Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization. This allows it to tackle complex cyber-attacks as they happen and prevent future cyber-attacks from happening.
N/A
Palo Alto Networks WildFire
Score 9.3 out of 10
N/A
Palo Alto Network’s WildFire is a malware prevention service. It specializes in addressing zero-day threats through dynamic and static analysis, machine learning, and advanced sandbox testing environments.
Darktrace is a product well suited for the vast majority of infrastructures and helps monitoring and responding to threats based on the network in a very elastic way. This is a product based on on-premise infrastructures that hosts its machines locally, of course it can be technically difficult to monitor an entire On-Cloud infrastructure but even there there's room for sensors and monitoring, not to mention the SaaS and mail integration that completes the product.
Palo Alto Networks WildFire is highly effective in enterprise environments where detecting zero-day threats and unknown malware is critical. Small businesses may find the cost of advanced subscriptions prohibitive, especially if they only need basic protection. Much of our infrastructure is OT and Palo Alto Networks WildFire is cloud dependent so cannot be used where we have air-gapped systems.
Uses it Al model UEBA to detect anomalies in the behaviour of not only the users in a corporate network but also the routers, servers, and endpoints in that network.
Provides a visualisation of both egress and outbound network traffics flowing in and out of the organisation.
Darktrace comes with it autonomous AI model detection and responses capabilities.
Darktrace as an AI next generation NDR solution, prevents ,contains and quarantines malicious traffics from and into the corporate network.
This is could base and easily manageable for our collocation. While working within the could can review in live time potential treats that it has reported from other devices.
Worked very well with existing Palo Alto devices.
Another huge plus is the simplicity of managing and ease of scalability.
Its cost is competitive with similar/like products available.
There are few areas that I would say need to be improved; their customer support portal allows you to log tickets with any suggestions or things you feel the product is missing, and they will generally show you how to achieve what you want, or in some cases, introduce it as a feature in a later update.
It works very well and takes care of protecting us from threats new and well-known. It's been a game changer in terms of threat detection & prevention.
The Darktrace toolset is very expansive, allowing it to handle many different tasks, but this leads to a user interface that is sometimes not at all intuitive. Icons don't always make sense visually, and the associated tool tips do not always provide enough detail on what action the button performs
It is a great product that has definitely improved our security posture, however it does require quite a bit of training and time spent customizing for the environment. We had several difficulties in deployment but Palo Alto support was able to help us work through the problems that we were not able to figure out on our own.
Darktrace support is excellent in my experience. They send a competent engineer on-site to provide on-boarding training. They were also very responsive in responding to questions and concerns. Having an individual point of contact who is a competent network and security engineer is not a common experience, at least for me.
PAN support is very good. You can get the reasonable and timely support on any conditions. When the product is already integrated with the PAN firewalls, you can choose the severity levels based on the effect. The customer service/TAC is very helpful, they even have additional recommendations of advises for product usability. Local partners are also assisting the cases and give their expertise.
We did NOT select Darktrace. OSSIM/AlienVault is a more mature product and it provided better intelligence and reporting. The end user interface is much easier to use - and you can tell built form engineers who have had to do the work. My suggestion for anyone considering Darktrace, is to get the price upfront; do a 30/60 onsite trail; and do the same thing, at the same time, with AlienVault. AlientVault will win every time. I say that because that's exactly what I did.
WildFire from Palo Alto Networks provides security with very little overhead. With AutoFocus, they’ve got threat intelligence built right in. That way, it can prepare us to react swiftly when a significant danger is identified and dealt with as soon as possible. They introduced firewalls that are aware of applications and can make use of Wildfire. It sped our ability to respond to emerging threats up because of this game-changing development.
One big positive is how it helps us with the security assessments that clients have done on us. They are looking to see if we know how we might have unusual/malicious traffic running on the network.
If you have a small network and only need 1 appliance, it can be a good ROI and peace of mind.
You could go down a hole in trying to spend time looking at all of your traffic with this software. You need to focus only on what it is showing as potential bad traffic.
We've had one or two malware files that were blocked by Wildfire. We use it occasionally to check unusual or unexpected files. Hard to monetize ROI, because we don't know what the impact would have been if the file made it through.
We pay significantly for the Wildfire licenses, but given the potential impact to our business, we feel it is worthwhile. Figure costs are somewhere around $1,500 per year per firewall for a mid-range model. Can be higher or lower for different sized firewalls. Onsite appliance was somewhere between $50-100K, which was too much for us, so we use the cloud model.
