Darktrace vs Symantec Endpoint Security

• It did an ok job of analyzing and collecting data. It used a span (mirrored) port and then using its own algorithm developed flow records.
• It did an ok job of segmenting traffic into networks - not always correctly, but ok.
• It tried to identify devices by type - once again, it did ok, but not that great.

Read full review

• The virus and spyware protection has worked well for us, catching several things and quarantining the items or cleaning them.
• The virus definitions very rarely fail to update for the users, so I feel confident that my client machines are kept up to date.
• I like the report I get daily telling me about threats found and action taken without having to login to the console to look it up myself.

Read full review

• False positives. Darktrace uses "AI" to create its alerts for "unusual" or "malicious" activity. It is very common to see an alert for completely benign and normal device behavior - PC tries to print for the first time in a while, for example.
• Antigena actions. To some extent, this is a continuation of the previous point. Darktrace can break the network connectivity of the suspected device automatically. The excessive number of false positives makes administrators reluctant to use this feature, though. Also, the default Antigena actions are not relevant to real-world problems as I saw them in my experience with Darktrace.

Read full review

• Removing dead clients from the console. This is nearly impossible to do, and makes keeping the console clean a very difficult task.
• Poorly tested versions are sometimes released that cause serious issues for users. This ranges from browsers malfunctioning to BSOD errors.
• Malware detection is good but not great. We are not confident in SEP by itself to neutralize malware threats. It's detection rate just isn't high enough for next generation and zero day threats.

Read full review

• We had an ROI just during the POC. DarkTrace helped us identify a ransomware attack and we stopped it before it happened.
• The weekly reports more than pay for itself within the first few months.
• The powerful search capability helps us solve problems where other solutions fall short.

Read full review

• SEP has had a very nice ROI in the form of keeping our network safe and clients' machines clean and free from spyware and viruses.
• The negative downside is that reinstalling the client isn't always an easy method. A lot of times we just have the user reimage their whole machine, which is usually the last resort.
• Another positive aspect of SEP is that it allows us to identify any problematic machines which might be allowing any malware, spyware or viruses in through any network ports or connections.

Read full review