IT Central Station is now PeerSpot: Here's why

Cortex XDR by Palo Alto Networks vs CrowdStrike Falcon comparison

Cancel
You must select at least 2 products to compare!
Executive Summary
Updated on March 21, 2022

We performed a comparison between Cortex XDR by Palo Alto Networks and CrowdStrike Falcon based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: The majority of Cortex XDR reviewers say the initial setup is straightforward, but a handful of Cortex XDR users say the setup is complex. All CrowdStrike Falcon users write that the initial setup is straightforward.
  • Features: Users of both products are happy with their high level of protection, stability, and scalability. Cortex XDR users report being satisfied with its user interface but would like to see more integration with other platforms. CrowdStrike Falcon users report being very satisfied with its performance and reliability. A few CrowdStrike Falcon users would like to see better reporting abilities and improvements to the dashboard’s user interface.
  • Pricing: Cortex XDR users write that the solution is expensive. Most CrowdStrike Falcon users feel that the price of the product is fair.
  • ROI: While Cortex XDR reviewers do not mention ROI, CrowdStrike Falcon users report a significant ROI.
  • Service and Support: Users of both solutions are happy with the level of support they receive.

Comparison Results: Both products receive high marks from reviewers. However, CrowdStrike Falcon comes out on top in this comparison due to its robust performance, ease of deployment, reasonable cost, and impressive ROI.

To learn more, read our detailed Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon report (Updated: May 2022).
Buyer's Guide
Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon
May 2022
Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon and other solutions. Updated: May 2022.
607,127 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"It is extensive in terms of providing visibility and insights into threats. It allows for research into a threat, and you can chart your progress on how you're resolving it.""The entirety of our network infrastructure is Cisco and the most valuable feature is the integration.""Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us.""It doesn't impact the devices. It is an agent-based solution, and we see no performance knock on cell phones. That was a big thing for us, especially in the mobile world. We don't see battery degradation like you do with other solutions which really drain the battery, as they're constantly doing things. That can shorten the useful life of a device.""The visibility and insight this solution gives you into threats is pretty granular. It has constant monitoring. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. You can see what happened after the threat. You can see what other applications were incorporated into the execution of the threat. For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. Then, after the event, something else was launched by whatever the threat was. Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. This helps you understand and nail down what the threat is and how to fix it.""The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems.""One of the best features of AMP is its cloud feature. It doesn't matter where the device is in regards to whether it's inside or outside of your network environment, especially right now when everybody's remote and taken their laptops home. You don't have to be VPNed into the environment for AMP to work. AMP will work anywhere in the world, as long as it has an Internet connection. You get protection and reporting with it. No matter where the device is, AMP has still got coverage on it and is protecting it. You still have the ability to manage and remediate things. The cloud feature is the magic bullet. This is what makes the solution a valuable tool as far as I'm concerned.""I'm only using the AMP (advanced malware protection) which is protecting my file system from all the malicious things that might happen. It should protect all kinds of things that might happen on the servers, things that I cannot see."

More Cisco Secure Endpoint Pros →

"The most valuable feature is that you can select remote access of any machine for sandboxing.""Their XDR agent and their behavioral indicators of compromise (BIOC) are pretty nice. Their managed threat hunting is also pretty nice. They also have WildFire, which is a service for actively looking for malware. It's quite useful.""The user interface of the solution is sophisticated and straightforward.""I've found the solution to be highly scalable for enterprises.""I like the centralized console and the predictive analysis it does of malware. It is very stable and also scalable.""The protection offered by this product is good, as is the endpoint reporting.""It integrates well into the environment.""Cortex XDR lets us manage several clients from the same console, and its endpoint defense is more advanced than traditional antivirus."

More Cortex XDR by Palo Alto Networks Pros →

"I have found the connection to search the hosts for detections very useful in CrowdStrike Falcon.""The most valuable feature is that we don't need to re-image machines as much as we had to.""The UI is simple and self-explanatory. Everything is easy to understand.""The 10 hours a week that we are freeing up from having to manage and monitor our AV solution has really allowed us to focus on other areas of the business. This has been a huge return on investment.""The initial setup is very simple.""It has definitely minimized resources. When everything was on-prem, there was a lot more work maintaining it. One of the big value tickets: I don't have lists of hundreds of exceptions for certain applications that I have to maintain, add, delete, and move. The very nature of the product has lessened my workload considerably.""One of the most valuable features of CrowdStrike Falcon is when there are upgrades there are no additional fees.""The detection is very reliable. Also, OverWatch is a great feature."

