

My main use case for ExtraHop Reveal(x) 360 is network detection and response. I use it for real-time threat detection, investigating lateral movement, and getting packet-level visibility that other tools miss. Second, I use it for network performance monitoring to troubleshoot performance issues and reduce MTTR. Third, I use it for complete visibility across hybrid and cloud environments, especially with its native decryption and cloud integration.

I primarily use ExtraHop Reveal(x) 360 for two use cases: security and performance. On the security side, I use it for NDR, detecting threats, lateral movement, and encrypted threats using its real-time decryption and packet-level forensics. On the performance side, I use it for NPM to troubleshoot slow applications, find root causes, and reduce MTTR from days to hours. Overall, I use it as a single 360-degree platform for visibility across on-prem and cloud.

The best features that ExtraHop Reveal(x) 360 offers are its cloud-native architecture, real-time packet-level visibility, and line-rate SSL decryption. It offers AI-driven threat detection, detection of lateral movement, and automated investigation workflows. It provides unified visibility across on-prem, cloud, and hybrid environments with seamless integration. Most importantly, it drastically reduces MTTR with packet forensics and intuitive dashboards.

What stands out about ExtraHop Reveal(x) 360 compared to others is its agentless, cloud-native SaaS model. Unlike other solutions, it does full line-rate decryption up to 100 Gbps and decodes over 70 protocols without needing agents. It does not rely on logs or agents; it uses wire data as ground truth, which gives true real-time visibility. That means faster deployment, lower overhead, and true 360-degree visibility from one platform.

ExtraHop Reveal(x) 360 is very powerful, and there is always room for improvement. One area is more customizable dashboards and reporting for executives, with more business-level reporting. Second, deeper native integrations with SOAR and ticketing tools to automate response even faster. Third, cost optimizations for SMBs, making some premium features more accessible would help wider adoption.

From a consultant's perspective, a few enhancements could make ExtraHop Reveal(x) 360 even stronger. First, usability, with more intuitive, guided workflows and contextual AI assist for junior analysts to reduce the learning curve. Second, onboarding with more pre-built use case templates for healthcare, finance, and other industries to speed up time-to-value. Third, support and enablement with more granular role-based access and better in-product documentation for faster troubleshooting. These are not gaps, but opportunities to make an already powerful platform even more user-friendly and scalable.

I have been working in this field for approximately five years.

ExtraHop Reveal(x) 360 is very stable in my experience. That is one reason I stayed with it because it is SaaS. The management plane is fully cloud-managed by ExtraHop. We never had downtime or upgrade issues. ExtraHop pushes updates non-disruptively, so we are always on the latest detection without maintenance windows. The sensors were also stable. I ran virtual sensors in AWS and on-prem for over a year at 10 Gbps sustained with zero crashes. Even during traffic bursts, it auto-scaled and did not drop packets. We had over 99.9% availability, and support was proactive; they monitor sensor health from the cloud. Compared to our old hardware appliances which needed constant patching, ExtraHop Reveal(x) 360 was much more stable and low maintenance.

Its scalability was one of the main reasons I chose it, so it is truly cloud-native SaaS. First, there are no hardware limits; it is all virtual sensors. Second, it allows for petabyte scale analysis. The SaaS control plane can ingest and retain months of metadata and packets from distributed sensors, all viewable from a single console. Third, it is auto-elastic in the cloud. In AWS, sensors auto-scale with traffic bursts, so I never dropped packets even during peaks, with no performance hit. Fourth, licensing is throughput-based, not endpoint-based, so when I added 2,000 more endpoints, my cost did not spike. That made the scaling very predictable.

Support for ExtraHop Reveal(x) 360 was excellent. That is actually one of ExtraHop's differentiators. First, 24/7 enterprise support. Second, proactive, not reactive. Third, they have deep technical expertise. Fourth, onboarding was smooth. They guided deployment, detection workshop, and SOC training in the first two weeks, so time to value was very fast. Overall, it deserves a nine out of 10 because it is a true partner model, not just vendor support.

On a scale of one to ten, I would rate customer support for ExtraHop Reveal(x) 360 a nine out of 10. I am giving it a nine because it was proactive and truly enterprise-grade, with 24/7 support, SLA-based, and a 30-minute response time for P1 issues.

