Cortex XDR by Palo Alto Networks vs Intercept X Endpoint comparison

You must select at least 2 products to compare!
Microsoft Logo
6,000 views|4,488 comparisons
97% willing to recommend
Palo Alto Networks Logo
29,736 views|16,699 comparisons
94% willing to recommend
Sophos Logo
19,608 views|16,554 comparisons
95% willing to recommend
Comparison Buyer's Guide
Executive Summary
Updated on Aug 18, 2022

We performed a comparison between Cortex XDR by Palo Alto Networks and Sophos Intercept X based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Users of Cortex XDR by Palo Alto Networks mention that deployment is straightforward. Some users of Sophos Intercept X consider the deployment to be easy while others think it is complex.
  • Features: Users of both solutions are happy with the products’ stability and scalability.

    Cortex XDR users like the solution’s ease of use, its centralized console, and its real-time scanning. Users would like to see an on-premises version, better automation capabilities, and enhanced reporting.

    Users of Sophos Intercept X like the solution’s easy management, easy administration, reliability, and centralized view. Users mention that the product does not handle USB products very well and say it would be better if all components could be managed under the same umbrella.
  • Pricing: Users of Cortex XDR say the price is reasonable. Some users of Sophos Intercept X also say the pricing is reasonable, but other reviewers say they would prefer it if the price was lower.
  • Service and Support: Users of Cortex XDR find the technical support to be helpful, knowledgeable, and responsive. Users of Sophos Intercept X share mixed opinions. Some say they wish there were faster response times, while other users express they have been very good, responsive, and adept.

Comparison Results: Overall, users of Cortex XDR by Palo Alto Networks give the product higher ratings because its deployment is easier, it has a great set of features, it is affordable, and the technical support is helpful.

To learn more, read our detailed Cortex XDR by Palo Alto Networks vs. Intercept X Endpoint Report (Updated: May 2024).
771,740 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
"The timeline feature is excellent. I also like the phishing simulation. We have phishing campaigns to educate employees and warn them about these threats.""It gives a lot of flexibility in terms of configuration and customization as per the business requirements.""The most valuable features are spam filtering, attachment filtering, and antivirus protection.""Microsoft 365 Defender is simple to upgrade.""The advantage of Microsoft Defender XDR has over other XDRs in the market is that it's easy to use. You can quickly differentiate between alerts, incidents, devices, software, etc. It's easier to investigate an incident, and you have so many options. You can automate investigations and use playbooks. There's also the live response session, which is something you can't find in any other XDR.""The most valuable feature depends on the scenario. For compliance, I like Microsoft Purview Information Protection and Data Loss Prevention. Sentinel is the most helpful feature for security. 365 Defender helps us prioritize threats across an enterprise. It's a crucial feature for the managed services team.""The EDR and the way it automatically responds to ransomware and other attacks are valuable features.""The EDR features are valuable. By getting the EDR features, we have more control over the device. We have information about events in real-time and more protection against zero-day threats and zero-day vulnerabilities. We can monitor every event or action that a device is going through. We can get an idea if it is something malicious or if we have to take any actions."

More Microsoft Defender XDR Pros →

"Monitoring is most valuable.""The solution allows us to make investigations. Other XDR solutions also provide similar capabilities but for investigation, Cortex XDR is better.""Cortex XDR's most valuable feature is its intelligence-based dashboards.""Its interface and pricing are most valuable. It is better than other vendors in terms of security.""The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past.""The behavior-based detection feature is valuable.""The most valuable feature is that you can select remote access of any machine for sandboxing.""Cortex XDR is a very capable solution for protecting large networks and a lot of endpoints. It's very useful because the automation is very high, and if you combine it with the features on Palo Alto firewalls, it provides very strong protection."

More Cortex XDR by Palo Alto Networks Pros →

"The solution's initial setup process was straightforward.""We have found the pricing to be reasonable.""The product is user-friendly.""It is easy to change the size of its capabilities, i.e. to expand processes or scale the size of users.""Since it's cloud-managed, the solution is easy to administer, especially if the person using it is in a different geophysical location.""Technical support is responsive and adept.""It is easy to interact with, and its cost is also good.""The most valuable feature is the CryptoGuard in Sophos. In a case of a ransomware attack, this feature comes into action to protect us."

