Fortinet FortiSandbox vs Trellix Network Detection and Response comparison

Fortinet FortiSandbox vs. Trellix Network Detection and Response

Download the complete report

Helped 845,040 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Fortinet FortiSandbox

Ranking in Advanced Threat Protection (ATP)

4th

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Threat Deception Platforms (7th)

Trellix Network Detection a...

Ranking in Advanced Threat Protection (ATP)

14th

Average Rating

8.4

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Network Detection and Response (NDR) (12th)

Mindshare comparison

As of April 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Fortinet FortiSandbox is 10.7%, up from 8.4% compared to the previous year. The mindshare of Trellix Network Detection and Response is 4.8%, down from 4.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Advanced Threat Protection (ATP)

Featured Reviews

Kiarash Heydari

Information security manager at asa com

Light and powerful solution design; useful to have

My impression is that the initial setup process is quite straightforward. If you know what you're using it for, the initial setup can be quite easy and the solution is not that hard to use. When it comes to the steps taken for the implementation, you would select the OS you're using and when the files are sent to the appliance you check, and in the appliance configuration, it must be like the visual governance environment. You must set up the OS you have so that appliance can scan or analyze your file. To maintain this solution, you must always have at least one all-around person tuning this solution.

Read full review

BiswabhanuPanda

Senior technical consultant at Hitachi Systems Micro Clinic

Offers in-depth investigation capabilities, integrates well and smoothly transitioned from a lower-capacity appliance to a higher one

The in-depth investigation capabilities are a major advantage. When the system flags something as malicious, it provides a packet capture of that activity within the environment. That helps my team quickly identify additional context that most other tools wouldn't offer – like source IP or base64 encoded data. We can also see DNS requests and other details that aren't readily available in solutions like Check Point or others that we've tried. The detection itself is solid, and their sandboxing is powerful. There's a learning curve – you need a strong grasp of OS-level changes, process forking, registry changes, and the potential impact of those. But with that knowledge, the level of information Trellix provides is far greater than what we've seen elsewhere. The real-time response capability of Trellix has been quite effective, although it's not very fast. The key is this solution's concept of 'preference zero.' They don't immediately act on a zero-day. For example, the solution has seen a piece of malware for the first time. It'll let it in, then do sandboxing. Maybe after four or five minutes, it identifies that specific file's DNX Secure Store as malicious. At that point, they update the static analysis engine, and it gets detected if anything else tries to download the same file. There is that initial 'preference zero' concept, like with Panda. You may not hold traffic in the network. That's standard in the industry; we don't do much about it. To address that, we also have endpoint solutions. We use SentinelOne in our environment, which helps us identify threats like Western Bureaus and others.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Integration is one of the solution's most valuable aspects. You can integrate even third-party solutions so that they can send the information or files they quarantine through the FortiSandbox"

"The most valuable feature is the protection and the way it works, the technology is what I like the most."

"The most valuable features of Fortinet FortiSandbox are the analysis options, artificial intelligence, and the many interfaces it provides."

"The most valuable features of Fortinet FortiSandbox are customization, ICAP protocol, and integration with other vendors. Additionally, the security work very well."

"Performance is a valuable feature."

"The scanner office document as well as PDF are useful. The most valuable thing is that you can emulate different operating systems without having the danger of getting something infected. It emulates several operating systems, and as a result, you either get the file or you don't get the file."

"The product is great. It can be deployed on the cloud or on-premises."

"The main benefit of Fortinet FortiSandbox is that it allows organizations to detect and prevent unknown threats from entering an infrastructure."

More Fortinet FortiSandbox pros

"If we are receiving spam emails, or other types of malicious email coming from a particular email ID, then we are able to block them using this solution."

"The scalability has not been a problem. We have deployed the product in very high bandwidth networks. We have never had a problem with the FireEye product causing latency issues within our networks."

"The product is very easy to configure."

"The installation phase was easy."

"Initially, we didn't have much visibility around what is occurring at our applications lower level. For instance, if we are exposed to any malicious attacks or SQL injections. But now we've integrated FireEye with Splunk, so now we get lots of triggers based on policy content associated with FireEye. The solution has allowed for growth and improvement in our information security and security operations teams."

"The MVX Engine seems to be very capable against threats and the way it handles APTs is impressive."

"The sandbox feature of FireEye Network Security is very good. The operating system itself has many features and it supports our design."

"Its ability to find zero-day threats, malware and anything malicious has greatly improved my customer's organization, especially for protecting the users' browser."

More Trellix Network Detection and Response pros

Cons

"Most people are confused about how to use the right integration of the right Fortinet product."

"There could be more templates and a higher number of simulated VMs to configure more use cases. Sometimes we need to configure many use cases in many different environments, and if the number of VMs that we configure is limited, we have to remove some and reconfigure the environment if we need another environment."

"At least once a week we have a false alarm. This needs to be adjusted so that we get fewer of these occurrences."

