Darktrace vs ExtraHop vs Vectra AI vs Corelight: An NDR Comparison for IT Leaders (2026)

Every NDR vendor claims its detections catch what the others miss, and you can't test that claim before you sign. Detection quality is the axis buyers argue about most and can verify least, so I set it aside at the start of every evaluation.

What decides whether Darktrace, ExtraHop, Vectra AI or Corelight works on your network is the machinery underneath. How traffic reaches the sensor. What survives encryption. Where analysis runs, and whether your metadata leaves the building. What the licence meter counts, and what you keep when you leave.

This comparison works through each mechanism using primary vendor documentation, so you can judge fit against your own estate. If you're weighing a managed service instead, the MDR comparison covers that decision.

IT Leaders Report 2026

What are your IT peers investing in 2026?

We spoke to about 1,300 IT leaders from various organisations to understand what they're evaluating. Most of it is the kind of thing you'd only hear from a peer you know well enough to ask, so we've put it in one place.

Read the report

Do You Need NDR If You Already Have EDR? Count Your Agentless Assets First

EDR protects what can run an agent. The case for NDR rests on everything else on the network, and that list is longer than most asset registers admit.

The uncovered surface usually includes:

• PLCs and HMIs on the plant floor
• IP cameras and badge readers
• Building management controllers
• Infusion pumps and imaging systems
• Printers
• The switches and firewalls themselves
• Storage appliances
• Contractor laptops you don't manage

Every one of them talks on the wire, whether or not it runs your security stack.

‍

The vendors won't frame the decision this way for you. Vectra's licensing documentation counts laptops, servers, firewalls, IoT and network-connected OT devices as licensed equally. An EDR-covered workstation costs the same to monitor as a PLC. You have to build the coverage rationale yourself.

The honest corollary: if your estate is almost entirely agent-covered, runs no OT and already feeds a mature SIEM, NDR has a weaker case. That budget may do more as detection engineering on telemetry you already collect. Count the agentless share before you book a single demo.

‍

How Darktrace, ExtraHop, Vectra AI and Corelight Are Architected

The four platforms split into two models.

Corelight is evidence-first. Its primary output is Zeek logs in an open, documented schema, streamed to Splunk HEC, Kafka, JSON over TCP, syslog or S3. Detection sits on top, through Suricata and machine learning models that Corelight states run at the edge and in the cloud. If you're still choosing the SIEM that will receive those records, our SIEM vendor comparison covers the options.

Darktrace, Vectra and ExtraHop are detection-first. Their core output is a scored detection. Evidence is a secondary product: Vectra sells metadata export and retention as Stream and Recall, metered per GB per day, and ExtraHop sells a recordstore and packetstore.

Where inference runs matters more than it looks. In regulated sectors, metadata leaving the environment can disqualify a platform before anyone reviews a detection.

‍

• Darktrace: the product specification runs analysis on the master, physical or Darktrace-hosted. vSensors do not operate a model engine; they process traffic and forward it.
• Vectra: detection models run on the local Brain. The Respond UX is served from Vectra's cloud, while the Quadrant UX runs locally.
• ExtraHop: ML detections need a connection to ExtraHop Cloud Services.
• Corelight: the sensor produces the logs. Corelight documents air-gapped deployment.

‍

NDR Traffic Acquisition: TAP vs SPAN vs Cloud Mirroring

All four products are passive, out-of-band sensors. Vectra's traffic guidance says plainly there is no inline mode, and Corelight's sensors take their feed from a tap, SPAN or packet broker. A sensor can only analyse what the network delivers, so acquisition is the first thing I test and the last thing vendors demo.

A mirror port and a tap behave differently under load. A tap copies every frame at line rate. A SPAN session asks the switch to copy traffic with spare capacity. When the source ports exceed what the destination port can carry, the switch drops the excess and nothing downstream reports it.

The vendors document the consequence but don't quantify it:

• Darktrace: its specification warns that analysis quality will be severely impacted when the feed is a subset of traffic, duplicated or unidirectional.
• Vectra: its guidance warns of data loss when a worker thread receives more traffic than it can process.

