No more typing reviews! Try our Samantha, our new voice AI agent.

Coro vs Trellix Endpoint Detection and Response (EDR) comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
7th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
108
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Extended Detection and Response (XDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Coro
Ranking in Endpoint Detection and Response (EDR)
57th
Average Rating
0.0
Reviews Sentiment
3.1
Number of Reviews
1
Ranking in other categories
Email Security (48th), Data Loss Prevention (DLP) (70th), Endpoint Protection Platform (EPP) (51st)
Trellix Endpoint Detection ...
Ranking in Endpoint Detection and Response (EDR)
23rd
Average Rating
7.4
Reviews Sentiment
6.8
Number of Reviews
25
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of April 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Coro is 0.7%, up from 0.5% compared to the previous year. The mindshare of Trellix Endpoint Detection and Response (EDR) is 1.1%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.4%
Trellix Endpoint Detection and Response (EDR)1.1%
Coro0.7%
Other94.8%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Vignesh  K - PeerSpot reviewer
Practice Engineer at Cloudunicorn.in
Auto scanning and enhanced security but re-adding protections need improvement
At that time, we observed certain issues with the product. The functionalities could be improved, such as the isolation feature. If we remove our protection, we cannot easily add it back. If, in our organization, we need to remove a specific system for a particular time, we cannot add it back for security after doing so. This is one thing we have experienced. Scalability is also lacking. If we want to do the same thing repeatedly, there's not much the solution offers; it isn't very strong.
CESARCASTRO - PeerSpot reviewer
Committee Of IT Cybersececurity at a energy/utilities company with 51-200 employees
Cross-site threat hunting has improved visibility and supports proactive incident response
I believe this is a product in evolution. I do not think it is a final tool to conduct forensics or information forensics of the incidents or information incidents that could arise in our network infrastructure. Trellix Endpoint Detection and Response (EDR) is interesting and is a very good entry point that has been evolving through the last years. In the next two months, I have a new contract, and we are pointing out to have an XDR solution with NDR and EDR together. I do not have enough time to do it because I am the manager. However, my coworkers do not understand it yet. I have a contract with a third-party company that is making reports around that, but also they do not have enough experience or enough utility of this. It would be interesting if I have a notification system from EDR. For example, if I am the manager, it would be interesting to have a warning, alarm, or something around that which could call me to get into the system and the dashboard to see what is happening. For example, if it is a high-level threat. However, most of them are just advisory or warnings. I do not enter the tool frequently. I guess I access it once every three months.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It collects and caches and the knowledge of machine learning from different customers to take to the cloud, it makes it better to use for everybody, it allows for quick learning and updates and can, therefore, offer zero-day malware security, and this sharing of metadata helps make the solution very safe."
"The solution allows us to make investigations. Other XDR solutions also provide similar capabilities but for investigation, Cortex XDR is better."
"After deploying Traps, we saw the performance of the network improve by 65 to 70 percent."
"Implementing Cortex XDR by Palo Alto Networks has had a significant impact on my security analyst workload because it becomes much easier."
"Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context, collecting relevant indicators such as hashes, IP addresses, or domains efficiently and can detect and block malicious attacks with firewalls."
"The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly. The way they have done everything and integrated all the solutions that they've purchased over the years to make it a very seamless, effective product is very good. One thing about Palo Alto is that they take the products or services that they purchase and make them seamless for the end user as compared to some companies that purchase other companies and then just kind of have their products off to the side or keep different interfaces. Palo Alto doesn't do that."
"Cortex XDR features advanced threat detection capabilities."
"The product's most valuable features are massive user and feature intelligence exploit detection."
"The auto-scanning feature is quite beneficial."
"The auto-scanning feature is quite beneficial."
"The most useful features are behavior monitoring, DLP, and access control. The automation has gotten much better in the last two years than when it was McAfee. It works better now and integrates more smoothly."
"Blocking browser navigation is a feature of the solution with which we have experienced success."
"The most valuable features of the solution are the ability to isolate or quarantine devices and block or detect Ransomware and other well-known tools that are used to exploit vulnerabilities on devices."
"Trellix has done a good job reducing threats."
"Trellix Endpoint Detection and Response (EDR) does everything; it saves time, it saves money, and of course, it provides peace of mind."
"Trellix Endpoint Detection and Response (EDR) is valuable because we have a Wide Area Network with many sites, and the EDR is cross-site since it is installed and managed from the cloud."
"It relies on external systems for detection and then asks the endpoint to handle blocking. However, the most crucial feature is its investigative capabilities. With real-time search and other functionalities, it enables comprehensive detection and response."
"If there is any malicious behavior in the workstation or server, the tool stops or isolates it automatically and generates alerts."
 

