Try our new research platform with insights from 80,000+ expert users

NetWitness NDR vs Rapid7 InsightIDR comparison

NetWitness and Rapid7 are both solutions in the Endpoint Detection and Response (EDR) category. NetWitness is ranked #61, while Rapid7 is ranked #26 with an average rating of 8.1. NetWitness holds a 0.4% mindshare in EDR, compared to Rapid7’s 1.2% mindshare. Additionally, 87% of NetWitness users are willing to recommend the solution, compared to 95% of Rapid7 users who would recommend it.
NetWitness NDR
Read 15 NetWitness NDR reviews
  • 1,789 Views
  • 644 Comparison Views
87% willing to recommend
Rapid7 InsightIDR
Read 32 Rapid7 InsightIDR reviews
  • 7,366 Views
  • 1,842 Comparison Views
95% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Sep 9, 2024

NetWitness NDR and Rapid7 InsightIDR are two leading NDR solutions. Rapid7 InsightIDR consistently outperforms NetWitness NDR in terms of overall features, ease of deployment, and return on investment.

Features: NetWitness NDR has advanced threat detection, incident response capabilities, and data enrichment features. Rapid7 InsightIDR offers integrated response automation, user behavior analytics, and asset discovery capabilities.

Room for Improvement: NetWitness NDR users cite complicated setup, need for extensive training, and high setup costs. Rapid7 InsightIDR users desire enhanced customization, more frequent updates, and better documentation.

Ease of Deployment and Customer Service: NetWitness NDR requires a complex deployment process and substantial technical expertise. Rapid7 InsightIDR has comparatively straightforward deployment, strong customer support, and detailed documentation.

Pricing and ROI: NetWitness NDR users feel the setup costs are high with moderate ROI. Rapid7 InsightIDR is viewed as cost-effective with better ROI due to comprehensive features and less resource-intensive deployment.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed NetWitness NDR vs. Rapid7 InsightIDR Report (Updated: July 2025).
Buyer's Guide
NetWitness NDR vs. Rapid7 InsightIDR
July 2025
Download the complete report
Helped 865,295 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness NDR
Ranking in Endpoint Detection and Response (EDR)
61st
Ranking in Extended Detection and Response (XDR)
39th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Threat Intelligence Platforms (40th), Security Orchestration Automation and Response (SOAR) (25th), Network Detection and Response (NDR) (19th)
Rapid7 InsightIDR
Ranking in Endpoint Detection and Response (EDR)
26th
Ranking in Extended Detection and Response (XDR)
17th
Average Rating
8.4
Reviews Sentiment
7.4
Number of Reviews
32
Ranking in other categories
Security Information and Event Management (SIEM) (14th), User Entity Behavior Analytics (UEBA) (5th), Threat Deception Platforms (5th)
 

Mindshare comparison

As of August 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of NetWitness NDR is 0.4%, up from 0.3% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.2%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR)
 

Featured Reviews

SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.
Read full review
Asim Naeem - PeerSpot reviewer
Providing comprehensive insight into alerts while working towards AI enhancement
I definitely recommend Rapid7 InsightIDR. It is becoming better, with improvements being continuously made to the product. Right now, I do not have any advice about Rapid7 for other users because every organization or user has different criteria or multiple use cases, so I refrain from commenting on that. I rate the overall solution seven out of ten.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is stable. We have been using it for some time, without any issues."
"The stability of the RSA NetWitness Endpoint is very good."
"Technical support is knowledgeable."
"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."
"Ability to isolate the machine when there are malicious files."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"The interface of this solution is very flexible and easy to use."
"It is very easy to use, and its usability is great. The use cases are also very easy. The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great."
More NetWitness NDR pros
"The log aggregation and storage provided by InsightIDR has shown no issues with scalability; aggregating over one hundred millions events daily."
"Features for user behavior analytics and the rules for attack review are good."
"Rapid7 InsightIDR integrates well with other solutions. It's also easy to configure because Rapid7 InsightIDR has a lot of instructions posted on their website that customers can follow if they need to get the source log."
"The technical support is a solid 10 out of 10 as they take the time to answer any questions or problems which may arise in a reasonable time frame."
"I like the tool's user analysis feature."
"The solution is easy to use, and the interface is intuitive."
"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."
"Simple configuration and automatically syncs to the cloud platform."
More Rapid7 InsightIDR pros
 