None of the four publishes an expected SPAN drop rate. Measure your own: compare switch interface counters against packet counts at the sensor during your busiest hour.

‍

Encapsulation is the second failure point. Vectra accepts GRE, VXLAN, GENEVE from v6.15 and ERSPAN from v9.10. Its encapsulation documentation excludes MPLS, and GRE nested inside VXLAN drops packets.

Some traffic never crosses a monitored port.

• Hosts on the same access switch and VLAN talk locally unless their ports sit in the SPAN source.
• VM-to-VM traffic on one hypervisor needs a virtual sensor on that host.
• Pod-to-pod traffic on one Kubernetes node needs host agents, or Packet Mirroring in GKE.

How many of these gaps you inherit depends on switching design, which our Cisco vs Aruba vs Arista comparison covers.

Cloud mirroring brings the provider's limits and a second bill.

• AWS: VPC Traffic Mirroring counts mirrored packets against the instance's bandwidth and drops them first under congestion. AWS charges US$0.015 per session-hour in US East (Ohio), plus data transfer.
• Azure: virtual network TAP is still in public preview in select regions. It has no IPv6 support, and adding a source can cause up to 60 seconds of network downtime.
• Google Cloud: Google charges US$0.008 per GiB processed, and mirrored traffic adds to VM egress.

‍

‍

Can NDR See Encrypted Traffic? TLS 1.3, ECH and Decryption Compared

Encryption removes payload from every passive sensor's view. What remains is metadata, and each platform extracts it differently.

ExtraHop is the only one of the four that documents native decryption. It offers two TLS methods: upload a server certificate and private key, or forward session keys from the server through a lightweight agent. The private-key method is incompatible with TLS 1.3 and perfect forward secrecy, so session key forwarding is the only option for modern traffic.

Check that forwarder against your server estate:

• The Linux installation guide lists dynamically linked OpenSSL 1.0.x and 1.1.x.
• The Windows forwarder supports only the native Windows TLS framework.
• Kerberos and NTLM traffic can also be decrypted, using domain keys retrieved by a dedicated account.
• ExtraHop states that decrypted payload is not written to disk.

Vectra states that the vast majority of its detections work without decryption. Decryption matters for Recall and Stream metadata, and for Match signature rules, some of which only fire on decrypted content. Vectra relies on an external decryptor. It advises sending decrypted and encrypted copies through separate sensor pipelines, because de-duplication discards the copy that arrives last.

Corelight does all its analysis without decryption:

• JA3 and JA3S fingerprints for TLS
• HASSH fingerprints for SSH
• Certificate fields
• Inferences drawn from packet length, order and direction inside SSH sessions
• QUIC metadata: Zeek's QUIC analyser logs version, connection IDs, server name and client protocol, such as h3.

Darktrace describes deep packet inspection across layer 4 to 7 protocols. It doesn't publicly document decryption, TLS fingerprinting or QUIC handling, so ask.

Two protocol changes set the ceiling for all four:

• TLS 1.3 sends the server certificate inside the encrypted handshake. Zeek's ssl.log documentation confirms that TLS 1.3 sessions carry no certificate details.
• Encrypted Client Hello, standardised as RFC 9849 in March 2026, encrypts the SNI and the ALPN list. A passive sensor sees only the outer cover name. Without session keys, identifying the destination falls back on IP address, DNS and certificate history.

‍

‍

NDR Detection Methods and Alert Explainability

Each platform documents a different detection method:

• Darktrace: unsupervised models built per customer for each device and peer group. The specification names Bayesian meta-classification, graph centrality and spectral clustering. Customers can write custom models in Model Editor, but Darktrace states it offers no way to access the underlying behavioural models or classification output.
• ExtraHop: ML detections delivered through a cloud machine learning service, an IDS module for signatures, and custom triggers through the Trigger API.
• Vectra: behavioural models running on the Brain. Match adds Suricata-format signatures, with up to 25 customer rulesets per Brain.
• Corelight: Zeek scripts, Suricata and YARA, plus ML models the vendor describes. The rule and script logic is readable as plain text.

