Vectra AI vs ExtraHop around an east-west hop that never touched an endpoint

14 hours after an RDP hop from a jump box to a file server, every managed endpoint is still green. The destination never ran an agent, so EDR had no process tree and no login event to score.

The credentials moved east-west on the wire. Vectra AI and ExtraHop RevealX are both network detection and response for that hop. Vectra’s traffic guide says the vast majority of its network detections do not require decryption. ExtraHop’s decryption docs say most detections can be generated without decryption, and that you enable decryption when you need payload on critical systems. The NDR marketing sentence that says “up to 100 Gbps” does not name a sensor, and the sensor datasheet’s 100 Gbps row is traffic analytics on one SKU.

	Vectra AI	ExtraHop
Product	Vectra AI network detection and response. Sensors and mixed-mode brains take mirrored or tunneled traffic and score behaviors, including on encrypted protocols.	ExtraHop RevealX network detection and response. Sensors do discovery and stream processing, then detections, investigation, and response. Decryption is a visibility option on top of that.
What you hand it	IP traffic from places that see user-to-data-center, inside the data center, and data-center-to-internet flows. DHCP, DNS, TLS, RDP, SMB, LDAP, Kerberos, and NTLM are called out as useful. MPLS is not supported.	Traffic into a physical or virtual sensor by port mirror, RPCAP, ERSPAN, or VXLAN. Decryption material only if you turn decryption on: session keys or private keys for TLS, and Active Directory domain keys for Kerberos and NTLM.
Encrypted traffic	Detections are designed to run on encrypted traffic. If you decrypt somewhere else, a decrypted copy can feed Vectra Match and investigation metadata. Send that copy on a parallel sensor and brain, or deduplication keeps whichever copy arrives last.	Optional. The decryption concepts page says encryption is optional for most protocols and most detections do not need it. Enabling it adds payload context for the protocols you select. Decrypted payload is not written to disk unless a Trace appliance is capturing packets.
License	Quote-required. No dollar amount was on the TDIR page.	Quote-required. RevealX 360 is SaaS and priced around discovered devices, record ingest, and lookback. RevealX Enterprise is the self-managed deployment. No dollar amount was on the NDR page.
Who operates it	SOC analysts working entity detections, plus the network team that places sensors and chooses what not to mirror (backup, video multicast, HPC).	SOC and network teams running RevealX sensors, plus whoever owns session-key forwarders or domain-controller accounts if decryption is enabled.

Compared on 3 Oct 2026 using Vectra’s network traffic recommendations, ExtraHop’s decryption concepts page, the RevealX sensor datasheet, and the ExtraHop NDR product page. This is not a sensor install and not a decrypt test.

Vectra AI

ExtraHop

Encrypted traffic and optional decryption

	Vectra AI	ExtraHop
Default visibility	Metadata and behavioral detections on encrypted enterprise protocols. The traffic guide points to encrypted command-and-control analysis that does not need payload.	Protocol decode and detections on traffic the sensor sees, including still-encrypted sessions. The docs say most detections can be generated without decryption.
When decryption enters	The sensor does not decrypt the payload itself. You may decrypt upstream and forward that copy for Recall, Stream, Instant Investigation, Advanced Investigation, or Vectra Match rules that will not fire on ciphertext. Use a second sensor paired to a different brain. One pipeline will drop the later duplicate, which is usually the decrypted copy.	You choose critical systems, not every packet. Active Directory decryption is per sensor and covers Kerberos and NTLM for SMB, MSRPC, WSMAN, and LDAP in the domains you connect. TLS decryption is per device and protocol, via a session-key forwarder (required for TLS 1.3 and perfect forward secrecy) or an uploaded RSA private key (not for TLS 1.3). Keys from domain controllers refresh hourly and stay in sensor memory.
What hits disk	Not a decrypted payload store. Investigation products can use metadata from a decrypted copy you chose to forward.	Decrypted payload is analyzed in memory and discarded. It is written only if a Trace appliance is deployed for continuous packet capture. Session keys can optionally sit with packets on a packetstore for a later forensic open, for users you explicitly allow.
Deployment fact	Place sensors outside the DMZ and where they see enterprise DNS and DHCP. Supported encapsulation includes VLAN, QinQ, VXLAN, GRE, GENEVE, and ERSPAN (ERSPAN added in version 9.10). Double-encapsulated GRE inside VXLAN is dropped. Overlapping IPs are not supported.	Sensors ship as appliances or virtual machines for SaaS RevealX 360 and for self-managed deployments, including AWS, Azure, and Google Cloud on the models the datasheet marks. The session-key forwarder runs on Windows or Linux, or keys can come from an F5 LTM so each server does not run the agent.

