Try our new research platform with insights from 80,000+ expert users

Cisco Secure IPS (NGIPS) vs Vectra AI comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 19, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco Secure IPS (NGIPS)
Ranking in Intrusion Detection and Prevention Software (IDPS)
6th
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
66
Ranking in other categories
No ranking in other categories
Vectra AI
Ranking in Intrusion Detection and Prevention Software (IDPS)
2nd
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
44
Ranking in other categories
Network Detection and Response (NDR) (2nd), Extended Detection and Response (XDR) (9th), Identity Threat Detection and Response (ITDR) (5th), AI-Powered Cybersecurity Platforms (5th)
 

Mindshare comparison

As of February 2025, in the Intrusion Detection and Prevention Software (IDPS) category, the mindshare of Cisco Secure IPS (NGIPS) is 4.2%, down from 4.6% compared to the previous year. The mindshare of Vectra AI is 11.8%, up from 10.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Intrusion Detection and Prevention Software (IDPS)
 

Featured Reviews

YoussefBoukari - PeerSpot reviewer
Very effective for malware and signature-based anomalies but stability needs improvement
Our company uses the solution for data functions in banking. It is a backend solution in the server center.  We analyze traffic and adapt configurations or customize policies to the environment of the IPS itself.  The solution very effectively provides malware protection and signature-based…
Mohammad Alkurdi - PeerSpot reviewer
Innovative detection features enhance monitoring
The advantages of the integration are not entirely out-of-the-box. You have to do it manually. When I'm doing tier response, an out-of-the-box solution is not available. You need to have a Linux server, and from the Linux server, you must perform AI tasks, and there is a lot to be handled in the back end. This is a major consideration about them. The recall feature, if it can be placed in some areas instead of the cloud, and charged for, would be better. Recall the storage where you watch all the traffic, and you can recall it and try to analyze it in the back end. It’s cloud-based. If they offer it on-prem, it would be better. I think they have a solution, but I have never tested it, to be honest with you.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The product's initial setup phase was easy."
"The solution very effectively provides malware protection and signature-based anomaly detection."
"Cisco has many products that are easily integrated with other services."
"We primarily use this solution as an application filter and for IPS."
"The top features of Cisco NGIPS, which have been working very well, include stateful inspection and the access list-based security configuration. But from my perspective, the best part of Cisco NGIPS is the licensing process, which is very easy and straightforward. It's essentially copy-paste licensing."
"The initial setup wasn't complex or complicated."
"I think their fingerprints are good in terms of how they whitelist and blacklist."
"It is more or less stable. Sometimes I have some issues normally when we need to upgrade it to newer versions. I think it does the job."
"It does a reliable job of parsing out the logs of all the network traffic so that we can ingest them into our SIEM and utilize them for threat hunting and case investigations. It is pretty robust and reliable. The administration time that we spend maintaining it or troubleshooting it is very low. So, the labor hour overhead is probably our largest benefit from it. We spend 99% of our time in Vectra investigating cases, responding to incidents, or hunting, and only around 1% of our time is spent patching, troubleshooting, or doing anything else. That's our largest benefit from Vectra."
"Some valuable features of Vectra AI are that it is very intuitive and that there are only a small amount of false positives. Therefore, it's an effective solution."
"One of the core features is that Vectra AI triages threats and correlates them with compromised host devices. From a visibility perspective, we can better track the threat across the network. Instead of us potentially finding one device that has been impacted without Vectra AI, it will give us the visibility of everywhere that threat went. Therefore, visibility has increased for us."
"We discovered a lot of things in our network and are correcting several misconfigurations. We are learning how some apps work together and how some things shouldn't happen. It's also easier for us to identify the source of a brute force, whereas before, we didn't even know we had a brute force."
"The core product provides excellent visibility, but my favorite feature is Vectra Recall."
"It's important for us that the user interface is easy to understand and that is the biggest benefit we see from Vectra AI."
"It provides various dashboards that facilitate the identification of connections and can detect data exfiltration, meaning data sent from your environment to another."
"Cognito Streams gives you a detailed view of what happens in the network in the form of rich metadata. It is just a super easy way to capture network traffic for important protocols, giving us an advantage. This is very helpful on a day-to-day basis."
 

