Darktrace vs Vectra around a lateral hop the agents never logged

Every managed endpoint stayed green. The hop still moved east-west on the wire, from a jump box to a file share that never ran an agent. Both products are sold as network detection and response for that gap. They disagree on what the console should do next when the session is encrypted.

Buy Darktrace when the network layer should propose or take Autonomous Response. Buy Vectra AI when encrypted traffic stays opaque and behavior still scores without full decrypt.

Overview

	Darktrace	Vectra AI
Primary use case	Darktrace / NETWORK NDR with Self-Learning AI DETECT across hybrid network, cloud, OT, endpoint, and identity surfaces, plus RESPOND Autonomous Response containment	Vectra AI NDR with Attack Signal Intelligence across hybrid network, identity, and cloud telemetry, with entity-centric urgency scoring and investigation workflows
Day-to-day workflow	Learn org-normal baselines, review Cyber AI Analyst investigations, approve or run Autonomous Response actions (block matching connections, enforce pattern of life, quarantine, or third-party firewall/EDR), tune Human Confirmation versus fully autonomous modes	Place Sensors on SPAN/TAP or cloud mirrors, triage entities ranked by Attack Signal Intelligence urgency, open Instant or Advanced Investigation, contain through native and integrated response paths
Main buying consideration	ActiveAI Security Platform coverage is sales-quoted. Network coverage is typically scoped per user or device with DETECT and RESPOND modules as separate line items on the quote. darktrace.com showed no public USD list rate for NETWORK packs when checked 7 Oct 2026	Vectra NDR meters on the 95th percentile of concurrently active internal IPs observed over 30 days (samples every 10 minutes; top 5% discarded). Quote-required; no public USD list rate on vectra.ai when checked 7 Oct 2026. CDR for M365, IDR for Azure AD, and related packs use separate identity or cloud meters

We reviewed Darktrace’s NETWORK product page and Autonomous Response overview for DETECT, RESPOND actions, and confirmation modes, plus the RITZ customer story, and Vectra AI’s network traffic analysis documentation for encrypted-metadata detection, Sensor and Brain architecture, and the licensing metrics page for the 95th-percentile concurrent IP meter, plus the Sanofi customer interview.

Darktrace

Vectra AI

Editions and pricing

Both vendors keep NETWORK and NDR commercial rates behind sales quotes. The documented meters differ: Darktrace scopes ActiveAI coverage modules; Vectra NDR counts concurrent internal IPs.

	Darktrace	Vectra AI
How it is sold	ActiveAI Security Platform modules including Darktrace / NETWORK (DETECT and RESPOND), with optional EMAIL, OT, IDENTITY, ENDPOINT, and related coverage areas as separate quote lines	Vectra NDR as the concurrent-IP subscription. Vectra CDR for M365, IDR for Azure AD, CDR for AWS or Azure, Stream, Recall, Match, and MDR are documented as separate meters on the licensing page
Figure on the public page	No public USD list rate for Darktrace / NETWORK on darktrace.com when checked 7 Oct 2026. AWS Marketplace lists a custom private-offer path rather than a printed NETWORK card	No public USD list rate for Vectra NDR on vectra.ai when checked 7 Oct 2026. Licensing docs define capacity as the 95th-percentile concurrent active internal IP count, not a printed per-IP dollar
What the listing adds about payment	Buyers confirm module mix, user or device counts per coverage area, and term on the sales quote. Multi-year ActiveAI contracts are negotiated; this page does not invent a representative dollar	Over-license usage allows 30 days to filter traffic (subnet or VLAN drop) or true-up pro-rated concurrent IP capacity through the end of the current term, per Vectra licensing docs

Detection and encrypted traffic

Shared surface starts with passive network visibility into east-west and north-south sessions. The documented split is how each product models threat signal when payloads stay encrypted.

	Darktrace	Vectra AI
Detection model object	Self-Learning AI under DETECT builds an organization-specific Unique Behavioral Profile and flags deviations that could disrupt the business, including novel and previously unseen threats on hybrid network paths	Attack Signal Intelligence applies behavioral AI models mapped to attacker techniques, with entity-centric urgency scoring from attack profile, velocity, and techniques rather than raw alert volume
Encrypted session handling	Darktrace / NETWORK analyzes encrypted and decrypted traffic across network, cloud, and OT under the same behavioral model on the product page reviewed. Response still targets anomalous connections rather than requiring a separate decrypt appliance as the documented default path	Vectra docs state the vast majority of NDR detections do not require traffic decryption. Models score metadata from encrypted sessions (packet timing, session size, connection patterns, certificate attributes, protocol behavior). Optional decrypted streams need a parallel Sensor and Brain path so deduplication does not drop one copy
Capture and identity signal	Passive ingestion across on-premises, virtual, multi-cloud, OT, endpoints, and identities under one continuously learned profile. Identity activity is evaluated inside the same behavioral profile as network infrastructure	Sensors capture via SPAN, TAP, packet brokers, or cloud mirroring. Network identity is derived from authentication protocols such as Kerberos, LDAP, NTLM, and DCE/RPC for service accounts and workloads without an endpoint agent

Response and investigation

Both queues move from detection into an investigation object. The documented split is native Autonomous Response actions versus prioritized Attack Signal Intelligence entities and integrated containment.

	Darktrace	Vectra AI
Response action object	Autonomous Response documents out-of-the-box actions without scripting: automatically choose the best option, block matching connections, enforce a device or peer-group pattern of life, block incoming or outgoing traffic or quarantine the device, and invoke third-party firewall or EDR quarantine through integrations	Respond workflows stop attacks through native, integrated, and managed response capabilities tied to prioritized entities. Containment is framed as interrupting attacker progress from the same investigation surface rather than a named Antigena-style action catalog on the pages reviewed
Operator control mode	Human Confirmation mode or fully autonomous mode, with guiderails by time of day, device set, or event type. Many deployments start in confirmation and move to autonomous after trust builds, per Darktrace’s Autonomous Response overview	Analysts work urgency-ranked entities first. Instant Investigation and Advanced Investigation query enriched metadata; optional Recall or Stream packs extend hunting retention under separate meters
Investigation assistant	Cyber AI Analyst continually investigates and contextualizes related alerts into connected incidents so analysts inherit a narrative rather than a raw model-alert queue	Attack Signal Intelligence rolls related detections into entity campaigns. HostID attribution tracks hosts across IP changes using DNS, Kerberos, DHCP, and integration signals

Favor Darktrace when the documented requirement is Darktrace / NETWORK DETECT with RESPOND Autonomous Response actions (block matching connections, enforce pattern of life, quarantine, or third-party firewall/EDR) under Human Confirmation or fully autonomous modes. Favor Vectra AI when the documented requirement is Vectra NDR Attack Signal Intelligence that scores encrypted-session metadata without full decrypt, metered on 95th-percentile concurrent active internal IPs, with entity urgency and Instant or Advanced Investigation.