That note names a real ExtraHop deployment choice: CrowdStrike’s ExtraHop data connector, with the ECS parser instead of the RevealX 360 parser. It is an integration fact, not a decryption-throughput claim.

Where 100 Gbps applies

Do not read “100 Gbps” as the decryption rate of every RevealX sensor.

	Vectra AI	ExtraHop
Sentence on the NDR page	No 100 Gbps figure on the Vectra traffic guide. A public throughput SKU for Vectra sensors was not in the pages opened.	The NDR product page says out-of-band decryption “at up to 100 Gbps” from more than 90 protocols, “without affecting performance.” That sentence does not name a sensor model, a sustained-versus-peak condition, or an IDS-on condition.
Sentence on the sensor datasheet	Not applicable. Vectra’s guide tells you to add sensors for throughput and to keep high-bandwidth backup and HPC off the sensor. It does not publish a Gbps table.	Headline: one sensor can analyze behavior for up to 100,000 endpoints at up to a sustained 100 Gbps. Spec table, different label: EDA 10300 traffic analytics, EDA-only throughput, 100 Gbps, modules NDR, NPM, and IDS, 100,000 devices. The next row, EDA and IDS throughput, is 50 Gbps on that same EDA 10300. EDA 9300 is 50 Gbps EDA-only and 25 Gbps with IDS. Virtual EDA 8320v is 20 Gbps. Those rows are traffic analytics, not a decryption-throughput row.
How to use the number	Size Vectra by the flows you mirror and by a parallel pipeline if you also forward a decrypted copy. Do not import ExtraHop’s 100 Gbps line.	If a quote says 100 Gbps, ask whether it means the NDR page’s decrypt sentence or the EDA 10300 EDA-only analytics row, and whether IDS is on. The decryption concepts page says TLS decryption performance varies by implementation and does not restate 100 Gbps.

What an east-west investigation returns

	Vectra AI	ExtraHop
Detection	Behavioral detections across the attack lifecycle on the protocols the sensor is fed, north-south and east-west. HostID uses artifacts such as DHCP, Kerberos, internal DNS, and optional EDR integrations (the guide names Carbon Black Response and CrowdStrike Falcon).	Detections on observed traffic, sharper when decryption is enabled for the system under attack. The NDR page also describes signature intrusion detection and packet forensics on the same platform. IDS changes the EDA 10300 throughput row from 100 Gbps to 50 Gbps on the datasheet.
Case file	Entity-centric detections and the priority of the host. Match rules that need payload will not fire unless you forwarded a decrypted copy on its own pipeline.	Detections plus packet query and retained packets when packet capture is licensed. On EDA 10300, packet capture is an optional disk (one 450 GB PCAP volume on the datasheet), separate from the analytics throughput row.
Identity	Kerberos and LDAP metadata help HostID and detections without a decrypt step. Decrypted LDAP or SMB content is available only if you supplied it.	With Active Directory decryption enabled, Kerberos and NTLM open SMB, LDAP, MSRPC, and WSMAN content the docs use for ticket forging, reconnaissance, and remote execution context.
Containment	Response stays in the Vectra investigation workflow and in the tools it drives. The traffic guide does not make decryption a prerequisite for containment.	The NDR page moves from visibility to detection to forensic investigation to response with the rest of the stack. Packet proof is optional context, not a requirement for every detection.

Vectra AI, Inc. still sells the product as Vectra AI. The 2 Oct 2025 Netography acquisition added Vectra Fusion for cloud-native network observability. Fusion is outside this NDR column unless the order says those controls ship inside the detection product. ExtraHop is still ExtraHop. Bain Capital Private Equity and Crosspoint Capital Partners closed their acquisition on 22 Jul 2021. That is ownership, not a rename. RevealX remains the product name.

Choose Vectra AI when NDR on encrypted east-west traffic, without operating a key forwarder, matches the constraint, and when any decrypted copy will ride a parallel sensor and brain. Choose ExtraHop RevealX when you want NDR with the option to decrypt TLS, Kerberos, and NTLM on critical systems and to investigate packets. Scope any 100 Gbps claim to the NDR page’s unnamed decrypt sentence or to the EDA 10300 EDA-only analytics row at 100 Gbps, which drops to 50 Gbps when IDS throughput is the row you need. Confirm the price on the quote.