More CrowdStrike Falcon Pros →

Cons
"The GUI needs improvement, it's not good.""The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications.""...the greatest value of all, would be to make the security into a single pane of glass. Whilst these products are largely integrated from a Talos perspective, they're not integrated from a portal perspective. For example, we have to look at an Umbrella portal and a separate AMP portal. We also have to look at a separate portal for the firewalls. If I could wave a magic wand and have one thing, I would put all the Cisco products into one, simple management portal.""The thing I hate the most, which they have not fixed, is when it creates duplicate entries within a console. If you have a computer and you upgrade from Windows 7 to Windows 10, or you upgrade your agent from version 6 to 7, it creates a new instance in there instead of updating the information. Instead of paying a license for one computer, I have to license two computers until I manually go in, search for all the duplicate entries, and clean them out myself.""In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through.""The connector updates are very easily done now, and that's improving. Previously, the connector had an issue, where almost every time it needed to be updated, it required a machine reboot. This was always a bit of an inconvenience and a bug. Because with a lot of software now, you don't need to do that and shouldn't need to be rebooting all the time.""They could improve the main dashboard to more clearly show me the things that I want to see. When I open the dashboard right now, I see a million things and they are not always the things that I need.""We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment."

More Cisco Secure Endpoint Cons →

"We had a problem with getting our older endpoints up to date, but their newest updates have been really good. I've been pleased with it in terms of what our needs are. It's doing what we want it to do.""A little bit more automation would be nice.""Limited remote connection.""Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access.""It should support more mobile operating systems. That is one of the cons of their infrastructure right now.""It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable.""There's an overall lack of features.""It would be better if they could educate the customers more. Some sort of seminars and roadshows will help educate the customers and show what the product can do. The price could be better. It would also help if they had a team for deployment and support."

More Cortex XDR by Palo Alto Networks Cons →

"They need to strengthen the forensic capabilities of this product, for e-discovery.""The product could be more accurate in terms of performance.""This solution could be improved with greater scope for admins to make changes to the solution.""I would rate it an eight out of ten. It does what it needs to do but there's always room for improvement.""In the six months that I have been using CrowdStrike, it has not been able to detect anything.""On the firewall management side, there should be more granularity. There should also be more granularity for device control. Everything else is brilliant.""We would like to be able to perform on-demand scanning, rather than relying on the scheduler.""The solution could improve by providing more types of reports because it's in the detection span you cannot re-export anything. If it could be exported to a CSV file directly there it would help a lot. I currently need to do this by API to get what I need."

More CrowdStrike Falcon Cons →

Pricing and Cost Advice
  • "The visibility that we have into the endpoint and the forensics that we're able to collect give us value for the price. This is not an overly expensive solution, considering all the things that are provided. You get great performance and value for the cost."
  • "Whenever you are doing the licensing process, I would highly advise to look at what other Cisco solutions you have in your organization, then evaluate if an Enterprise Agreement is the best way to go. In our case, it was the best way to go. Since we had so many other Cisco products, we were able to tie those in. We were actually able to get several Cisco security solutions for less than if we had bought three or four Cisco security solutions independently or ad hoc."
  • "In our case, it is a straightforward annual payment through our Enterprise Agreement."
  • "Our company was very happy with the price of Cisco AMP. It was about a third of what we were paying for System Center Endpoint Protection."
  • "There are a couple of different consumption models: Pay up front, or if you have an enterprise agreement, you can do a monthly thing. Check your licensing possibilities and see what's best for your organization."
  • "The Enterprise Agreement is like an all-you-can-eat buffet of Cisco products. In that vein, it was very affordable."
  • "We can know if something bad is potentially happening instantaneously and prevent it from happening. We can go to a device and isolate it before it infects other devices. In our environment, that's millions of dollars saved in a matter of seconds."
  • "The pricing and licensing are reasonable. The cost of AMP for Endpoints is inline with all the other software that has a monthly endpoint cost. It might be a little bit higher than other antivirus type products, but we're only talking about a dollar a month per user. I don't see that cost as being an issue if it's going to give us the confidence and security that we're looking for. We have had a lot of success and happiness with what we're using, so there's no point in changing."
  • More Cisco Secure Endpoint Pricing and Cost Advice →

  • "The pricing is a little high. It is per user per year."
  • "We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
  • "This is an expensive solution."
  • "Its pricing is kind of in line with its competitors and everybody else out there."
  • "Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
  • "The pricing is okay, although direct support can be expensive."
  • "Our customers have expressed that the price is high."
  • "It's about $55 per license on a yearly basis."
  • More Cortex XDR by Palo Alto Networks Pricing and Cost Advice →

