No more typing reviews! Try our Samantha, our new voice AI agent.

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Weekly security reports summarize daily network events, highlighting potential threats and advising on remediation strategies.
Real-time alerts for user lockouts and invalid password attempts enhance IT department responsiveness.
Netsurion satisfies compliance requirements by centralizing the storage of all security event data, which is essential for auditing.
The Managed Threat Protection includes the MITRE ATT&CK Framework, recognized as an industry standard for evaluating threats.
Netsurion's 24/7 monitoring provides actionable threat intelligence, enhancing company security by detecting and preventing malicious activities.

CONS

The deployment of agents poses challenges, often leading to agents quitting or requiring redeployment.
There are issues with long search times, especially when looking back beyond 30 days, even with improvements in version 9 requiring a solid-state hard drive.
Too many domain controllers complicate updates and firewall management.
Agents on endpoints frequently fail, needing manual intervention from local administrators.
System requirements are high, demanding powerful servers that impact on-premise components.
 

Netsurion Pros review quotes

John-Berry - PeerSpot reviewer
Information Technology Manager at ProfitSolv
Sep 11, 2023
Netsurion has its own security operations center, where it tracks information that comes across our telemetry.
Kevin Lohan - PeerSpot reviewer
Head of IT at a venture capital & private equity firm with 11-50 employees
Aug 22, 2023
The most valuable feature is definitely real-time alerting, especially in situations where someone might attempt to exploit or hack into our network.
JD
Manager of Security and Networking at Shenandoah Valley Electric Cooperative
Aug 24, 2023
What I like most about Netsurion is the level of visibility and reporting.
Learn what your peers think about Netsurion. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
893,221 professionals have used our research since 2012.
JosephSnyder - PeerSpot reviewer
CIO at a financial services firm with 201-500 employees
Aug 23, 2023
Expediting incident response is really great.
reviewer2273475 - PeerSpot reviewer
CIO at a computer software company with 501-1,000 employees
Sep 8, 2023
They have a number of integrations with different products. Google Workspace is one of them, and Microsoft Azure is another one. They integrate with a number of other things, such as Duo for multi-factor authentication. They can pull the logs from Duo to see if users are coming from bad repeatable IPs or if there are malicious known IPs that may be popping up in the logs. They are able to see that, and they can identify that. Some of the other integrations they do are from inside your network. For firewalls, they can integrate with SonicWall, Cisco, Fortinet, etc. They have a pretty wide variety of things to integrate with and be able to pull the logins from those devices.
reviewer1717125 - PeerSpot reviewer
Cyber Security Specialist at a financial services firm with 11-50 employees
Nov 16, 2021
I think Netsurion scales well. We've gone from a small number of agents up to thousands. So I would imagine that it would continue to scale. I don't see any issue with that.
RC
VP of IT Systems at Carteret-Craven Electric Cooperative
Nov 16, 2021
When I looked last week, we probably averaged about 20 million log entries a day. So, we certainly can't individually manage that. Just looking at the reports, then trying to go back and find anything that was questionable, was a challenge. Therefore, the managed service has been invaluable to us in terms of being able to narrow the scope of what really needs to be looked at and bringing those things to our attention to be dealt with.
Gene Anderson - PeerSpot reviewer
IT Coordinator at a government with 51-200 employees
Jan 16, 2022
We don't have the eyeballs available to stare and watch for things, or even have the capability of building internal alert systems. So, the managed SOC has been huge for freeing up staff to work on other responsibilities. We are saving on at least one full-time employee.
it_user1738380 - PeerSpot reviewer
Network Engineer at a wholesaler/distributor with 201-500 employees
Dec 9, 2021
When it comes to threat detection and response, it does a very good job detecting and blocking on its own. And the SOC is a nice added value because they're doing analysis on things that aren't as obvious, on things that you can't just detect with a signature or behavior. Also, any SIEM will come with a lot of noise, so having them do a lot of the initial analysis to find out what's critical and what issues are false alarms is very good.
BS
IT Director at Global Connections Inc
Dec 7, 2021
Netsurion was easy to deploy. I have worked with other systems that were a little less complex, but they weren't quite as easy to deploy.
 

Netsurion Cons review quotes

John-Berry - PeerSpot reviewer
Information Technology Manager at ProfitSolv
Sep 11, 2023
Netsurion's SOC can be a bit too aggressive at times.
Kevin Lohan - PeerSpot reviewer
Head of IT at a venture capital & private equity firm with 11-50 employees
Aug 22, 2023
I would also like to have a dashboard that I can access anytime to review the real-time data from their website.
JD
Manager of Security and Networking at Shenandoah Valley Electric Cooperative
Aug 24, 2023
There's always room to improve because there would be no competition if they had a perfect solution. The GUI to perform searches within the product may not be intuitive to a new user.
Learn what your peers think about Netsurion. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
893,221 professionals have used our research since 2012.
JosephSnyder - PeerSpot reviewer
CIO at a financial services firm with 201-500 employees
Aug 23, 2023
The system requirements are very, very high. So I need a pretty powerful server to run. If they could lighten that load so that the on-premise part of their product didn't impact my systems as much that would be ideal.
reviewer2273475 - PeerSpot reviewer
CIO at a computer software company with 501-1,000 employees
Sep 8, 2023
They have their programs and tools that you have to put into your own environment. We basically ingest all the log data and then push it out to them. I wish it was a little bit different than that where we just push directly towards them. I do not know if that is a function that they thought would be better in terms of security, but I wish that instead of doing that, it should go from the device to them and not from the device to another system and then out to them. There seem to be some drawbacks to doing that.
reviewer1717125 - PeerSpot reviewer
Cyber Security Specialist at a financial services firm with 11-50 employees
Nov 16, 2021
The agents on the endpoints seem to fail quite a bit, requiring manual involvement from the local administrators. I would like to see their product be much more ad hoc and update automatically.
RC
VP of IT Systems at Carteret-Craven Electric Cooperative
Nov 16, 2021
I would like to see a faster response when we see things like 15,000 lockouts. I really wished that I had known that on Friday afternoon rather than waiting until I got the weekly report today. By the same token, they are looking at it from the point of view that this is a system or software malfunction. This is not a bad actor repeating the exact same password three times a second. Therefore, they can tell that this is not a bad thing. However, it's not a security event but it is an operational event for me. Knowing this sort of thing would help my team and me out more because then we would be able to clear out a lot of network traffic that we didn't know was going on. So, we would like quicker updates on non-high security events.
Gene Anderson - PeerSpot reviewer
IT Coordinator at a government with 51-200 employees
Jan 16, 2022
The threat detection and response is passive. We have asked if there were options for taking action, and we have not gotten any feedback on that, which would be useful to know. Depending on the situation and threat, some actions may not be possible, but we haven't gotten any feedback on what options could be directed and actionable with the understanding that it may have an extra cost. It would be nice to know or find out if it is actually possible to take actions by a SIEM service or a SIEM agent.
it_user1738380 - PeerSpot reviewer
Network Engineer at a wholesaler/distributor with 201-500 employees
Dec 9, 2021
Everything that I've wanted has been added in. EDR was added, and MITRE was added. Those were two big ones that we didn't even have to push for.
BS
IT Director at Global Connections Inc
Dec 7, 2021
We get a report generated on a particular day of the week and we go through it, trying to mitigate problems and make sure we're seeing everything that's happening. It would be helpful if the SOC spent a little more time with us going through some of those reports.