More Intercept X Endpoint Pros →

"At times, when we have an incident email and we click on the link for that incident, it opens a pop-up, but there is nothing. It has happened a couple of times.""There is definitely scope for improvement in the automation area. Because the solution is a SaaS platform, we don't have the overall ability to automate stuff.... There is no direct way to go ahead because it's a SaaS platform.""The user interface of Microsoft 365 Defender could improve. They could make it simpler.""Customers say they want absolutely seamless integration between other Microsoft solutions and Defender XDR, including the ability to change device settings within the Defender portal. They need to contact the IT team responsible for the device management tools to change some settings. They would prefer that those changes be initiated directly from the Defender portal or applied from Intune without involving the IT operations team.""I'd like to see a wider solution that includes not only desktop devices but also other devices, such as servers, storage cabinets, switching equipment, et cetera.""The only problem I find is that the use cases are built-in. There is no template available that you can modify according to your organization's standards. What they give is very generic, the market standard, but that might not be applicable to every organization.""Stability could be improved by avoiding frequent changes to the interface.""The management features could be improved, particularly in terms of better integration with Intune, Microsoft's cloud-based management solution."

More Microsoft Defender XDR Cons →

"Cortex XDR is trickier to configure than other Palo Alto products. This is one area where we are not so satisfied.""The encryption is not up to the mark.""Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis.""The product's pricing needs improvement. They could provide more discounts. Additionally, the dashboard and control panel could be enhanced.""We had a problem with getting our older endpoints up to date, but their newest updates have been really good. I've been pleased with it in terms of what our needs are. It's doing what we want it to do.""We would also like to have advanced tech protection and email scanning.""There are a large number of false positives.""The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."

More Cortex XDR by Palo Alto Networks Cons →

"Mobile device management is a challenging area, and it can be improved. Some areas in the DLP solution can also be improved. It has the DLP capability, but it is not an all-out DLP program. I would like to see them improve the DLP solution in terms of reporting and possibly network monitoring. Currently, they only do the reporting parts of it.""We are not able to merge the sub-estates. If we create multiple sub-states and there may be instances where a user is in a different sub-state, it may not be possible for us to relocate that user from one sub-state to another through the console. We have to merge them manually which is not ideal.""We had some initial problems with our deployment, and they were more around uninstalling Sophos Basic and installing Sophos Intercept X. We had some challenges with some of the uninstallation scripts. They can improve the deployment of Sophos Intercept X when there is already an existing Sophos version. They can also provide more information in the form of best practices and lessons learned from previous findings. A knowledge base with this type of information would be helpful.""Sophos Intercept X doesn't have its own firewall that utilizes the Windows Firewall or intrusion prevention.""It has a performance hit on a local laptop. There's an agent installed and we are bothered a lot by it because it seems to be using a lot of computer resources.""Needs more flexible reporting, particularly for medium to large size companies.""The performance offered by the product needs improvement.""The solution's pricing could be better."

More Intercept X Endpoint Cons →

Pricing and Cost Advice
  • "The solutions price is fair for what they offer."
  • "The price could be better. Normally, the costs depend on the country you're located in for the license. When we were in the initial stage, we went with the E5 license they call premium standard. It cost us around $5.20 per month for four users."
  • "The price of the solution is high compared to others and we have lost some customers because of it."
  • "Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
  • "We have a lot of problems in Latin America regarding the price of Microsoft 365 Defender, because the relationship between dollars and the money of the different countries, it's is a lot. Many customers that have small businesses say that they would like the solution but it is too expensive. However, large companies do not find the cost an issue."
  • "The most valuable licensing option is expensive, so pricing could be improved. Licensing options for this solution also need to be consolidated, because they frequently change."
  • "Microsoft should provide lower-level licensing options. They should do it in such a way that even an individual could purchase a license, and it should be entirely flexible."
  • "They have moved from a licensing model to pay-per-use... The question is: What happens if, for any reason, there's not enough budget to accept this model? That could be a great problem."
  • More Microsoft Defender XDR Pricing and Cost Advice →

  • "I feel it is fairly priced."
  • "The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
  • "We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
  • "It is "expensive" and flexible."
  • "Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
  • "I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
  • "It is cost-effective compared to similar solutions. It fits for the small businesses through to the big businesses."
  • "The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."
  • More Cortex XDR by Palo Alto Networks Pricing and Cost Advice →

  • "We renew the license for one year at $10,000."
  • "The price is pretty good."
  • "When you start going to the EDR technologies and the MTR, it is a little bit expensive. It's a very good technology, and obviously, you're going to pay for it, but the pricing could do a little bit of work."
  • "We were able to eliminate the ransomware using the one-month, full-featured trial license."
  • "Licensing is based on the number of users. They give a discount for editors who are considered as important members. From what I know, Sophos products are not expensive. If you have a license extension, you just need to contact the editor or partner to change the mode of licensing or extend the license to cover more people."
  • "Intercept X for endpoints is around $35 per user per year. The server version is $95 per server per year."
  • "I find the pricing to be a little bit expensive, although it is acceptable, for now."
  • "The price of this product should be reduced because it is a little high."
  • More Intercept X Endpoint Pricing and Cost Advice →

    Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
    771,740 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and… more »
    Top Answer:Microsoft Defender XDR is expensive, especially for the full suite functionality. However, when compared to buying… more »
    Top Answer:Improving scalability, especially for very large tenants, could be beneficial for Microsoft Defender XDR. Additionally… more »
    Top Answer:Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks.… more »
    Top Answer:Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that… more »
    Top Answer:Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface… more »
    Top Answer:I like that Crowdstrike Falcon allows me to easily correlate data between my firewalls. Its detection and machine… more »
    Top Answer:The price of the product is okay, in my opinion. The tool's cost per user and per annum basis is around INR 700 to 800.
    Also Known As
    Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
    Cyvera, Cortex XDR, Palo Alto Networks Traps
    Sophos Intercept X
    Learn More

    Microsoft Defender XDR is a comprehensive security solution designed to protect against threats in the Microsoft 365 environment. 

    It offers robust security measures, comprehensive threat detection capabilities, and an efficient incident response system. With seamless integration with other Microsoft products and a user-friendly interface, it simplifies security management tasks. 

    Users have found it effective in detecting and preventing various types of attacks, such as phishing attempts, malware infections, and data breaches.

    Watch the Microsoft demo video here: Microsoft Defender XDR demo video.

    Cortex XDR by Palo Alto Networks is the first threat detection and response software to combine both visibility across all types of data as well as autonomous machine learning analytics. Threat detection very often requires analysts to divide their attention among many different data streams. This platform unifies a vast variety of data flows, which allows analysts to assess threats from a single location. Users can now maintain a level of visibility that other threat detection programs simply cannot offer. This level of transparency lends itself to both quick identification of problems that arise and the equally quick development of a potential solution.

    Cortex XDR’s machine learning works on many different levels to detect and prevent threats. It is constantly scanning for threats and vulnerabilities. The solution can scan up to 5.4 billion IP addresses in three-quarters of an hour. This allows it to spot weak points in the system and notify administrators long before hackers can take advantage of vulnerabilities. Once the Artificial Intelligence (AI) discovers an issue or an area where an issue could potentially take place the system creates a log of the information and subsequently sends an alert to system administrators. The AI takes the information that it has gathered and uses it to assign threat levels to the issues that it detects. Following this, a human analyst will be assigned to manually assess the issue and deal with it accordingly. You can set it to automatically respond to the threat by isolating the issue while analysts investigate it.

    Benefits of Cortex XDR

    Some of Cortex XDR’s benefits include:

    • The use of advanced AI analytics, behavior analytics, and custom-made detection to detect advanced threats before they occur.
    • The ability to group similar threat alerts, reducing incoming alerts by as much as 98%. This allows analysts to avoid being overwhelmed by the volume of incoming alerts.
    • The ability to investigate threats as much as 8 times faster than would be possible with other software. The machine learning, when coupled with the unified data stream that Cortex XDR collects, significantly increases the ability to more quickly discover the root cause of a threat.

    Reviews from Real Users

    Cortex XDR by Palo Alto Networks software stands out among its competitors for a number of reasons. Two major ones are its ability to isolate threats while enabling them to be studied and the way that the software combines all of the data that it gathers into a single, more complete picture than other solutions offer.

    PeerSpot users note the effectiveness of these features. A network designer at a computer software company wrote, “The solution has a very helpful isolation feature. If any system gets compromised, with one click I can access the system and isolate it from other networks, and then go into further forensic investigation of the current threat without compromising anything else.”

    Jeff W., Vice President/CTO at Sinnott Wolach Technology Group, noted, “The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly.”

    Sophos Intercept X Endpoint is a comprehensive cybersecurity solution that combines the power of artificial intelligence (AI) with Sophos' deep expertise in cybersecurity to provide unmatched protection against sophisticated cyber threats, including ransomware, malware, exploits, and zero-day vulnerabilities. Sophos Intercept X Endpoint stands out for its innovative approach to endpoint security, leveraging advanced technologies and expert services to provide comprehensive protection. Its focus on prevention, detection, and response, combined with ease of use and scalability, makes it a preferred choice for organizations looking to strengthen their cybersecurity defenses.

    Harness the Power of a Deep Learning Neural Network

    Achieve unmatched endpoint threat prevention. Intercept X uses deep learning, an advanced form of machine learning to detect both known and unknown malware without relying on signatures.

    Deep learning makes Intercept X smarter, more scalable, and more effective against never-seen-before threats. Intercept X leverages deep learning to outperform endpoint security solutions that use traditional machine learning or signature-based detection alone.