  • "The pricing on CrowdStrike is per license. It was about $42 per seat yearly."
  • "The pricing could be reduced. If it was more reasonable that would be great."
  • "Our licensing fees were between $50,000 and $60,000 per year, which was pretty expensive for a small business."
  • "When comparing to Microsoft, CrowdStrike Falcon is more expensive."
  • "All I can say about the licensing cost is that it's negotiable."
  • "The price is too high."
  • "The pricing is good and there are no costs in addition to the standard licensing fees."
  • "We bought a very small number of licenses, then ran it for a year. We bought a 100 licenses for a year, so we didn't actually do a proof of concept. We just bought them. Then, the next year, we bought 10,000 licenses."
  • More CrowdStrike Falcon Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Endpoint Protection for Business (EPP) solutions are best for your needs.
    607,127 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:I'm only using the AMP (advanced malware protection) which is protecting my file system from all the malicious things… more »
    Top Answer:Cisco Secure Endpoint is not too expensive and it's not cheap. It's quite fair.
    Top Answer:They could simplify the solution and make it a little bit easier to understand how things are happening or if something… more »
    Top Answer:Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks.… more »
    Top Answer:Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions… more »
    Top Answer:Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface… more »
    Top Answer:Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing… more »
    Top Answer:The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push… more »
    Top Answer:I like that Crowdstrike allows me to easily correlate data between my firewalls. What’s most useful for my needs is the… more »
    Comparisons
    Also Known As
    Cisco AMP for Endpoints
    Cyvera, Cortex XDR, Palo Alto Networks Traps
    CrowdStrike
    Learn More
    Overview

    Cisco Secure Endpoint is a cloud-managed endpoint security solution that provides advanced protection against viruses, malware, and other cyber threats by detecting, preventing, and responding to threats. Cisco Secure Endpoint is managed online via a web-based management console and can be deployed on a variety of platforms. It protects endpoints, networks, emails, and web traffic.

    In a world of evolving threats, it’s necessary to put security above everything. Cisco Secure Endpoint provides you with the scope, scale, and capabilities to attain effective security with its integrated portfolio and industry-leading threat intelligence. Cisco Secure Endpoint continuously tracks and analyzes files and file activities across your systems - both remote and on premises - and compares these events to other events that occurred before or during past attacks. If a file exhibits malicious behavior, the tool sends an alert which enables you to stop a potential threat from succeeding.

    Key Capabilities of Cisco Secure Endpoint

    • Multi-layered protection: Cisco Secure Endpoint combines behavioral analytics, machine learning, and signature-based techniques to prevent threats from compromising your endpoints.

    • Powerful EDR capabilities: Reduce attack surface using advanced endpoint and extended detection and response, threat hunting, and endpoint isolation.

    • Dynamic malware analysis: Identify and block attacks in real time.

    • Simplified investigations: Advanced search capabilities help you get the information you need about your endpoints fast.

    Reviews from Real Users

    Cisco Secure Endpoint stands out among its competitors for a number of reasons. Two major ones are its ability to enable developers to easily secure their endpoints with one single operation using its management console and its advanced alerting techniques.

    Tim C., an IT manager at Van Der Meer Consulting, writes, "The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."

    Wouter H., a technical team lead network & security at Missing Piece BV, notes, "Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."

    Cortex XDR by Palo Alto Networks is the first threat detection and response software to combine both visibility across all types of data as well as autonomous machine learning analytics. Threat detection very often requires analysts to divide their attention among many different data streams. This platform unifies a vast variety of data flows, which allows analysts to assess threats from a single location. Users can now maintain a level of visibility that other threat detection programs simply cannot offer. This level of transparency lends itself to both quick identification of problems that arise and the equally quick development of a potential solution.

    Cortex XDR’s machine learning works on many different levels to detect and prevent threats. It is constantly scanning for threats and vulnerabilities. The solution can scan up to 5.4 billion IP addresses in three-quarters of an hour. This allows it to spot weak points in the system and notify administrators long before hackers can take advantage of vulnerabilities. Once the Artificial Intelligence (AI) discovers an issue or an area where an issue could potentially take place the system creates a log of the information and subsequently sends an alert to system administrators. The AI takes the information that it has gathered and uses it to assign threat levels to the issues that it detects. Following this, a human analyst will be assigned to manually assess the issue and deal with it accordingly. You can set it to automatically respond to the threat by isolating the issue while analysts investigate it.

    Benefits of Cortex XDR

    Some of Cortex XDR’s benefits include:

    • The use of advanced AI analytics, behavior analytics, and custom-made detection to detect advanced threats before they occur.
    • The ability to group similar threat alerts, reducing incoming alerts by as much as 98%. This allows analysts to avoid being overwhelmed by the volume of incoming alerts.
    • The ability to investigate threats as much as 8 times faster than would be possible with other software. The machine learning, when coupled with the unified data stream that Cortex XDR collects, significantly increases the ability to more quickly discover the root cause of a threat.