Cons

"This product has not improved my organization - in fact, we are in the process of moving back to another product as a result of Cortex's horrible impact on system performance."
"The solution should force customers to integrate with network traffic to see the full benefits of XDR."
"It would be good to have a better way to search for a file within the UI."
"The product's pricing could be better."
"I would like to see them include NDR (Network Detection Response). Then it would work well with SIEM Response."
"There is a severe gap in functionality between Windows, Linux, and Mac versions."
"Cortex XDR is trickier to configure than other Palo Alto products. This is one area where we are not so satisfied."
"When it comes to core analysis, and security analysis, Cortex needs to provide more information."
"Scalability is lacking. If we want to do the same thing repeatedly, there's not much the solution offers; it isn't very strong."
"The functionalities could be improved, such as the isolation feature."
"Some modules that are doing machine learning and artificial intelligence are blocking our processes."
"The searching capabilities for the IOCs can be further improved"
"One of the issues about the product stems from the failure to work on its administrative scalability. The aforementioned area can be considered for improvement."
"The dashboard is split across different platforms. For example, if you want information on Incident Detection, you have to access one dashboard, and for DLP reporting, there's a separate platform. This fragmentation means you can't access everything from a single dashboard."
"Another area for improvement in the tool is the reporting. My company needs weekly and monthly reports about the alerts, but you can't extract reports from McAfee MVISION Endpoint Detection and Response, so a decision was made to move to another EDR solution, particularly Microsoft Defender for Endpoint, next month."
"I'd like the tool to become more like an XDR, with one management system and endpoint activation."
"The technical support must be improved."
"The dashboard and reporting features are not so user-friendly or intuitive, so they need some work."
 

Pricing and Cost Advice

"It has reasonable pricing for the use cases it provides to the company."
"The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"The pricing is a little bit on the expensive side."
"It is "expensive" and flexible."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"It's about $55 per license on a yearly basis."
"I don't like that they have different types of licenses."
Information not available
"Speaking about the price, you must use the product to find the product's cost for you."
"Pricing for McAfee MVISION Endpoint Detection and Response is not that expensive, but it's not something that a startup could buy. Pricing for it is for midsized businesses. There's an additional payment if you want data retention for more than thirty days. They gave us data retention for thirty days. Then if you want longer data retention, they have the paid option for a three-month data retention period and for a one-year data retention period."
"On a scale of one to ten, where one is low and ten is high, I rate the solution's pricing an eight out of ten."
"The cost is okay, compared to other products."
"McAfee MVISION Endpoint Detection and Response is reasonable in terms of cost. It's a tool my company has been using for a few years now. It costs $25,000 to $30,000 for six hundred users."
"The pricing is always high."
"The price is reasonable."
"The product’s pricing is reasonable."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
885,444 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
14%
Manufacturing Company
8%
Computer Software Company
8%
Financial Services Firm
8%
Construction Company
10%
Computer Software Company
9%
Manufacturing Company
8%
Comms Service Provider
7%
Financial Services Firm
12%
Government
10%
Computer Software Company
9%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise47
No data available
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise3
Large Enterprise11
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Coro?
The cost is reasonable because it is aimed at SMB customers, not enterprise customers. The prices are reasonable. We ...
What needs improvement with Coro?
At that time, we observed certain issues with the product. The functionalities could be improved, such as the isolati...
What is your primary use case for Coro?
We have not sold the product to any customers as of now. We are still in the testing phase, which means we, along wit...
What is your experience regarding pricing and costs for McAfee MVISION Endpoint Detection and Response?
I pay for what we get. But the service level from my partner company is not enough to overcome a complex case.
What needs improvement with McAfee MVISION Endpoint Detection and Response?
I believe this is a product in evolution. I do not think it is a final tool to conduct forensics or information foren...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
McAfee MVISION EDR, MVISION EDR, MVISION Endpoint Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Lenovo, Dropbox, T-Systems
Sutherland Global Services
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: March 2026.
885,444 professionals have used our research since 2012.