This matters in practice. An alert you can't explain is an alert you can't take to a change board or an auditor. When the logic is readable, your team can see why something fired. When it isn't, you're trusting a score.

Before shortlisting, ask each vendor for three things in writing:

1. The baseline period before detections are reliable.
2. Whether MITRE ATT&CK technique IDs appear in exports as well as in the console.
3. What evidence an analyst sees behind a score.

None of the four documents all three publicly.

‍

NDR Licensing Models: Why Gbps and Device-Count Quotes Don't Compare

The four vendors meter different things, and the units don't convert. The meter will shape your bill more than any list price.

• Vectra counts the 95th percentile of concurrently active internal IPs. It samples every 10 minutes across 30 days, discards the top 5% and retires an IP after two hours of silence. If you exceed the licence, you get 30 days to filter traffic or true up.
• Corelight sells throughput. Its AWS Marketplace listing prices a standard Zeek subscription for 1 Gbps at US$49,995 for 12 months.
• ExtraHop sizes by sensor class. Its datasheet rates the EDA 6370 at 10 Gbps and 18,000 devices. Enabling IDS halves throughput on the two largest models: the EDA 10300 drops from 100 Gbps to 50 Gbps.
• Darktrace combines both units. Its AWS Marketplace tiers, each for 12 months, are: 300 Mbps and 200 hosts at US$30,000; 2 Gbps and 1,000 hosts at US$60,000; 5 Gbps and 10,000 hosts at US$100,000.

Consider two estates. A data centre segment carrying backup and storage replication adds gigabits through a handful of IPs. That grows a Corelight or ExtraHop bill and barely moves Vectra's. A campus rollout of cameras and sensors adds thousands of IPs at negligible bandwidth, which reverses the effect.

‍

Watch for cost cliffs:

• Vectra's IP meter: a host with two network interfaces counts twice, and each Zscaler Private Access username counts as an active IP.
• Vectra retention and export: Recall and Stream grow with metadata volume.
• Corelight add-ons: ask how Suricata, Smart PCAP and each Collection are priced relative to the throughput subscription.
• Cloud mirroring: it arrives on the provider's invoice, not the vendor's.

‍

‍

From an IP Address to an Owner: Asset and Identity Attribution

An NDR alert names an IP address. Turning that into a device, an owner and a ticket is where response time goes.

Vectra's HostID attributes sessions to hosts using 14 host artefacts, including NetBIOS names, DHCP, Kerberos machine authentication and reverse DNS. It also pulls context from CrowdStrike, Carbon Black and VMware vCenter.

Darktrace ingests DHCP and VPN logs in syslog format for device tracking. ExtraHop and Corelight document EDR and SIEM integrations but publish less detail on the resolution logic itself.

The device that matters most is the one that appears in no directory: the camera an electrician installed, the contractor laptop, the controller a vendor shipped pre-configured.

For those, passive fingerprinting from DHCP options, TLS handshakes and protocol behaviour is all you get, so test attribution on unmanaged devices during the pilot.

A zero trust architecture depends on this answer. You can't decide what a device may reach until you know what it is.

‍

NDR Response Actions and Who Holds the Authority

Darktrace is the only one of the four with documented native response. Autonomous Response acts from dedicated firing interfaces on the appliance and through firewall integrations. Device eligibility settings control its scope, and cloud deployments that rely on VPC mirroring need osSensors for autonomous actions.

Vectra and Corelight sit out of band and can't block traffic themselves. ExtraHop follows the same integration-led model. Containment for all three runs through EDR, firewall or SOAR integrations.

None of the four publicly documents its response defaults, or the delay between a detection and an available action. Settle who approves an automated block on a production system, and write it into the runbook. If a managed provider will hold that authority, our MDR and XDR providers guide covers how delivery models divide it.

