No more typing reviews! Try our Samantha, our new voice AI agent.

Anomali vs Darktrace comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
4.6
Cortex XDR offers high ROI with reduced costs, improved efficiency, affordable pricing, and enhanced security features compared to competitors.
Sentiment score
6.0
Anomali improves ROI by enhancing SOC efficiency, reducing manual processes, and increasing productivity through automation and AI.
Sentiment score
6.3
Darktrace users experience substantial returns through threat prevention and reduced downtime, despite deployment challenges and difficulty measuring returns.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cyber Security Manager at Welab bank
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
Detection and Response Consultant at Inovasys
In Cortex XDR by Palo Alto Networks, most of the remediation is automated and the accuracy is quite good.
Network Security Engineer at Cyberwell Solution
Analyst productivity has improved significantly, with hours saved because of automation and AI-driven work that Anomali performs.
Global Leadership Council at a tech company with 10,001+ employees
Anomali provides us with a very cost-effective value compared to the market, and I would rate it ten out of ten for return on investment metrics.
Solution Delivery Advisor at a tech vendor with 10,001+ employees
There is a return on investment concerning time and effort saved by 40% after implementing Anomali.
Security Consultant at Deloitte
Other NDR solutions provide virtual appliances that can be deployed on virtualization servers to get up and running quickly.
Technical Consultant - Unix Platform Services at BITS AND BYTE IT CONSULTING PVT LTD
Using this solution provides financial benefits by securing from server attacks, which offers indirect savings.
Systems Specialist/ Administrator at ALFA International Company Limited.
 

Customer Service

Sentiment score
7.0
Cortex XDR is praised for technical support and responsiveness, despite occasional delays and varying regional support quality.
Sentiment score
5.0
Anomali's customer service is praised for expertise and support, though smaller clients face response time challenges.
Sentiment score
7.6
Darktrace's customer service is praised for responsiveness and efficiency, though some suggest improvements for complex issues.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
Head of data centers at a non-profit with 10,001+ employees
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
Senior Process Expert at A.P. Moller - Maersk
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
Chief of IT Architecture at a financial services firm with 10,001+ employees
They have strong onboarding and deployment assistance, provide a dedicated technical account manager for large customers, and engage in regular product updates and customer interaction.
Global Leadership Council at a tech company with 10,001+ employees
The technical support at Anomali is excellent.
Senior Cyber Threat Hunter at a financial services firm with 10,001+ employees
It doesn't seem very professional how they're handling support anymore.
Enterprise Security Architect V at FirstEnergy
The technical support from Darktrace is of high quality.
Network & Security Section Head/Digital Transformation at a government with 201-500 employees
Darktrace provides excellent technical support with a monthly meeting to review platform incidents, ensuring the system functions as expected.
Head of Technology Operations at Pobl Group
The challenge lies in waiting for a response after logging a ticket.
Group Cybersecurity Administrator at Tharisa
 

Scalability Issues

Sentiment score
7.5
Cortex XDR scales well for different organizations, but may be costly for small enterprises despite its cloud-based efficiency.
Sentiment score
8.0
Anomali offers scalable threat intelligence solutions, supporting organizations' growth with seamless tool integration and unlimited data management capacity.
Sentiment score
7.6
Darktrace is praised for its scalability, supporting diverse user bases and integrating well with existing infrastructures.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Assistant Security Architect at Cloudnomics
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Junior Security Analyst at ITSEC Asia
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
Head of data centers at a non-profit with 10,001+ employees
The scalability is massive, allowing us to store millions of indicators.
Enterprise Security Architect V at FirstEnergy
I believe Anomali's scalability is good; whether it is an organization for ten people or one hundred thousand people, the job a threat intel platform has to do will be the same.
Sr. Threat Intelligence Analyst at a tech vendor with 10,001+ employees
Anomali's scalability is impressive as a mature platform capable of processing large amounts of threat intelligence and indicators of compromise data.
Global Leadership Council at a tech company with 10,001+ employees
Darktrace has high scalability, and I would rate it a nine out of ten.
Network & Security Section Head/Digital Transformation at a government with 201-500 employees
Since it's cloud-based, it expands easily.
Head of Technology Operations at Pobl Group
There is still a gap in terms of storage, and we are trying to figure out how to increase that capacity for regulated environments, which require data retention for 5 to 6 years.
Technical Consultant - Unix Platform Services at BITS AND BYTE IT CONSULTING PVT LTD
 

