Cortex XDR by Palo Alto Networks Reviews

Name: Cortex XDR by Palo Alto Networks
Brand: Palo Alto Networks
Rating: 4.2 (112 reviews)

Vendor: Palo Alto Networks

4.2 out of 5

112 reviews
96% willing to recommend

Leave a review

What is Cortex XDR by Palo Alto Networks?

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Get the Cortex XDR by Palo Alto Networks Buyer's Guide and find out what your peers are saying about Cortex XDR by Palo Alto Networks, CrowdStrike Falcon, Microsoft Defender for Endpoint and more!

Cortex XDR by Palo Alto Networks is the #1 ranked solution in top AI-Powered Cybersecurity Platforms solutions, #2 ranked solution in top Ransomware Protection solutions, #4 ranked solution in endpoint security software, #5 ranked solution in XDR Security products, and #6 ranked solution in EDR tools. PeerSpot users give Cortex XDR by Palo Alto Networks an average rating of 8.4 out of 10. Cortex XDR by Palo Alto Networks is most commonly compared to CrowdStrike Falcon: Cortex XDR by Palo Alto Networks vs CrowdStrike Falcon. Cortex XDR by Palo Alto Networks is popular among the small business segment, accounting for 40% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 12% of all views.

Buyer's Guide

Cortex XDR by Palo Alto Networks

May 2026

Get the report

Helped 895,891 peers since 2012

Featured Cortex XDR by Palo Alto Networks reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

The most valuable aspect of Cortex XDR by Palo Alto Networks for me is its integration with AI detection, where we get to know the behavioral detection based on users, traffic patterns, and different services that we consume. It's more about user and behavior analysis with upfront detection rules and automation that we can integrate with for orchestration purposes. It's effective. We have seen multiple occasions where we were notified with the detection rule, and the SOC team engaged with us, and we took the remediation action as and when it was highlighted. The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources. We have AI detection for different levels of user behaviors, and we integrate with the firewall engines and WAF, along with the EDRs and XDR, so that we have a complete overall security view and have gained much more confidence in it.

Read full review

Surya Kumar Gedala

Final Year Student at Gitam University

The best features Cortex offers in my experience include its capability for detection and investigation, along with several types of threat intelligence management. It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds. In playbooks, automation handles responding actions such as isolating endpoints or enriching IOCs, along with reducing mean time to detect and mean time to respond. I have used this for my SOC operations environment, discussing it with my college. Automation and playbooks have helped me significantly. If there is a threat, detecting it used to be a lengthy process. Now, with the advancement in technology, Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context. These automations collect relevant indicators such as hashes, IP addresses, or domains efficiently and can detect and block malicious attacks with firewalls. It is very useful for eliminating workload of human errors, speeding responses for next-generation operations. Playbooks are customizable with dynamic analysis that align with organizational policies.

Read full review

Jagannath S

Cyber Security Engineer at Olacabs

The best features of Cortex XDR by Palo Alto Networks, which I have been using for almost a year, include the very nice operating system and user interface that is so user-friendly, making it very beginner-friendly. You can learn it in less than a week, covering almost all the queries and everything. You can understand the alert very simply. It makes investigation easier and faster, which is the main highlight. I assess the effectiveness of the AI-driven endpoint security in Cortex XDR by Palo Alto Networks and I know that we only know the risks which are found before. We don't know the risks which are coming in the future. The AI-based detection and BIOC rule detection may help in the future for detecting new threats, which will be helpful for the company. Cortex XDR by Palo Alto Networks helps a lot with blocking sophisticated threats in real-time because we don't have to care much about the threats which are prioritized by ourselves. If we are only getting the detection and XDR detects it, it means we have to take further action. If we set the priority to block or prevent the action, it will automatically do it. This helps to save our time and allows us to do our further investigation after that. How much faster it has become to detect and respond to threats depends on the device and defense actions, averaging around 30 minutes. I have experienced a reduction in alert triage since integrating Cortex XDR by Palo Alto Networks because you can configure the rules and fine-tune them according to the alerts we get. This will be very helpful to prevent false positives. It is very easy to fine-tune in XDR and will take around 15 to 20 minutes if you understand the concept. This can actually prevent the flooding of alerts and will be helpful for triaging the most prioritized alerts. Implementing Cortex XDR by Palo Alto Networks has had a significant impact on my security analyst workload because it becomes much easier. If you are installing something like an antivirus, it cannot actually prevent us from accessing the endpoint through our computer. Cortex XDR actually helps to access the computer very easily in a short time. The tool is actually really fast and connects very quickly if you want to access the system. It detects and prevents according to the BIOC rule very well, and we get the alert as well. Then we can do the further investigation using that alert. The UI is very simple, and you can connect and check whatever you want in another device. In our company, we mostly depend on XDR. Cortex XDR by Palo Alto Networks saves me a lot of time because when we get the alert in some other tools, we used to check the alerts using XDR. It only takes a simple time to check the endpoint and determine what activities are going on with XDR. You don't have to get the user's laptop or approach the user at all. You can actually do it from your device very easily. This actually saves a massive amount of time per day.

