Splunk ARI helps us to get continuous, real-time visibility into our organization's "attack-surface" like all devices, users, and software in a network. This provides continuous asset discovery of everything on the network by correlating data already living in Splunk. Its ability to assign composite Risk Scoring to each asset based on its vulnerabilities, the seniority of the user and whether it lacks security agents like encryption or antivirus helps us with better Risk Scoring and Prioritization. The attack surface explorer helps us visually map the relationship between the user’s and devices.

The administration tool is useful, but while its functionality is solid, the information is not summarized or presented effectively to the user. The user experience is outdated and requires a refresh. Integration with third-party products is very simple and functions as expected. However, the final cost is too high.