No more typing reviews! Try our Samantha, our new voice AI agent.

NetWitness NDR vs Proofpoint Threat Response comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
8.0
Implementing NetWitness NDR enhances security, improves network visibility, reduces costs, and boosts efficiency and productivity for businesses.
Sentiment score
8.3
Proofpoint Threat Response boosts ROI, saves time, cuts costs, and improves efficiency and satisfaction for management and the SOC team.
Now, it is all taken care of by Proofpoint with zero human error, allowing hours of work to be completed in minutes.
Securuty solution architect at a tech services company with 11-50 employees
 

Customer Service

Sentiment score
7.3
NetWitness NDR's customer service is generally efficient and highly regarded, though some users report occasional slow response times.
Sentiment score
9.7
Proofpoint offers responsive, professional customer service with effective support and documentation, ensuring user satisfaction and high-quality assistance.
I would rate customer support a ten because they are prompt with solutions, provide advice during troubleshooting, and their documentation is excellent.
Securuty solution architect at a tech services company with 11-50 employees
 

Scalability Issues

Sentiment score
7.0
NetWitness NDR is scalable for large enterprises, though some users report issues with scalability and agent migration.
Sentiment score
6.8
Proofpoint Threat Response scalability is mixed, dependent on hardware and integrations, with potential for improvement, especially in cloud deployment.
Scalability is currently limited, as it only integrates with Proofpoint Email Protection, Proofpoint TAP, and the Abuse Mailbox.
Securuty solution architect at a tech services company with 11-50 employees
 

Stability Issues

Sentiment score
7.7
NetWitness NDR is generally reliable, providing real-time data and stability, though minor technical issues are occasionally reported.
Sentiment score
8.1
Proofpoint Threat Response is praised for robust stability, though some users cite database-related scalability issues in large deployments.
 

Room For Improvement

NetWitness NDR requires improvements in UI, scalability, detectability, integration, session times, pricing, training, and features, making it complex and slow.
Enhancing support, integration, and interface design, while considering scalability and user interaction improvements, would benefit Proofpoint Threat Response.
I suggest adding support for other email protection services such as Cisco IronPort, IronMail, and Abnormal, which would enhance its capabilities.
Securuty solution architect at a tech services company with 11-50 employees
 

Setup Cost

Proofpoint Threat Response is considered cost-effective with good value and relatively low cost compared to alternatives like Abnormal Security.
For pricing, setup cost, and licensing, it is necessary to purchase Proofpoint professional services if assistance is desired during setup, which is quite easy.
Securuty solution architect at a tech services company with 11-50 employees
 

Valuable Features

NetWitness NDR offers high detection rates, real-time malware response, third-party integration, and a user-friendly, interoperable interface with advanced analytics.
Proofpoint Threat Response enhances email security with auto-pulling, phishing protection, integration, and efficient spam and false positive management.
Now, with Proofpoint Threat Response Auto-Pull, integration with TAP, Abuse Mailbox, CSV integration, and other data sources, the team can perform tasks that once required hours in just a minute.
Securuty solution architect at a tech services company with 11-50 employees
 

Categories and Ranking

NetWitness NDR
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (47th), Threat Intelligence Platforms (TIP) (34th), Endpoint Detection and Response (EDR) (57th), Security Orchestration Automation and Response (SOAR) (22nd), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (40th)
Proofpoint Threat Response
Average Rating
8.2
Reviews Sentiment
6.7
Number of Reviews
6
Ranking in other categories
Security Incident Response (5th)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. NetWitness NDR is designed for Network Detection and Response (NDR) and holds a mindshare of 3.5%, up 2.6% compared to last year.
Proofpoint Threat Response, on the other hand, focuses on Security Incident Response, holds 5.4% mindshare, down 14.4% since last year.
Network Detection and Response (NDR) Mindshare Distribution
ProductMindshare (%)
NetWitness NDR3.5%
Darktrace13.2%
Vectra AI9.1%
Other74.2%
Network Detection and Response (NDR)
Security Incident Response Mindshare Distribution
ProductMindshare (%)
Proofpoint Threat Response5.4%
VMware Carbon Black Cloud10.2%
ServiceNow Security Operations9.3%
Other75.1%
Security Incident Response
 