I previously used a mix of tools: Darktrace for NDR and Corelight Zeek for network logs, plus traditional full packet capture like RSA NetWitness. I switched to ExtraHop Reveal(x) 360 for four reasons. First, Darktrace had no ground truth; it was mostly AI anomaly alerts, lots of black box, high false positives around 40%, and no packet evidence. ExtraHop gives ML plus full packet payloads, so I can prove every alert. Second, tool sprawl: I had Zeek for logs, NetWitness for PCAP, and Darktrace for NDR, and nothing was correlated. ExtraHop Reveal(x) 360 gave me NDR, NPM, forensics, and decryption in one platform. Third, cloud visibility gap: Darktrace and NetWitness were strong on-prem but very weak in AWS and Azure, and I had zero east-west visibility in the cloud. ExtraHop Reveal(x) 360 is cloud-native SaaS with VPC monitoring and vTAP support, so I get visibility on-prem and in the cloud. Fourth is decryption at scale: my old setup could not decrypt TLS 1.3 at 10 Gbps without a performance hit. ExtraHop decrypts natively with keys without proxy; that was a game changer for me.

I purchased ExtraHop Reveal(x) 360 through AWS Marketplace via a private offer. I chose Marketplace for three reasons: simplified procurement, consolidated billing under my AWS account, and it counted towards my EDP commitment. It also made deployment faster. I could spin up sensors directly in my VPCs with one click from Marketplace. Licensing, billing, and deployment were all streamlined through AWS.

I have seen strong ROI, both hard cost and time savings. First, meantime to respond: I reduced MTTR from four to six hours to under 30 minutes because every alert comes with packet evidence, so Tier 1 can validate instantly instead of chasing logs. Second, tool consolidation: ExtraHop Reveal(x) 360 replaced my separate packet capture, NPM, and legacy NDR. That alone saved approximately 30% on licensing and infrastructure. Third, on threat detection, I caught lateral movement and C2 activity in east-west traffic that my SIEM and EDR completely missed. That prevented at least two potential incidents that could have cost significantly.

Operationally, there are zero agents to manage. My SecOps saved approximately 15 to 20 hours a week not managing agents and decrypting traffic manually. ROI was clear: faster detection, lower TCO, and measurable risk reduction. On employees, I did not need extra headcount. ExtraHop Reveal(x) 360 is SaaS, so no dedicated team for hardware. Two network security engineers manage it for five locations and two clouds. With my old tools, I needed four to five people for capture, NPM, and NDR separately, so I saved two to three FTEs.

On time saved, this was massive. MTTR went from four to five hours to under 30 minutes, which is an 85% reduction because every alert has packet evidence, and L1 does not need to escalate. Investigation time per incident went from 90 minutes to 15 minutes. Weekly operational times, I saved 15 to 20 hours a week, not managing agents, decryption, and manual PCAP pulls.

On money saved, three areas. Number one is tool consolidation: I replaced three tools—full packet capture appliance plus NPM plus legacy NDR—saving approximately 30% to 35% on licensing in year one. Number two, breach prevention: it detected lateral movement and C2 in east-west that EDR/SIEM missed. That one detection alone saved potential $200,000 in breach cost and downtime. Number three is the AWS EDP benefit: buying via AWS Marketplace counted towards my commitment, so I could get better discount leverage. Overall, less headcount, 85% faster response, and 30% lower TCO.

Licensing is subscription-based SaaS, priced on throughput, which is how much traffic I analyze, not per endpoint, which I found very scalable. My licensing was via AWS Marketplace private offer, annual subscription, which included the cloud management plane, sensors, and support. There was no separate hardware cost. Setup cost was minimal because it is SaaS, with no physical appliances. I deployed virtual sensors as VMs using TAP and SPAN in on-prem and VPC mirroring in the cloud. It was up and running in a day. Compared to legacy NDR or packet capture tools, TCO was lower because there were no agents to manage and no extra storage appliances, with full cloud management.

I did a formal POC with three options before choosing ExtraHop Reveal(x) 360. I evaluated Darktrace, Vectra AI, and Corelight, plus my existing RSA NetWitness for packet capture.