    Stop Ransomware in Its Tracks

    Block ransomware attacks before they wreak havoc on your organization. Intercept X with XDR includes anti-ransomware technology that detects malicious encryption processes and shuts them down before they can spread across your network. It prevents both file-based and master boot record ransomware.

    Any files that were encrypted are rolled back to a safe state, meaning your employees can continue working uninterrupted, with minimal impact to business continuity. You get detailed post-cleanup information, so you can see where the threat got in, what it touched, and when it was blocked.

    Intelligent Endpoint Detection and Response (EDR)

    The first EDR designed for security analysts and IT administrators

    Intercept X Advanced with EDR allows you to ask any question about what has happened in the past, and what is happening now on your endpoints. Hunt threats to detect active adversaries, or leverage for IT operations to maintain IT security hygiene. When an issue is found remotely respond with precision. By starting with the strongest protection, Intercept X stops breaches before they start. It cuts down the number of items to investigate and saves you time.

    • The strongest protection combined with powerful EDR
    • Add expertise, not headcount
    • Built for IT operations and threat hunting

    Extended Detection and Response (XDR)

    Intercept X Advanced with XDR is the industry’s only XDR solution that synchronizes native endpoint, server, firewall, email, cloud and O365 security. Get a holistic view of your organization’s environment with the richest data set and deep analysis for threat detection, investigation and response for both dedicated SOC teams and IT admins.

    • Cross reference indicators of comprise from multiple data sources to quickly identify, pinpoint and neutralize a threat
    • Use ATP and IPS events from the firewall to investigate suspect hosts and identify unprotected devices across your estate
    • Understand office network issues and which application is causing them
    • Identify unmanaged, guest and IoT devices across your organization’s environment

    Managed Detection and Response

    • Threat Hunting - Proactive 24/7 hunting by our elite team of threat analysts. Determine the potential impact and context of threats to your business.
    • Response - Initiates actions to remotely disrupt, contain, and neutralize threats on your behalf to stop even the most sophisticated threats
    • Continuous Improvement - Get actionable advice for addressing the root cause of recurring incidents to stop them for occurring again
    Sample Customers
    Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
    CBI Health Group, University Honda, VakifBank
    Flexible Systems
    Top Industries
    Manufacturing Company18%
    Computer Software Company15%
    Financial Services Firm13%
    Computer Software Company17%
    Financial Services Firm10%
    Manufacturing Company8%
    Computer Software Company17%
    Financial Services Firm13%
    Security Firm9%
    Computer Software Company15%
    Financial Services Firm8%
    Manufacturing Company6%
    Financial Services Firm14%
    Manufacturing Company14%
    Computer Software Company12%
    Healthcare Company6%
    Computer Software Company19%
    Comms Service Provider8%
    Educational Organization6%
    Company Size
    Small Business40%
    Midsize Enterprise24%
    Large Enterprise35%
    Small Business26%
    Midsize Enterprise17%
    Large Enterprise57%
    Small Business41%
    Midsize Enterprise22%
    Large Enterprise37%
    Small Business25%
    Midsize Enterprise19%
    Large Enterprise56%
    Small Business63%
    Midsize Enterprise17%
    Large Enterprise20%
    Small Business37%
    Midsize Enterprise20%
    Large Enterprise43%
    Buyer's Guide
    Cortex XDR by Palo Alto Networks vs. Intercept X Endpoint
    May 2024
    Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. Intercept X Endpoint and other solutions. Updated: May 2024.
    771,740 professionals have used our research since 2012.

    Cortex XDR by Palo Alto Networks is ranked 4th in Endpoint Protection Platform (EPP) with 80 reviews while Intercept X Endpoint is ranked 7th in Endpoint Protection Platform (EPP) with 101 reviews. Cortex XDR by Palo Alto Networks is rated 8.4, while Intercept X Endpoint is rated 8.4. The top reviewer of Cortex XDR by Palo Alto Networks writes "Perfect correlation and XDR capabilities for network traffic plus endpoint security". On the other hand, the top reviewer of Intercept X Endpoint writes "A standard offering with good threat analysis but reduces machine performance". Cortex XDR by Palo Alto Networks is most compared with Microsoft Defender for Endpoint, CrowdStrike Falcon, Darktrace, Symantec Endpoint Security and Trellix Endpoint Security, whereas Intercept X Endpoint is most compared with Microsoft Defender for Endpoint, CrowdStrike Falcon, Kaspersky Endpoint Security for Business, SentinelOne Singularity Complete and Bitdefender GravityZone EDR. See our Cortex XDR by Palo Alto Networks vs. Intercept X Endpoint report.

    See our list of best Endpoint Protection Platform (EPP) vendors, best Extended Detection and Response (XDR) vendors, and best Ransomware Protection vendors.

    We monitor all Endpoint Protection Platform (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.