Cons

"The price is a little high. It's hard to find solutions that are easy on the budget and strike a balance between affordability and features."
"The initial setup is a bit complex because it requires a lot of configuration, firewall and zoning."
"It is no longer scalable because it has gone end of life."
"The file trajectory, the trace in contamination files, could be improved."
"It has room for improvement when it comes to integrating machine learning and AI into it where even if you don't have a baseline that is of length for anomaly detection, it could do more like an AI style machine learning. It learns on its own."
"Multi-internet line load balancing should be supported."
"I would recommend this solution to others for medium, large, and enterprise businesses only."
"Cisco NGIPS could improve its ability to do SSL inspections. Sometimes the ability to do SSL inspection is not scalable and you might not be able to get the installment required if you don't size the right hardware."
"Vectra is still limited to packet management. It's only monitoring packet exchanges. While it can see a lot of things, it can't see everything, depending on where it's deployed. It has its limits and that's why I still have my SIEM."
"One of the things I am not so happy about when it comes to Vectra is the scoring board."
"You are always limited with visibility on the host due to the fact that it is a network based tool. It gives you visibility on certain elements of the attack path, but it doesn't necessarily give you visibility on everything. Specifically, the initial intrusion side of things that doesn't necessarily see the initial compromise. It doesn't see stuff that goes on the host, such as where scripts are run. Even though you are seeing traffic, it doesn't necessarily see the malicious payload. Therefore, it's very difficult for it to identify these type of host-driven complex attacks."
"I would like to see data processed onshore. Right now, the cloud components, like Office 365, must be processed on servers outside of Australia. I would like to see a future adoption of onshore processing."
"The solution has not reduced the security analyst workload in our organization because we still need to SIEM. Unfortunately, while Vectra, for us, is a brilliant tool for network investigations, giving wonderful visibility, it doesn't go the whole way to replace our SIEM that is needed for compliance. So, I still have the same amount of alerting and logging that I did before. It gives us more defined ability to see incidents, but it doesn't give us enough information to satisfy a PCI or 27001 audit."
"The solution needs to become more proactive. When Vectra AI is the primary solution in an environment - like it is in our case - you must work on response time. We have a small team so response time at endpoint level is vital."
"We are using SMB 3.0, which is an encrypted protocol. When we get some alerts or something, we cannot go deep into the protocol to see what's wrong because it's encrypted. We need to decrypt the protocol in another way, which is quite difficult. We might go back to SMB 2.0 just for this reason, but that's not a good solution."
"A blind spot that I have is around the ease with which you can automate threat intervention."
 

Pricing and Cost Advice

"The licensing can be billed annually or in multi-year contracts such as three, four, or five years."
"Cisco products are always expensive, but if you can afford the price then it's a great solution."
"The tool's licensing costs are yearly."
"There is a license required to use Cisco NGIPS and it can be a one or three-year license."
"NGIPS is expensive."
"The price for additional throughput is the highest in the industry."
"The annual licensing tends to be expensive, but in terms of implementing the licenses, it's a very uncomplicated process and as easy as copy-paste in its straightforwardness."
"This is an expensive product, with the biggest cost being the license that keeps the service going."
"There are additional features that can be purchased in addition to the standard licensing fee, such as Cognito Recall and Stream."
"Vectra AI's pricing is cheaper than that of Darktrace."
"Vectra is a bit on the higher side in terms of price, but they have always been transparent. The reason that they are this good is that they invest, so they need to charge accordingly."
"The pricing is very good. It's less expensive than many of the tools out there."
"Vectra's licensing model could scale to our research network, which has multiple, 100-gigabit links."
"The pricing is high."
"The license is based on the concurrent IP addresses that it's investigating. We have 9,800 to 10,000 IP addresses."
"The pricing and licensing are quite straightforward because they're based on the IP licenses. As a result, they are easy to count."
report
Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.
838,640 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
University
12%
Financial Services Firm
9%
Educational Organization
8%
Computer Software Company
15%
Financial Services Firm
13%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Cisco NGIPS?
The product's initial setup phase was easy.
What needs improvement with Cisco NGIPS?
The dashboard is quite old compared to today's technology. We would like to see improvements in the dashboard features.
What is the biggest difference between Corelight and Vectra AI?
The two platforms take a fundamentally different approach to NDR. Corelight is limited to use cases that require the eventual forwarding of events and parsed data logs to a security team’s SIEM or ...
What do you like most about Vectra AI?
The solution is currently used as a central threat detection and response system.
What is your experience regarding pricing and costs for Vectra AI?
It is very acceptable when you compare it with Darktrace, for example.
 

Also Known As

Sourcefire NGIPS, Firepower NGIPS
Vectra Networks, Vectra AI NDR
 

Overview

 

Sample Customers

American Electric Power, Huntington Bank, Keycorp, Nationwide, Transunion, Marriott, Inova Health, Ford, Thomson Reuters, Dow Chemical, Equifax, Chevron, Walmart, Coca Cola
Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association
Find out what your peers are saying about Cisco Secure IPS (NGIPS) vs. Vectra AI and other solutions. Updated: January 2025.
838,640 professionals have used our research since 2012.