‍

OT, Cloud and Air-Gapped Coverage, Plus the Filters That Disqualify

OT coverage. Passive monitoring suits industrial networks because it sends nothing to fragile controllers. The platforms document it very differently:

• Corelight: its ICS/OT Collection names BACnet, DNP3, EtherCAT, EtherNet/IP and CIP, Modbus, PROFINET, S7Comm and TDS. It builds on the ICSNPP parsers from CISA and Idaho National Laboratory.
• Darktrace: it states coverage of Modbus, DNP3 and 100+ ICS protocols without publishing the list.
• ExtraHop and Vectra: ask for a named protocol list in writing.

Budget for log volume as well. A Corelight conference presentation notes that some ICS logs run two to four times the size of the connection logs, and that lands directly on SIEM ingest cost. Our guides to ICS and SCADA security and OT/IT convergence cover the segmentation work that decides where OT sensors sit.

Air-gapped operation separates the four sharply:

• Corelight documents air-gapped deployment with offline seeding and manual licence management.
• Darktrace can run a physical master without Call-Home. Model updates then arrive with software updates.
• Vectra's Quadrant UX runs locally, while the Respond UX depends on its cloud.
• ExtraHop subscription licences must connect to its licensing server.

Some conditions remove a platform regardless of quality:

• FedRAMP High: Darktrace Federal was certified at High on 25 April 2025. Vectra announced High authorisation through Knox Systems in August 2026.
• FedRAMP Moderate: ExtraHop RevealX Federal was certified on 15 September 2025. Corelight is listed as in process.
• No vendor connectivity permitted: ExtraHop's subscription licensing fails this condition.
• Inline blocking at the sensor: Vectra and Corelight can't do this.
• TLS 1.3 payload inspection without a separate decryptor: only ExtraHop offers it, and it requires forwarders on your servers.
• Azure capture with IPv6: virtual network TAP doesn't support it.

On employee monitoring, none of the four documents works council or privacy guidance. Brief your works council and data protection officer before the pilot, not after the first alert names a person.

‍

NDR Data Portability: What You Keep When You Leave

Leaving a platform tests where your network history actually lives.

• Corelight: its Zeek logs already sit in your SIEM or object storage, in an open schema. The records stay readable after you leave, and Zeek scripts and Suricata rules move with you as text files.
• Vectra: exports metadata to your data lake through Stream, metered per GB per day. Its Match rules use Suricata format, so they travel.
• Darktrace: exports metadata for longer retention, but its behavioural models stay with the platform. Default retention on the appliance is around 30 days, depending on hardware and traffic.
• ExtraHop: exposes records through its REST API.

Put the export format and the extraction window in the contract. 5 problems that surface after you replace your on-prem SIEM shows what happens to detection history when nobody asks that question.

‍

Which NDR Approach Suits Your Network?

Use the questionnaire below to see which NDR approach suits you.

‍

Choosing an NDR Platform on Technical Fit

Match your conditions to the approach:

• You run an OT or ICS estate: shortlist platforms that name your protocols in writing. Corelight documents eight; ask the others for theirs.
• A hunt team already works in your SIEM: evidence-first fits best. Corelight's open records stay yours and feed the tools your analysts already use.
• You have little analyst capacity: detection-first platforms give you prioritised alerts instead of logs to interpret. That points to Darktrace, Vectra or ExtraHop.
• Residency rules out vendor cloud analysis: Corelight air-gapped, a Darktrace physical master or Vectra's Quadrant UX remain options. ExtraHop's subscription licensing does not.
• Your estate is cloud-first: price the provider's mirroring before any NDR quote. In Azure, confirm the virtual network TAP preview limits apply to none of your workloads.
• You only have SPAN ports and no tap budget: measure drop rates at peak before buying. Every platform analyses only what arrives.
• You have engineering capacity but no licence budget: open-source Zeek and Suricata produce the same log schema Corelight builds on. You carry the sensor engineering and content maintenance yourself.

Before you sign, get three things in writing:

1. The expected packet loss at your peak throughput on your actual acquisition method.
2. What the platform extracts from your own encrypted traffic mix, measured during the pilot.
3. The export format and window for network records, custom detections and suppressions on termination.