Read full review

Cortex XDR by Palo Alto Networks mindshare

Product category:

As of May 2026, the mindshare of Cortex XDR by Palo Alto Networks in the Extended Detection and Response (XDR) category stands at 4.7%, down from 5.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Extended Detection and Response (XDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	4.7%
CrowdStrike Falcon	9.4%
SentinelOne Singularity Endpoint	5.9%
Other	80.0%

Extended Detection and Response (XDR)

PeerResearch reports based on Cortex XDR by Palo Alto Networks reviews

Type	Title	Date
Category	Extended Detection and Response (XDR)	May 23, 2026	Download
Product	Reviews, tips, and advice from real users	May 23, 2026	Download
Comparison	Cortex XDR by Palo Alto Networks vs CrowdStrike Falcon	May 23, 2026	Download
Comparison	Cortex XDR by Palo Alto Networks vs SentinelOne Singularity Endpoint	May 23, 2026	Download
Comparison	Cortex XDR by Palo Alto Networks vs TrendAI Vision One	May 23, 2026	Download

Valuable Features

Cortex XDR by Palo Alto Networks offers advanced AI-driven threat detection, behavior-based detection, and anti-exploit features. It integrates seamlessly with other Palo Alto products and provides robust automation and incident response capabilities. Users appreciate its ease of use, scalability, real-time visibility, and centralized management. Features like WildFire AI, USB control, and endpoint isolation are particularly valued for their effectiveness in protecting against sophisticated threats and ensuring comprehensive network and endpoint security.

"The biggest positive impact I see from Cortex XDR by Palo Alto Networks is a significant reduction in the number of people required to manage it."
"Cortex XDR by Palo Alto Networks is specifically designed to prevent zero-day attacks and is part of an ecosystem of Palo Alto, providing customers with a long-term vision to modify and redesign how security is applied in their company."
"I recognize that Cortex XDR by Palo Alto Networks is one of the best products in its category regarding capabilities."

Room for Improvement

Cortex XDR by Palo Alto Networks requires better integration with both its own and third-party products. The interface is complex and customization options are limited. Licensing changes and high costs are problematic. Endpoint performance and management need enhancement, particularly for Windows, Linux, and Mac versions. False positives are frequent and the dashboard lacks user-friendly features. Support and training could improve, alongside features such as email alerts, reporting, and automation. Responding to threats and managing network protocols should be enhanced.

"Cortex XDR by Palo Alto Networks is not only pricey; it is extremely expensive."
"The negative aspect I see is the economic model used by Palo Alto."
"Cortex XDR by Palo Alto Networks could improve its user interface, which is more complicated compared to competitors such as SentinelOne."

ROI

Cortex XDR by Palo Alto Networks provides significant cost savings and operational efficiency. Customers experience peace of mind from reduced security incidents, enhanced compliance, and fewer administrative efforts. Its cost-effectiveness compared to alternatives like Microsoft Defender XDR allows financial benefits through operational savings. Users noted a decrease in malware infections and increased user satisfaction. The automated remediation capabilities lower staffing needs, and the comprehensive security ensures valuable protection against breaches, making it a crucial investment for organizations.

