ExtraHop Reviews, Ratings & Features 2026 | Gartner Peer Insights

Gartner defines network detection and response (NDR) as products that detect abnormal network behaviors by applying behavioral analytics to network traffic data. NDR products continuously analyze raw network packets or traffic metadata within internal networks (east-west) and between internal and external networks (north-south). They include automated responses, such as host containment or traffic blocking, implemented directly or through integration with other cybersecurity products. Vendors deliver NDR as hardware or software appliances for sensors, with some supporting IaaS environments. Management and orchestration consoles are available as software or SaaS. Organizations rely on NDR to detect and contain postbreach activities such as ransomware, insider threats and lateral movements. NDR complements other technologies that primarily trigger alerts based on rules and signatures by building heuristic models of normal network behavior and detecting anomalies. Security teams commonly use NDR as a complementary detection and response technology within a broader set of security operations center (SOC) tools. These include security orchestration, automation and response (SOAR), security information and event management (SIEM), endpoint detection and response (EDR), and other detection technologies.
These include security orchestration, automation and response (SOAR), security information and event management (SIEM), endpoint detection and response (EDR), and other detection technologies.

Active

Find the top Network Detection and Response Software with Gartner. Compare and filter by verified product reviews and choose the software that’s right for your organization.

Network Detection and Response

RevealX

ExtraHop

IT Security & Risk Management Associate

My overall experience with Extrahop RevealX has been really good. Its a solid network tool to get visibility into what's actually happening on the network, and it has helped us catch things we would have missed otherwise. The reason I rated it high is for its high quality detections and it does a good job of surfacing things that matter and helps with the investigations. There's also a learning curve to the tool if you're unfamiliar with NDR and network event investigation, but with ample time and learning resources, that should not be a concern. 

3B - 10B USD

50M - 250M USD

500M - 1B USD

1B - 3B USD

<50M USD

10B - 30B USD

250M - 500M USD

30B + USD

Gov't/PS/ED <5,000 Employees

Gov't/PS/ED 5,000 - 50,000 Employees

Overall, this is a good product, but only recently has been innovating and still requires heavy tuning in order to filter out scanning and typical traffic. We have had the product for ~7+ years and this is still a monthly/daily effort. At times it feels like we are the test subjects, and the features aren't fully functional or operational before pushed out.

- solving support cases adequately and quickly
- implemented feature requests properly and in promised time
- We are satisfied with the NDR product especially traffic monitoring for security analysis
- high variety of NDR sensors available also on new virtualisation platforms like Nutanix
- very professional pre-sales and support during deployment and implementation

Darktrace

Cisco Systems

Vectra AI

Gigamon

Other...

FireEye

Fortinet

Corelight

Arista Networks

LogRhythm

Broadcom (VMware)

IronNet

Plixer

Broadcom

Sophos

TrendAI

Trellix

NetWitness

Exabeam

Broadcom (Symantec)

MixMode

Fidelis Security

WatchGuard

Kemp (Flowmon)

Awake Security

Lumu

DeepSeas

Stellar Cyber

ExtraHop is on a mission to reveal cyber risk and build business resilience by exposing threats organizations can’t see. The ExtraHop RevealX platform gives organizations visibility into the cyber threats, vulnerabilities, and network performance issues that evade their existing security and IT tools. With these risk insights, organizations can investigate smarter, stop threats faster, and keep operations running. 
 
RevealX deploys on premises or in the cloud. It addresses the following use cases: 
- ransomware
- software supply chain attacks
- zero trust
- IoT security
- lateral movement
- C2 communication
- security hygiene 
- and more 

We are on a mission to protect and propagate trust by revealing the cybertruth: the truth about the attackers already inside your network, what they‚Äôre doing, and how to stop them. We partner with every customer, every day, to reveal it. When organizations have full network transparency with ExtraHop, they can see more, know more, and stop more cyberattacks.

We are on a mission to protect and propagate trust by revealing the cybertruth: the truth about the attackers already inside your network, what theyÃÂ¢ÃÂÃÂre doing, and how to stop them. We partner with every customer, every day, to reveal it. When organizations have full network transparency with ExtraHop, they can see more, know more, and stop more cyberattacks.

Reviews

Ratings Overview

Overall experience with

Favorable Review

Timely support and modern UI offset by opaque detection explanations and inflexible license model

Critical Review

Product has only recently starting innovating- still needs work.

Likes and dislikes about

likes

dislikes