Stability Issues

Sentiment score
8.0
Cortex XDR by Palo Alto Networks is highly stable, resolving early issues and delivering consistent, reliable performance with minimal downtime.
Sentiment score
8.4
Anomali shows high stability and reliability globally but requires improved management of platform changes for better adaptation.
Sentiment score
8.5
Darktrace is highly rated for stability and reliability, with effective monitoring and an intuitive interface despite occasional traffic impacts.
Cortex remains fast and responsive, even with increasing data and alerts.
Final Year Student at Gitam University
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR by Palo Alto Networks can be trusted completely.
Soc Analyst at Softcell Technologies Limited
From a reliability perspective, Anomali consistently injects threat feeds, works on automation, performs reliable API integrations, and supports enterprise scale globally.
Global Leadership Council at a tech company with 10,001+ employees
For example, while Microsoft allows ample time for users to adapt to deprecated features, Anomali only gave us three weeks before switching, so they need to be more cognizant of customer use cases from their engineering side.
Enterprise Security Architect V at FirstEnergy
The good thing is that they have a health check page, and if any issues arise, they notify us.
Lead Cyber Threat Intelligence Incident Response Engineer & Security Engineer at a retailer with 10,001+ employees
The stability of Darktrace is excellent, rated ten out of ten.
Head of Technology Operations at Pobl Group
The appliance itself has never let me down.
Group Cybersecurity Administrator at Tharisa
For stability, I would rate Darktrace an eight out of ten.
Security Analyst at a healthcare company with 10,001+ employees
 

Room For Improvement

Cortex XDR needs better integration, user interface, automation, and competitive pricing, along with reduced performance issues and clearer features.
Anomali needs AI upgrades, improved interface, better threat handling, expanded GenAI, streamlined features, and integration enhancements.
Darktrace needs improved integration, automation, usability, pricing, support, and clarity, plus better endpoint protection and third-party tool integration.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
Final Year Student at Gitam University
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
Pre Sales Architect at network techlab
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cyber Security Information Security Specialist at MHM Holding GmbH
Combining all aliases into a coherent solution would be beneficial, as we had to review each individual source ourselves.
Senior Cyber Threat Hunter at a financial services firm with 10,001+ employees
Anomali should increase their capability to fetch details from various dark web solutions where threat actors post compromised credentials.
Lead Cyber Threat Intelligence Incident Response Engineer & Security Engineer at a retailer with 10,001+ employees
Anomali's ability to correlate and integrate different Threat Intel platforms, such as Mandiant and PolySwarm, is another valuable feature, removing duplicacy and enabling the application of specific IOCs across various security controls.
Associate Consultant at a tech vendor with 1,001-5,000 employees
There is no dedicated salesperson in Egypt, and having one would help to improve focus on this market.
Solution Architect at a tech services company with 51-200 employees
They say they can integrate with most firewalls, but when we did an integration with Meraki MX firewalls, that integration didn't work and still doesn't work to this day.
Security Analyst at a healthcare company with 10,001+ employees
We need Darktrace on each branch to get the data out, and I suggest having some kind of a centralized product that gets data from multiple sources to aggregate and provide the data.
Technical Consultant - Unix Platform Services at BITS AND BYTE IT CONSULTING PVT LTD
 

Setup Cost

Cortex XDR's pricing is seen as reasonable for its advanced capabilities, though setup costs can be perceived as high.
Anomali offers medium to high pricing with flexible licensing, enterprise contracts, and trusted leadership influencing continued usage.
Darktrace is costly yet valued for advanced features, offering flexible module selection with negotiable discounts and yearly contracts.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
Consultant at a tech services company with 1,001-5,000 employees
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Senior Process Expert at A.P. Moller - Maersk
Compared to CrowdStrike, which is very costly, and SentinelOne, which is also very costly, Cortex XDR by Palo Alto Networks is a medium cost-efficient solution.
Soc Analyst at Softcell Technologies Limited
Pricing and licensing are good, but the costs for purchasing threat feeds are somewhat complicated and a bit on the higher side.
Associate Consultant at a tech vendor with 1,001-5,000 employees
My experience with Anomali's pricing is that it is higher compared to other open-source alternatives.
Senior Information Technology Security Consultant at Mideast Data Systems
My experience with pricing, setup cost, and licensing is that there are not many follow-ups, but once we interacted with the product team or the leadership of Anomali, they managed a lot with us, and it all paid off to reach a conclusion that we would continue with this product.
Solution Delivery Advisor at a tech vendor with 10,001+ employees
The product is considered expensive compared to others.
Solution Architect at a tech services company with 51-200 employees
The pricing is costly in USD, and they charge based on device counts.
Group Cybersecurity Administrator at Tharisa
The licensing cost is approximately eight dollars a year.
Security Information & Incident Analyst at a financial services firm with 1,001-5,000 employees
 