The advice that I would give to others would be four things. First, do not evaluate it as just NDR; evaluate it as a unified platform: NDR plus NPM plus packet forensics plus decryption. If you evaluate only for alerts, you will miss 70% of the value. The real ROI is in tool consolidation and packet evidence. Second, do a proper POC with real traffic, not lab traffic. I saw true value only when I mirrored actual east-west and cloud traffic. Third, plan decryption from day one. The biggest value I got was from decrypted visibility. Work with your PKI team early to get keys sorted for TLS 1.3. Without decryption, you are seeing only 30% of your traffic. Fourth, involve both NetOps and SecOps. This is not just a security tool. NetOps will appreciate the NPM performance dashboards, and SecOps will appreciate the detections. Leverage ExtraHop's team; their SE and CSM were very strong. I would rate this product a nine out of 10.

I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time network traffic across the north-south environment. While we do not currently focus on east-west traffic, we have plans to enable that capability in our roadmap for upcoming quarters. Additionally, we address advanced threats such as lateral movement and insider threats. We also use the platform for visibility of all encrypted traffic deployed with endpoint agents, supporting incident response investigations integrated with our SIEM and cross-functional threat intelligence sources.

Our SOC team has highlighted several scenarios demonstrating how ExtraHop Reveal(x) 360 helps with incident response investigations. One major threat involved an open port that was not supposed to be part of our standards, which was detected and resolved.

ExtraHop Reveal(x) 360 offers AML-based behavioral detection, good integration with SIEM and SOAR platforms such as Splunk and QRadar, and contextual metadata for faster triage through alerting mechanisms. The platform provides agentless traffic analysis for packet-level visibility and features a cloud-native SaaS architecture that eliminates the need for heavy on-premises management, making these features stronger compared to competitors in the market.

The behavioral detection that our SIEM identified was enhanced by ExtraHop Reveal(x) 360, providing an in-depth summary of a specific host. The process was quicker than expected, consuming less than a day for complete approvals, isolation, and resolution.

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. Initial setup requires significant effort to get the platform tuned up to speed, which can be difficult. Additionally, the dashboards could benefit from enriched customizations, advanced features for learning, and detailed documentation to assist with complex integrations.

I have been using ExtraHop Reveal(x) 360 for close to three and a half years, deploying it in our cloud environments, specifically in Azure and AWS, while we maintain a different solution on-premises for our cloud detection and response needs.

ExtraHop Reveal(x) 360 performs stably under high traffic loads. While there is a cost associated with the load sent, the cloud-hosted analytics layer alleviates infrastructure-related performance bottlenecks, enhancing visibility into encrypted traffic and making the platform more suitable for hybrid and large enterprise networks such as ours.

The platform has proven to be stable and performs consistently even under high traffic loads. Quick auto-upgrade solutions for sensors prevent any major disruptions and mitigate infrastructure-related performance bottlenecks.

ExtraHop Reveal(x) 360's scalability is well-defined, facilitating ease of growth for enterprise environments. The cloud-native architecture manages large traffic volumes across distributed settings without significant performance degradation, allowing us to add more sensors as needed.

The support we receive from ExtraHop is very good, responsive, and knowledgeable.

ExtraHop support provides dedicated engineers who check in bi-weekly, demonstrating knowledge and responsiveness. They address technical gaps by consulting their internal engineering team to deliver solutions during onboarding and tuning.

We did not use any solution prior to ExtraHop Reveal(x) 360, but we evaluated a few options including Vectra AI. We recognized ExtraHop's stronger depth in packet-level visibility and encrypted traffic analysis as the key factors in our choice.

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. Initial setup requires significant effort to get the platform tuned up to speed, which can be difficult.

I evaluated Vectra AI and another solution, likely involving Cisco. However, ExtraHop's depth of packet-level visibility and encrypted traffic analysis made it the standout option.

We have covered most of the features over the past three years and look forward to discovering more as we work closely with the ExtraHop technical team, who are open to sharing what they have developed.

Pricing is on the higher side, typically based on load, volume of traffic, and deployment scale. The advanced detection capabilities provide significant value in reducing investigation time, making the licensing and pricing acceptable for larger organizations.

ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments.

ExtraHop Reveal(x) 360's SaaS environment is well-suited for cloud, on-premises, and hybrid environments, effectively addressing real-life scenarios involving east-west and north-south traffic. The platform is recommended for large organizations in need of comprehensive detection capabilities. I would rate this product overall as an 8 out of 10.

My main use case for ExtraHop Reveal(x) 360 is primarily to detect devices and any abnormal activity on our network and on our client network.

A specific example of how I use ExtraHop Reveal(x) 360 to detect abnormal activity is when users attempt to upload documents outside of the network. We detect that activity from ExtraHop.

ExtraHop Reveal(x) 360 has been providing extensive networking details that give us insight into our network traffic. Even though we have XDR and SIEM tools, the NDR platform provides more visibility, especially since we have core switches, routers, and firewalls.

The best features ExtraHop Reveal(x) 360 offers include device detection. In large environments, we do not detect all devices, and when we implement this solution, we can see what devices are present in our environment, including users bringing devices from outside their home and plugging them into our network. This is a valuable feature.

The device detection feature works easily for me. Sometimes users are unaware of bringing their own devices from home, and we need to detect those. We miss some devices when we do not install our other security tools. In this scenario, this feature is quite helpful for us.

It is helpful to understand the MITRE framework with ExtraHop Reveal(x) 360. It shows if there is malicious activity or abnormal activity, and we can analyze through MITRE and those frameworks, which is quite helpful for understanding and investigating the network.

ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform. This improves our security posture within our network.

The specific outcomes I noticed with ExtraHop Reveal(x) 360 include detecting abnormal traffic movement and lateral movement occurring on the network. A SIEM tool might take time to detect these, but ExtraHop performs well in this scenario.

I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR. Having one platform for both would make it a great product for the organization and for the market as well.

I have been using ExtraHop Reveal(x) 360 for around one year now.

In my experience, ExtraHop Reveal(x) 360 is stable, and I have not experienced any downtime.

ExtraHop Reveal(x) 360's scalability is very good, and I have not experienced any issues as my organization grows.

The customer support for ExtraHop Reveal(x) 360 has been good for me. Currently, I have not had any issues to reach out to your team, so I cannot comment further.

I have seen a return on investment with ExtraHop Reveal(x) 360. From a time-saving point of view, it is a very good tool, and we can save on human intervention, meaning less manual intervention is needed.

I would advise others looking into using ExtraHop Reveal(x) 360 that if you have a major environment where you cannot identify or control your devices, especially within your network, it is better to use ExtraHop features to improve your security posture. I would rate this product a 9 out of 10.

We were seeking a solution that can effectively identify security incidents within our networks, providing a level of visibility that surpasses what other products with agents currently offer. Additionally, we have a critical need for robust asset management capabilities. Traditional agent-based products fall short in comparison to what we can automatically glean from our network. Our third priority lies in network hardening. We aim to rapidly identify vulnerabilities and weaknesses, a task that has historically been time-consuming or, in some cases, nearly impossible. The ability to receive comprehensive information within a mere three minutes is crucial for enhancing our network security posture.

We only used it on PoV. But we have already easily identified the places that need attention. So we can say that the product starts bringing valuable data to the company from the very first minutes of use.

Additionally, I would like to mention the option to purchase an additional NPM licence which enables the statistics and network metrics module for NOC. For example, this solution will help in troubleshooting network and AD.

It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management. Its strengths lie in its outstanding user interface, streamlined implementation, and efficient ongoing support. With a commendably low false positive rate, it minimizes operational efforts, allowing for quick comprehension and configuration. A notable advantage is its licensing based on MAC addresses, providing a more accurate representation of real devices and potential cost savings.

The NDR feature analyzes network traffic, creating records with connection details. While these records offer insights, there's a limitation in investigating payloads directly. ExtraHop provides an option for an additional server to save payloads, but its temporary storage has constraints. Unlike some competitors, it lacks an automatic payload-saving feature for each detection, presenting an improvement opportunity. Suggested enhancement involves the main sensor prompting payload storage for specific detections, streamlining the investigation process, and contributing to a more efficient workflow. A drawback includes packet storage limitations for payload data, necessitating timely extraction for thorough investigations.