Pricing

Cortex XDR by Palo Alto Networks is often seen as an expensive solution, with pricing that varies based on the number of users, endpoints, and additional features. While some users find it fairly priced, others note its high costs compared to competitors like Sophos and SentinelOne. The licensing is generally yearly with recurring costs, and potential extra charges for added functionalities like VPN and advanced threat protection. Despite the expense, many consider it valuable for its strong security capabilities.

"The tool's price is moderate."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"The cost depends on your chosen license type, like Pro or other licenses."

Popular Use Cases

Organizations primarily use Cortex XDR by Palo Alto Networks for endpoint protection, emphasizing anti-malware and exploit prevention. It leverages behavior analysis, machine learning, and artificial intelligence for threat detection and response. Cortex XDR integrates seamlessly with firewalls, VPNs, and other security tools, providing a centralized security management system. It offers features like malware detection, threat prevention, threat intelligence, endpoint monitoring, and behavior analysis, ensuring comprehensive protection for networks in diverse environments, including remote work settings.

Service and Support

Cortex XDR by Palo Alto Networks' support varies. Some users praise its quick, knowledgeable assistance, while others face challenges like slow responses and language barriers. Some report improvement over time, noting that support has become more knowledgeable and available in the United States, eliminating language issues. Feedback suggests that premium support is superior, with performance linked to specific support plans. Efficient, responsive service is noted, but some still experience issues with escalation and specialized support.

Deployment

Cortex XDR by Palo Alto Networks' initial setup is generally straightforward, with many finding it easy to deploy. Organizations appreciate its flexibility, allowing features to be activated as needed. Complexity can vary based on infrastructure knowledge and the extent of deployment. Cloud-based deployment simplifies the process, enabling quick setups. Some find the administrative aspect challenging, especially in creating detailed profiles, but careful preparation can mitigate difficulty, making the setup manageable for most.

Scalability

Cortex XDR by Palo Alto Networks is highly scalable, suitable for varying organizational sizes, from small teams to large enterprises. Deployment is smooth whether on-premises or cloud-based, handling thousands of endpoints efficiently. Many organizations note its ease of expansion, achievable by adding licenses. The cloud functionality and flexibility allow rapid scaling to accommodate more users or devices without significant challenges, demonstrating its robustness and effectiveness in handling increased demand and workloads.

Stability

Users report Cortex XDR by Palo Alto Networks as highly stable, though some early bugs and upgrade issues were noted. Stability improved with newer versions. Minor database and false alert issues were observed, but no major downtimes. Users appreciate its reliable performance, with no significant crashes or freezes. Even with high data loads, it remains responsive, though some lagging occurred during peak activities. It is preferred over other competitors for its consistent performance.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Cortex XDR by Palo Alto Networks Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company Size	Count
Small Business	45
Midsize Enterprise	19
Large Enterprise	41

By reviewers

By visitors reading reviews
Company Size	Count
Small Business	1682
Midsize Enterprise	1060
Large Enterprise	1468

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

12%

Construction Company

12%

Comms Service Provider

Manufacturing Company

Outsourcing Company

Computer Software Company

Healthcare Company

Government

University

Retailer

Educational Organization

Energy/Utilities Company

Media Company

Transportation Company

Real Estate/Law Firm

Insurance Company

Hospitality Company

Wholesaler/Distributor

Performing Arts

Pharma/Biotech Company

Marketing Services Firm

Recreational Facilities/Services Company

Non Profit

Legal Firm

Religious Institution

Recruiting/Hr Firm

Logistics Company

Compare Cortex XDR by Palo Alto Networks with alternative products

Learn more about Cortex XDR by Palo Alto Networks

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Cortex XDR by Palo Alto Networks was previously known as Cyvera, Cortex XDR, Palo Alto Networks Traps.

