CrowdStrike Falcon vs Darktrace

• Detects and automatically blocks dangerous behavior on endpoints that could be indicative of malicious activity, like executing programs from the deleted items folder, executing a SSH command in silent mode from different places in the OS, etc.
• Monitors endpoints continuously for known malware, evaluates dangerous behaviors and blocks execution based on risk tolerance settings, uses AI to draw correlations on multiple attack vectors, and has a human malware hunting element to detect known or newly detected attack vectors.
• Is easy to deploy across a large organization and manage centrally by as few as 1 person part time.
• This was the fastest and easiest implementation of an enterprise grade security system I have ever done. I pushed software to the endpoints on a Friday afternoon, and was complete by Noon on Monday, as each workstation came online, the installer completed, and we were protected.

Read full review

• It did an ok job of analyzing and collecting data. It used a span (mirrored) port and then using its own algorithm developed flow records.
• It did an ok job of segmenting traffic into networks - not always correctly, but ok.
• It tried to identify devices by type - once again, it did ok, but not that great.

Read full review

• Falcon isn't continuously scanning the machine, if something is downloaded and viewed as safe it won't be re-checked later.
• More dashboards and information on vulnerabilities on the machines would be helpful.
• More reports that could be given to executives would also be beneficial. There are some now, but the options are rather limited.

Read full review

• False positives. Darktrace uses "AI" to create its alerts for "unusual" or "malicious" activity. It is very common to see an alert for completely benign and normal device behavior - PC tries to print for the first time in a while, for example.
• Antigena actions. To some extent, this is a continuation of the previous point. Darktrace can break the network connectivity of the suspected device automatically. The excessive number of false positives makes administrators reluctant to use this feature, though. Also, the default Antigena actions are not relevant to real-world problems as I saw them in my experience with Darktrace.

Read full review

• A significant increase in responsiveness to data security incidents.
• The frequency and extent of data security issues have been drastically reduced.

Read full review

• We had an ROI just during the POC. DarkTrace helped us identify a ransomware attack and we stopped it before it happened.
• The weekly reports more than pay for itself within the first few months.
• The powerful search capability helps us solve problems where other solutions fall short.

Read full review