I have been working with it for several weeks.

Occasionally, when I click on a link, I receive a page error, and after a few refreshes, it starts working again. I'm unsure whether the issue lies on my side or theirs, and we need to identify the cause. It's worth noting that this happens infrequently, and the rest of the system operates smoothly without any errors.

The solution scales well, supports network traffic analysis in the cloud. Of course, it is limited due to the limitations of the cloud itself. The servers are very powerful. For example, a 1U server can handle 25 Gbps of traffic. When there are solutions that require 2 2U servers for such performance.

We used LogRhythm NetMon, but it had reached its life cycle and had basic functionality.

The initial setup was straightforward.

The implementation process was swift, taking only an hour. After receiving sign-up emails, I completed a questionnaire, discussed the architecture, and a dedicated environment with the correct naming was promptly set up. Upon receiving an invitation, I set a password, and enabled Multi-Factor Authentication, gaining full access to the client environment. A server arrived via post, and following documentation instructions, I installed it in our data center, handling all cabling. During a call with a technical engineer, we configured the server together, initiating data transmission to the cloud environment. In the cloud, I easily customized settings and added users and the essential setup was complete.

The pricing is dependent on the network size, typically falling into the six-digit range. When compared to other solutions, it aligns with the market average, indicating a competitive pricing level.

Yes. LogRhythm NDR and DarkTrace.

I recommend prioritizing demos over POCs when engaging with vendors. Organizing POCs involves significant time and resource investments for both parties. Instead, invest time in multiple demo sessions, exploring the product in various scenarios and comparing capabilities against a predefined list of success criteria. Create a detailed success criteria list initially. Identify a top vendor based on these criteria, saving time and resources. Overall, I would rate it nine out of ten.

The solution is primarily used for network detection and response. We collect network traffic with it.

We can use the solution for detection, which is quite helpful. We can see if some port is connected that shouldn't be. There's machine learning that helps with detection. 

The initial setup is very easy.

It is scalable.

The solution is very stable. 

There needs to be more support.

We'd like to see more protocols. There are some basic protocols, however, there needs to be more. 

I've used the solution for one and a half years. 

It's very stable. There are no bugs or glitches. It doesn't crash or freeze. You don't need to upgrade in order to get better performance. 

The solution is scalable. It's easy to expand the storage of the cloud as needed. Of course, it will cost extra if you expand.

We have 200 to 300 people using the solution. 

I haven't directly dealt with technical support. We just use the solution to detect and respond and reach out to the client if we see anything. The solution does seem to need more support in general. 

The solution is straightforward to implement. It's on the cloud, which makes it simple. We just send the traffic to the cloud.

It took about two to three days to have everything implemented. 

Before deployment, we just customized some desktops to provide more security. 

The licensing is paid annually. 

If a company wants to build a security operations center, this solution may help. 

I'd rate the solution eight out of ten. 

It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic.

It is also easy to handle and easy to understand.

They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers. 

I am a distributor. One of our customers started to use ExtraHop Reveal(X) Cloud three years ago. They are very satisfied with this product. They bought another one this year.

We have one more customer who bought this solution five years ago. They already have a very good impression of this solution. 

It is scalable. It is five times more scalable than other competitors like Riverbed. 

Their technical support is more effective and of better quality than other competitors. They have more people for service and distribution. 

Their professional service can be improved. Service is essential for customers.

It is easy to install and implement.

In Korea, game companies, telecom companies, and retail companies usually use cloud deployment. The finance and manufacturing companies use on-premises deployment.

Korean customers have a nice impression of this product. ExtraHop is a leading vendor in Korea. It may be number one in the Network Purpose Monitoring (NPM) market in Korea. They, however, are not a large cloud company. They don't have enterprise customers. They also don't have a large customer base in the cloud environment in countries like the USA. 

I would recommend this solution. ExtraHop is a technical company. ExtraHop CEO, CMO, and CTO are technical people. They are oriented towards technology and are developing their product features for customers. They have very good skills in providing product functionality to customers.

I would rate ExtraHop Reveal(X) Cloud an eight out of ten.