Cortex XDR by Palo Alto Networks customers

CBI Health Group, University Honda, VakifBank

Product Categories

Extended Detection and Response (XDR)

Endpoint Protection Platform (EPP)

Endpoint Detection and Response (EDR)

Ransomware Protection

AI-Powered Cybersecurity Platforms

Popular Comparisons

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Wazuh vs Cortex XDR by Palo Alto Networks

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Darktrace vs Cortex XDR by Palo Alto Networks

IBM Security QRadar vs Cortex XDR by Palo Alto Networks

Microsoft Sentinel vs Cortex XDR by Palo Alto Networks

Varonis Platform vs Cortex XDR by Palo Alto Networks

Elastic Security vs Cortex XDR by Palo Alto Networks

Huntress Managed EDR vs Cortex XDR by Palo Alto Networks

Tanium vs Cortex XDR by Palo Alto Networks

HP Wolf Security vs Cortex XDR by Palo Alto Networks

Trellix Endpoint Security Platform vs Cortex XDR by Palo Alto Networks

TrendAI Vision One vs Cortex XDR by Palo Alto Networks

WatchGuard Firebox vs Cortex XDR by Palo Alto Networks

See all alternatives

Cortex XDR by Palo Alto Networks Reviews Summary
Author info	Rating	Review Summary
Senior Process Expert at A.P. Moller - Maersk	4.5	I value Cortex XDR's AI detection and 360-degree security view. Initial false positives and feature gaps were resolved, making it stable, scalable, and well-supported. It now offers complete visibility and reduced operational overhead, justifying its cost.
Final Year Student at Gitam University	4.5	I found Cortex to be the best endpoint detection tool, extensively using its automation and playbooks for incident response and threat intelligence. While highly effective and stable, I suggest improvements like UI simplicity, faster sync, and better third-party integrations.
Cyber Security Engineer at Olacabs	4.5	I find Cortex XDR highly effective; its intuitive UI simplifies threat detection, investigation, and real-time threat blocking, saving me significant time. However, its cost might be prohibitive for smaller companies.
Network Security Engineer at Cyberwell Solution	5.0	I find Cortex XDR excellent for securing acquired clinics, preventing incidents effectively with its simple management, stability, and scalability. I value its strong ROI and excellent support, though I believe the end-device application viewing feature should be free.
Head of data centers at a non-profit with 10,001+ employees	4.0	I find Cortex XDR highly effective for AI-driven threat blocking and investigation, significantly reducing our risk and outperforming previous solutions. Its performance and support are excellent, but I consider its financial cost to be very high.
Business Development Manager For Palo Alto Networks at a tech services company with 1,001-5,000 employees	4.0	I rate Cortex XDR highly for its zero-day prevention and ecosystem. However, the 200-license minimum and missing MSSP model hinder adoption for smaller companies, despite its stability and scalability. Customer support needs improvement.
Principle Cloud Architect at a tech services company with 11-50 employees	4.0	I found Cortex XDR excellent for replacing traditional antivirus, significantly reducing staff, and improving threat detection. While expensive, it offers strong integration within the Palo Alto ecosystem, delivering great value. I hope for more non-Palo integrations and improved container security.
Network Security Administrator at Alethe Consulting Pvt. Ltd	4.0	I highly recommend Cortex XDR for its seamless Palo Alto firewall integration, comprehensive endpoint security, and reduced analyst workload. Its GUI and AI features are excellent. My main suggestion is for Palo Alto to lower its pricing for wider market scalability.

Title	Rating	Mindshare	Recommending
CrowdStrike Falcon	4.3	9.4%	97%	140 interviews Add to research
Microsoft Defender for Endpoint	4.1	N/A	95%	213 interviews Add to research

Cortex XDR by Palo Alto Networks Reviews

What is Cortex XDR by Palo Alto Networks?

Featured Cortex XDR by Palo Alto Networks reviews

Cortex XDR by Palo Alto Networks mindshare

PeerResearch reports based on Cortex XDR by Palo Alto Networks reviews

Valuable Features

Room for Improvement

ROI

Pricing

Popular Use Cases

Service and Support

Deployment

Scalability

Stability

Review data by company size

Top industries

Compare Cortex XDR by Palo Alto Networks with alternative products

Learn more about Cortex XDR by Palo Alto Networks

Cortex XDR by Palo Alto Networks customers

Related questions

Product Categories

Popular Comparisons