    Reviews from Real Users

    Cortex XDR by Palo Alto Networks software stands out among its competitors for a number of reasons. Two major ones are its ability to isolate threats while enabling them to be studied and the way that the software combines all of the data that it gathers into a single, more complete picture than other solutions offer.

    PeerSpot users note the effectiveness of these features. A network designer at a computer software company wrote, “The solution has a very helpful isolation feature. If any system gets compromised, with one click I can access the system and isolate it from other networks, and then go into further forensic investigation of the current threat without compromising anything else.”

    Jeff W., Vice President/CTO at Sinnott Wolach Technology Group, noted, “The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly.”



    CrowdStrike is the leader in cloud-delivered next-generation endpoint protection. CrowdStrike has revolutionized endpoint protection by being the first and only company to unify next-generation antivirus (AV), endpoint detection and response (EDR), and a 24/7 managed hunting service — all delivered via a single lightweight agent. 

    Many of the world’s largest organizations already put their trust in CrowdStrike, including three of the 10 largest global companies by revenue, five of the 10 largest financial institutions, three of the top 10 health care providers, and three of the top 10 energy companies.

    Request a free trial here: https://go.crowdstrike.com/try-falcon-prevent

    Offer
    Learn more about Cisco Secure Endpoint
    Learn more about Cortex XDR by Palo Alto Networks
    Get Fast and Easy Protection Against All Threats

    Protect your organization from all threats - not just malware - even when computers and servers aren’t connected to the internet. Start your free trial and deploy CrowdStrike Falcon within minutes to start receiving full threat protection.

    Sample Customers
    Heritage Bank, Mobile County Schools, NHL University, Thunder Bay Regional, Yokogawa Electric, Sam Houston State University, First Financial Bank
    CBI Health Group, University Honda, VakifBank
    Information Not Available
    Top Industries
    REVIEWERS
    Government13%
    Healthcare Company13%
    Manufacturing Company13%
    University7%
    VISITORS READING REVIEWS
    Computer Software Company23%
    Comms Service Provider20%
    Government7%
    Financial Services Firm5%
    REVIEWERS
    Computer Software Company15%
    Financial Services Firm12%
    Government9%
    Consumer Goods Company9%
    VISITORS READING REVIEWS
    Computer Software Company23%
    Comms Service Provider19%
    Government7%
    Financial Services Firm5%
    REVIEWERS
    Financial Services Firm19%
    Computer Software Company17%
    Energy/Utilities Company9%
    Hospitality Company6%
    VISITORS READING REVIEWS
    Computer Software Company23%
    Comms Service Provider16%
    Government7%
    Financial Services Firm6%
    Company Size
    REVIEWERS
    Small Business37%
    Midsize Enterprise17%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business24%
    Midsize Enterprise20%
    Large Enterprise56%
    REVIEWERS
    Small Business42%
    Midsize Enterprise18%
    Large Enterprise40%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise21%
    Large Enterprise57%
    REVIEWERS
    Small Business31%
    Midsize Enterprise23%
    Large Enterprise46%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise20%
    Large Enterprise57%
    Buyer's Guide
    Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon
    May 2022
    Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon and other solutions. Updated: May 2022.
    607,127 professionals have used our research since 2012.

    Cortex XDR by Palo Alto Networks is ranked 5th in Endpoint Protection for Business (EPP) with 42 reviews while CrowdStrike Falcon is ranked 1st in Endpoint Protection for Business (EPP) with 50 reviews. Cortex XDR by Palo Alto Networks is rated 8.2, while CrowdStrike Falcon is rated 8.8. The top reviewer of Cortex XDR by Palo Alto Networks writes "Easy to set up, reliable, and always scanning". On the other hand, the top reviewer of CrowdStrike Falcon writes "Speeds up the data collection for our phishing playbooks dramatically". Cortex XDR by Palo Alto Networks is most compared with Microsoft Defender for Endpoint, SentinelOne, Symantec Endpoint Security, Sophos Intercept X and Trellix Endpoint Security, whereas CrowdStrike Falcon is most compared with Microsoft Defender for Endpoint, SentinelOne, Darktrace, Carbon Black CB Defense and Fortinet FortiEDR. See our Cortex XDR by Palo Alto Networks vs. CrowdStrike Falcon report.

    See our list of best Endpoint Protection for Business (EPP) vendors.

    We monitor all Endpoint Protection for Business (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.