"It should be easier to import custom virtual machines. Some of the VMs that are in FortiSandbox don't have the applications that we have in our environment. We need to import a VM with specific applications that we use in our environment. Have all the licenses because this is a real environment. You need a license for the Windows client you run on it. It's possible to import custom VMs, but it's a pain to do it. I would like a tool that simplifies the process."

"In the next release, I would like to see machine learning and anti-exploitation included."

"It would be better if it had support for Mac and Linux."

"The delivery feature in my country is extremely bad."

"The reporting tools could be improved in Fortinet FortiSandbox."

More Fortinet FortiSandbox cons

"Stability issues manifested in terms of throughput maximization."

"A better depth of view, being able to see deeper into the management process, is what I'd like to see."

"It would be great if we could create granular reports based on the protocols, types of attacks, regions of attack, etc. Also we would like to easily be able to add exceptions to rules in cases of false positives."

"It is very expensive, the price could be better."

"There is a lot of room for Improvement in the offering, from cost to functionality. It is pretty straightforward to implement which is an advantage. However, it falls short in pricing, detection capabilities, and, most importantly, reporting and policy management."

"It is not a very secure product."

"The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would help in network detection response."

"The analytics could be better. It seems heavily influenced by the McAfee and FireEye integration, and that integration still isn't seamless."

More Trellix Network Detection and Response cons

Pricing and Cost Advice

"The price is competitive."

"There are no costs in addition to the standard licensing fees."

"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."

"The price of Fortinet FortiSandbox is expensive."

"It is an expensive solution."

"There is a license to use this solution."

"I rate the product's pricing a five or six on a scale of one to ten, where one is low, and ten is high."

"There are additional costs, which isn't included in the licensing fee."

More Fortinet FortiSandbox pricing and cost advice

"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."

"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."

"When I compare this solution to its competitors in the market, I find that it is a little expensive."

"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."

"It's an expensive solution."

"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."

"Because of what the FireEye product does, it has significantly decreased our mean time in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the meantime to analysis decrease by at least tenfold."

"The pricing is a little high."

More Trellix Network Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.

See recommendations

845,040 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Government

13%

Computer Software Company

11%

Financial Services Firm

10%

Manufacturing Company

Financial Services Firm

17%

Comms Service Provider

11%

Computer Software Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Fortinet FortiSandbox?

The real-time analysis capability of FortiSandbox is beneficial for email analysis.

What is your experience regarding pricing and costs for Fortinet FortiSandbox?

I think it's affordable. For the six to seven months of usage, the cost has been reasonable.

What needs improvement with Fortinet FortiSandbox?

We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, ...

What do you like most about FireEye Network Security?

We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. With Trellix, we easily confirmed that there was no lateral network involvement an...

What is your experience regarding pricing and costs for FireEye Network Security?

While I do not handle pricing directly, it is known that there is a variety of customers with different licensing needs, which depends on the organization's size and policy.

What needs improvement with FireEye Network Security?

The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would help in network detection response. Networking often involves complexity that c...

Palo Alto Networks WildFire vs Fortinet FortiSandbox

Comparisons

Compared 42% of the time

Check Point SandBlast Network vs Fortinet FortiSandbox

Compared 15% of the time

Microsoft Defender for Office 365 vs Fortinet FortiSandbox

Compared 7% of the time

Trend Micro Deep Discovery vs Fortinet FortiSandbox

Compared 5% of the time

Fortinet FortiEDR vs Fortinet FortiSandbox

Compared 5% of the time

More Fortinet FortiSandbox Competitors

Palo Alto Networks WildFire vs Trellix Network Detection and Response

Compared 16% of the time

Darktrace vs Trellix Network Detection and Response

Compared 9% of the time

Trend Micro Deep Discovery vs Trellix Network Detection and Response

Compared 7% of the time

Vectra AI vs Trellix Network Detection and Response

Compared 7% of the time

Zscaler Internet Access vs Trellix Network Detection and Response

Compared 7% of the time

More Trellix Network Detection and Response Competitors

Product Reports

Fortinet FortiSandbox

Download Fortinet FortiSandbox product report

Trellix Network Detection and Response

Download Trellix Network Detection and Response product report

Trellix Network Detection and Response report

Also Known As

FortiSandbox

FireEye Network Security, FireEye

Overview

Fortinet FortiSandbox is a behavior-based threat detection solution that prevents and detects malicious code in files transferred within the organization. It is integrated with FortiGate firewalls and FortiMail for threat protection and can be used for monitoring and reporting. The solution inspects files in a virtual environment with different types of virtual machines and can block or quarantine files based on their score.

The most valuable features include dynamic behavior analysis, manual scan features, easy management and configuration, fast scanning, scalability, customization, and ICAP protocol. The solution is cost-effective and faster than other sandbox solutions, with a good user interface.

Fortinet

Detect the undetectable and stop evasive attacks. Trellix Network Detection and Response (NDR) helps your team focus on real attacks, contain intrusions with speed and intelligence, and eliminate your cybersecurity weak points.

Trellix

Sample Customers

Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG

FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems

Fortinet FortiSandbox vs. Trellix Network Detection and Response