No more typing reviews! Try our Samantha, our new voice AI agent.

Cortex Agentic Endpoint Security vs CrowdStrike Falcon comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cortex Agentic Endpoint Sec...
Ranking in Endpoint Protection Platform (EPP)
39th
Ranking in Endpoint Detection and Response (EDR)
43rd
Average Rating
9.0
Reviews Sentiment
6.6
Number of Reviews
1
Ranking in other categories
AI Security (236th), Agentic Endpoint Security (2nd), Endpoint Control and Prevention (ECP) (7th)
CrowdStrike Falcon
Ranking in Endpoint Protection Platform (EPP)
3rd
Ranking in Endpoint Detection and Response (EDR)
1st
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
204
Ranking in other categories
No ranking in other categories
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
JA
Ciso at CYBERcom
Unified telemetry has transformed our SOC operations and now automates complex incident response
The best features of Cortex Agentic Endpoint Security include UEBA and anomaly detections, all of the activities that happened on the network that are off the baseline. Most of the time in any attack, one of the first stages is something that the system did not see before. This gives us a lot of value, along with the automation part. When it comes to differentiating between benign tools, the criteria security analysts use includes taking a lot of advantage of the playbooks for enrichment and doing partial investigation, searching hashes on different blacklists and different IOC feeds, and searching for IP addresses and domain age. We also use our investigation systems that we built, which involves Cortex in them as a detection source.
JW
Senior Security Engineer at a financial services firm with 10,001+ employees
Centralized endpoint protection has strengthened compliance and accelerated incident response
There are a number of areas that I only touch a handful of times, but when I get in there, I realize why I don't do that. The main area would be within the support area. The support bot is not really as smart as you would expect it, especially in this day and age of LLM and other capabilities that I know CrowdStrike Falcon is already capable of doing. Additionally, I would appreciate a little bit more easy to read insights of some of the dashboards or maybe manipulation of the dashboards. It is still a little cumbersome to build custom dashboards and it's not as intuitive as you would think. Documentation is abysmal and needs to be improved dramatically. I know that there's a big effort to do this, however, even the new effort is honestly worse than it was before. Those are definitely major areas of improvement, just more in the usability of the features.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We can visualize and control the activities in the environment from anywhere."
"We have a complete overview of all our PCs and it's very easy to handle and to use the interface. It has a lot of benefits for us."
"Cortex XDR by Palo Alto Networks has given us better endpoint visibility and richer investigation context, allowing us to identify suspicious activity, understand the attack path, and contain potential threats much faster than before."
"Cortex XDR by Palo Alto Networks is easy to use and does not consume a lot of hardware resources."
"My advice for anybody who is considering Cortex XDR is that it is a complete solution, and has very good features."
"The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past."
"It's a perfect solution. It integrates well into the environment."
"It's a nice product that's stable and scalable."
"Once you add all of the additional features of XAIM and sending third-party logs to the system and using automation, this makes Cortex Agentic Endpoint Security superior to all of the other vendors."
"CrowdStrike Falcon is effortless to use, and it's a cloud-specific platform. You only need to deploy the light agents on the licensed endpoints, and you're ready to work. Your dashboards will tell you the number of the endpoints being protected and the incidents. There are also incident dashboards with alerts that will tell you about the details."
"My advice to others looking into using CrowdStrike Falcon is that it is a very powerful tool that provides a lot of insights."
"The most valuable features of CrowdStrike Falcon are the AI in detecting and real-time detections."
"CrowdStrike Falcon has positively impacted my organization by providing good protection, logs, and reports, which I find very good."
"We have a small IT Team, and this allows us to get sleep at night, knowing that someone else is taking care of any incidents that occur."
"CrowdStrike Falcon is able to identify threats based on processes, rather than looking at signatures and this is what I like about this solution."
"I like the detection rates of mobile threats."
"The Insight feature is one we found the most useful."
 

Cons

"Cortex XDR could improve its sales support team, including better commission structures and referral programs."
"It is an enterprise-level solution. Its price could be less expensive."
"The solution lacks real-time, on-demand antivirus."
"In some cases, there are too many options for me, and it is a bit too hard to find some settings which I really need to implement."
"For Cortex XDR by Palo Alto Networks, if I had to point out improvements, I would say the UI is still somewhat difficult for beginners."
"The tool needs to be improved in terms of integration and interface."
"It automatically detects security issues. It should be able to protect our network devices while operating autonomously."
"Whenever the tool releases a new version when deploying the product across the organization, I feel like there are some disturbances in the CPU usage after upgrading the tool to the latest version."
"I rate the technical support for Cortex Agentic Endpoint Security as not always the best."
"CrowdStrike Falcon could be enhanced by extending its security capabilities to include NDR and XDR."
"Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system."
"CrowdStrike Falcon can be improved in that the UI takes a little bit to understand where to go and how to get there."
"I feel the weakest thing about CrowdStrike Falcon is their documentation."
"An improvement would be to extend support to legacy and unsupported servers."
"We can do a threat analysis of any machine at any time, but that threat analysis is very limited."
"Some policies in the tool need to be fine-tuned. Customized IOCs need to be improved since they have certain shortcomings."
"The main complaint that myself and leadership have about CrowdStrike Falcon is that the cost has become expensive compared to competitors."
 

Pricing and Cost Advice

"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"The pricing is a little high. It is per user per year."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"The price is on the higher side, but it's okay."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"The price was fine."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"The pricing is a little bit on the expensive side."
Information not available
"The pricing could be reduced. If it was more reasonable that would be great."
"There are approximately a hundred different modules you have to purchase, depending on what you want to do. I have most of the modules. How it works is you buy the portfolio, you have to decide all the components you want in it, and then they price out a bundle for you. I have almost all of the package features in my bundle. You only need to pay for the modules you want."
"The pricing will depend upon your volume of usage."
"CrowdStrike Falcon is one of the more expensive endpoint solutions on the market."
"The price of CrowdStrike Falcon is expensive and should be reduced."
"The pricing is not bad. It's on the higher end of the market, but you get what you pay for."
"The product is expensive."
"The price of CrowdStrike Falcon is expensive."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
921,714 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Financial Services Firm
15%
Comms Service Provider
13%
Construction Company
9%
Outsourcing Company
8%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
No data available
By reviewers
Company SizeCount
Small Business62
Midsize Enterprise53
Large Enterprise104
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Ask a question
Earn 20 points
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
Is Crowdstrike Falcon better than Trend Micro Deep Security?
I like that Crowdstrike allows me to easily correlate data between my firewalls. What’s most useful for my needs is t...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Koi
CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface, CrowdStrike Falcon Platform
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Information Not Available
Find out what your peers are saying about SentinelOne, Microsoft, CrowdStrike and others in Endpoint Protection Platform (EPP). Updated: October 2026.
921,714 professionals have used our research since 2012.