Cons

"RSA NetWitness Network could improve on integration with non-native application integration."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
"The initial setup requires a high level of skill."
"Threat detection could be better."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."
More NetWitness NDR cons
"There are certain limitations with Rapid7 that I am working on."
"The ability to tune the collector for custom logs would greatly help."
"I would like to see more development in InsightIDR towards building their SIEM solution and converting it to XDR."
"InsightIDR is only available in a cloud version. Some of our customers prefer an on-prem solution because they want to manage the security within their environment."
"Lacks a mobile application."
"One of the things that could be better is digital forensics. It is there, but it can be better. They could provide more on the endpoint detection level."
"The product allows us to make only 30 custom rules."
"One thing that springs to mind is easier API integration with ITSMs. We are evaluating a new ITSM and I would like to have InsightIDR create a ticket when an attack is identified, and the ticket would be closed in InsightIDR when the ITSM resolution is completed. This would take out the "single point of failure" we currently have, if the email recipient is somehow absent, in recording the risk appetite for the incident and the actions taken to mitigate or not."
More Rapid7 InsightIDR cons
 

Pricing and Cost Advice

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"I do not have any opinion on the pricing or licensing of the product."
"We are on a three-year contract to use RSA NetWitness Network."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
"It is highly scalable. It can be bought based on your requirements."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
More NetWitness NDR pricing and cost advice
"It is more reasonably priced than other vendors."
"The solution has a mid-range price point in the market"
"Rapid7 InsightIDR's pricing is reasonable."
"Rapid7 InsightIDR charges us based on the endpoints we connect to."
"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."
"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."
More Rapid7 InsightIDR pricing and cost advice
report
See which vendors are best for you
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
See recommendations
865,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
10%
Government
7%
Computer Software Company
15%
Manufacturing Company
8%
Financial Services Firm
7%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Ask a question
Earn 20 points
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
See all answers
What do you like most about Rapid7 InsightIDR?
During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an applicati...
See all answers
What is your experience regarding pricing and costs for Rapid7 InsightIDR?
The product pricing is very cheap.
See all answers
 

Comparisons

Darktrace vs NetWitness NDR Logo
Darktrace vs NetWitness NDR
Compared 13% of the time
Fidelis Elevate vs NetWitness NDR Logo
Fidelis Elevate vs NetWitness NDR
Compared 9% of the time
Vectra AI vs NetWitness NDR Logo
Vectra AI vs NetWitness NDR
Compared 7% of the time
Cortex XDR by Palo Alto Networks vs NetWitness NDR Logo
Cortex XDR by Palo Alto Networks vs NetWitness NDR
Compared 7% of the time
ExtraHop Reveal(x) vs NetWitness NDR Logo
ExtraHop Reveal(x) vs NetWitness NDR
Compared 7% of the time
More NetWitness NDR Competitors
Darktrace vs Rapid7 InsightIDR Logo
Darktrace vs Rapid7 InsightIDR
Compared 9% of the time
Microsoft Sentinel vs Rapid7 InsightIDR Logo
Microsoft Sentinel vs Rapid7 InsightIDR
Compared 8% of the time
Rapid7 InsightVM vs Rapid7 InsightIDR Logo
Rapid7 InsightVM vs Rapid7 InsightIDR
Compared 7% of the time
CrowdStrike Falcon vs Rapid7 InsightIDR Logo
CrowdStrike Falcon vs Rapid7 InsightIDR
Compared 5% of the time
Splunk Enterprise Security vs Rapid7 InsightIDR Logo
Splunk Enterprise Security vs Rapid7 InsightIDR
Compared 5% of the time
More Rapid7 InsightIDR Competitors
 

Product Reports

Buyer's Guide
NetWitness NDR
August 2025
NetWitness NDR reportDownload NetWitness NDR product report
Buyer's Guide
Rapid7 InsightIDR
August 2025
Rapid7 InsightIDR reportDownload Rapid7 InsightIDR product report
 

Also Known As

RSA ECAT, NetWitness Network
InsightIDR
 

Overview

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

NetWitness

Parsing hundreds of trivial alerts. Managing a mountain of data. Manually forwarding info from your endpoints. Forget that. InsightIDR instantly arms you with the insight you need to make better decisions across the incident detection and response lifecycle, faster.

Rapid7
 

Sample Customers

ADP, Ameritas, Partners Healthcare
Liberty Wines, Pioneer Telephone, Visier
Buyer's Guide
NetWitness NDR vs. Rapid7 InsightIDR
July 2025
Free Report: NetWitness NDR vs. Rapid7 InsightIDR
Find out what your peers are saying about NetWitness NDR vs. Rapid7 InsightIDR and other solutions. Updated: July 2025.
DOWNLOAD NOW
865,295 professionals have used our research since 2012.
See our NetWitness NDR vs. Rapid7 InsightIDR report.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.