Valuable Features

Cortex XDR enhances security with AI-driven analytics, user-friendly management, cloud deployment, and comprehensive threat response features.
Anomali excels in threat intelligence with strong integrations, user-friendly features, and enhances efficiency in threat visibility and response.
Darktrace offers AI-driven threat detection, real-time monitoring, and autonomous response with scalability and ease of integration for enhanced security.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
Cyber Security Manager at Welab bank
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
Pre Sales Architect at network techlab
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
Final Year Student at Gitam University
Regarding integration, Anomali has capabilities to integrate with different downstream applications such as Palo Alto, allowing us to create playbooks to block domains, URLs, or IPs directly within the firewall.
Lead Cyber Threat Intelligence Incident Response Engineer & Security Engineer at a retailer with 10,001+ employees
Correlating IOCs with the telemetry data we are ingesting from our data sources allows us to pull monthly reports identifying how many assets and users interacted with malicious content, giving insight into whether communications failed or users accessed restricted content, providing complete visibility of the IOCs traveling throughout our environment.
Associate Consultant at a tech vendor with 1,001-5,000 employees
It aggregates intelligence from hundreds of sources, automatically de-duplicates, applies risk scoring, applies context, and reduces much manual effort.
Global Leadership Council at a tech company with 10,001+ employees
It is capable of responding to lateral movement and ransomware deployment within environments where there is data exfiltration.
Group Cybersecurity Administrator at Tharisa
I do not need to manually process incidents as Darktrace provides an incident summary, potential detection paths, and other details, all exportable with just a click.
Security Information & Incident Analyst at a financial services firm with 1,001-5,000 employees
If I am in a data center where I don't have layer two, it becomes an issue because the autonomous response is reliant on sending spoofed TCP resets to my core switch to block traffic, which is a major issue.
Security Analyst at a healthcare company with 10,001+ employees
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
115
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Anomali
Ranking in Extended Detection and Response (XDR)
11th
Average Rating
8.0
Reviews Sentiment
6.2
Number of Reviews
13
Ranking in other categories
Security Information and Event Management (SIEM) (10th), User Entity Behavior Analytics (UEBA) (5th), Advanced Threat Protection (ATP) (11th), Threat Intelligence Platforms (TIP) (4th)
Darktrace
Ranking in Extended Detection and Response (XDR)
7th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
84
Ranking in other categories
Email Security (10th), Intrusion Detection and Prevention Software (IDPS) (2nd), Network Traffic Analysis (NTA) (1st), Network Detection and Response (NDR) (1st), Cloud Security Posture Management (CSPM) (10th), Cloud-Native Application Protection Platforms (CNAPP) (9th), Attack Surface Management (ASM) (4th), AI-Powered Cybersecurity Platforms (5th), AI Observability (7th)
 

Mindshare comparison

As of August 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.5%, down from 5.0% compared to the previous year. The mindshare of Anomali is 2.6%, up from 0.3% compared to the previous year. The mindshare of Darktrace is 4.3%, down from 7.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.5%
Darktrace4.3%
Anomali2.6%
Other88.6%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
TarunKumar11 - PeerSpot reviewer
Global Leadership Council at a tech company with 10,001+ employees
Strategic threat intelligence has improved detection speed and consistently reduces analyst workload
Anomali can be improved in various aspects. Its AI-driven automation can further advance, and AI-powered investigation summaries can improve. User experience could be enhanced through simplification of workflows. Better board-level cyber risk dashboards could provide easier visualization. Additionally, Anomali could work on simplifying the pricing structure. Although it excels in threat intelligence aggregation and operationalization, stronger GenAI capability, improved executive reporting, and a more intuitive workflow for analysts would further increase SOC efficiency and add more business value. Regarding Anomali's AI capabilities, governance and security are quite good. Anomali has incorporated AI and machine learning primarily to improve correlation and prioritization. These capabilities are valuable but could be more mature. The platform could achieve better threat correlation, prioritization, more anomaly detection, and allow AI to accelerate intelligence analysis while further improving quality and relevance. The accuracy and reliability of Anomali's AI output are fairly reasonable and good. The AI engine works well, but this capability could be improved. Better threat correlation with threat actors, certain indicators of compromise, malware, and campaigns is possible. Threat prioritization could increase, and alert noise could be reduced through further de-duplication. While reasonable, this is not the best available, and other products possibly have more AI maturity, such as Recorded Future and CrowdStrike Falcon.
Pasan Jayarathna - PeerSpot reviewer
Network Security Engineer at Cyberwell Solution
Monitoring has improved data loss detection and now spots abnormal internal file transfers quickly
In my understanding, the best feature Darktrace offers is the identification of copying files, which acts as a DLP, and it is a main concern for companies because users sometimes copy data outside without knowing, especially those without a technical background. When I mention the DLP-like feature and file copying detection, the alerts have been very timely, as we get an alert within a couple of minutes, which is excellent. Even if some developers are working after hours and copying files, our SOC team detects this, and most of the time they call us so we can identify the users. The alerts are quite accurate and proactive.
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
908,834 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
10%
Comms Service Provider
10%
Manufacturing Company
10%
Financial Services Firm
12%
Construction Company
10%
Comms Service Provider
9%
Outsourcing Company
8%
Manufacturing Company
10%
Financial Services Firm
9%
Computer Software Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise21
Large Enterprise54
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise1
Large Enterprise14
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise29
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Anomali Enterprise?
My experience with pricing, setup cost, and licensing is that there are not many follow-ups, but once we interacted w...
What needs improvement with Anomali ThreatStream?
I can mention one point regarding improvements for Anomali, which is more enhanced reporting flexibility. The reporti...
What is your primary use case for Anomali ThreatStream?
I was using Anomali primarily for threat intelligence operations, security monitoring, and threat detection initiativ...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for Darktrace?
Concerning pricing for the product, I would say it is somewhat expensive.
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Match, Lens, ThreatStream, STAXX, Anomali Security Analytics
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network
Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.
Find out what your peers are saying about Anomali vs. Darktrace and other solutions. Updated: June 2026.
908,834 professionals have used our research since 2012.