Capgemini Insider Threat Intelligence Platform vs. ExtraHop Reveal(x)

ExtraHop is a must have for on-premise environments where traffic passes through a physical data centre or network operations centre giving complete visibility into what is happening on the corporate network. This works flawlessly if business operations are in office. For hybrid or remote setups, the solution still works well by placing ExtraHop traffic between the VPN termination and firewall and setting up a span port. ExtraHop works well for cloud based deployments as well with their virtual appliances; however, it does not have the same edge against competition as many CNAPP solutions can gather similar data using graph API's provided by the cloud service provider. That said, ExtraHop does provide some unique features that CNAPP's do not around network operations.

Incentivized

• Network discovery
• Network based detections for suspicious/malicious activity and behaviour
• Insight into data flow between systems
• Visibility into network errors

Incentivized

Console is easy to use use and familiarize oneself with. Some points deducted as it can be annoying at times to have to drill down using the drop down menu, and then selecting tabs to get the data you want.

Incentivized

I evaluated ExtraHop against Dark Trace. Against all criteria, ExtraHop had a clear edge including visibility, price, effectiveness, integrations, and more.

Incentivized

• Increased visibility into network based attacks
• Increase visibility into data flows aiding in data loss prevention capabilities
• Assisting network infrastructure teams with visibility into network based performance metrics

Incentivized