Featured Reviews

reviewer1799727 - PeerSpot reviewer
Manager, IT Security Operations at a non-profit with 11-50 employees
Reliable and good support but can be expensive
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.
MP
Securuty solution architect at a tech services company with 11-50 employees
Automated email removal has reduced spam impact and gives the security team more time for analysis
Proofpoint Threat Response offers the best features through creating a workflow that deals with different types of emails, including identifying spam. If any user identifies an email as malicious, it triggers a workflow to the information security team, who will analyze it and determine whether to inform the user that it is not malicious or trigger a flow. A flow can be created for different types, where high spam emails are auto-pulled, low spam emails are quarantined for analysis, and integration with Proofpoint TRAP and Proofpoint TAP allows auto-pull for emails declared malicious. Additionally, I can revert changes if an email initially declared as spam is later found not to be spam, restoring it to the user's mailbox without user intervention. This complete feature encompasses threat response, prediction, activations, deletions, and sometimes restorations. I find myself using the integration with TAP and the integration with the Abuse Mailbox the most because those are utilized daily. Users often confuse whether an email is malicious or not, prompting them to use Proofpoint Abuse Mailbox via the report phishing button. As spammers grow more intelligent, Proofpoint TAP is also useful by flagging those emails. No action is required on our side because it is the collaboration between Proofpoint Threat Response and Targeted Attack Protection, making the SOC team's work easier, with reduced false positives, allowing them time for more productive tasks. Proofpoint Threat Response has positively impacted the organization by improving security posture, providing breathing space for the SOC team with fewer false positives, and offering a tool for users to report any malicious email using the Abuse Mailbox, which the SOC team can analyze. Proofpoint intelligence can then declare emails malicious or not and pull them from the user's mailbox. The solution has impacted us positively, safeguarding against spam while giving the SOC team the capacity to analyze needs without being overwhelmed by false positives. In previous days without Proofpoint Threat Response Auto-Pull, the SOC team spent more than two or three hours analyzing emails, checking hash values, verifying the nature of emails, and conducting eDiscovery for malicious emails. During mass spam attacks, the entire day was consumed in firefighting mode. Now, with Proofpoint Threat Response Auto-Pull, integration with TAP, Abuse Mailbox, CSV integration, and other data sources, the team can perform tasks that once required hours in just a minute.
report
Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
11%
Outsourcing Company
10%
Comms Service Provider
9%
Manufacturing Company
9%
University
14%
Financial Services Firm
14%
Outsourcing Company
9%
Energy/Utilities Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise6
No data available
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for Proofpoint Threat Response?
For pricing, setup cost, and licensing, it is necessary to purchase Proofpoint professional services if assistance is desired during setup, which is quite easy. A license is purchased, and a techni...
What needs improvement with Proofpoint Threat Response?
To improve Proofpoint Threat Response, I suggest adding support for other email protection services such as Cisco IronPort, IronMail, and Abnormal, which would enhance its capabilities. This would ...
What is your primary use case for Proofpoint Threat Response?
Proofpoint Threat Response was initially implemented on-premises as Proofpoint Threat Response Auto-Pull, integrated with Proofpoint Email Protection service and TAP, Proofpoint Targeted Attack Pro...
 

Also Known As

RSA ECAT, NetWitness Network
No data available
 

Overview

 

Sample Customers

ADP, Ameritas, Partners Healthcare
University of Waterloo, Akorn, Fenwick and West LLP
Find out what your peers are saying about Darktrace, TrendAI, Vectra AI and others in Network Detection and Response (NDR). Updated: October 2026.
917,433 professionals have used our research since 2012.