Try our new research platform with insights from 80,000+ expert users

Cortex XDR by Palo Alto Networks vs Qualys Multi-Vector EDR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Ranking in Endpoint Detection and Response (EDR)
9th
Average Rating
8.4
Reviews Sentiment
7.3
Number of Reviews
92
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Extended Detection and Response (XDR) (7th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (4th)
Qualys Multi-Vector EDR
Ranking in Endpoint Detection and Response (EDR)
72nd
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
1
Ranking in other categories
Network Detection and Response (NDR) (29th)
 

Mindshare comparison

As of October 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 4.6% compared to the previous year. The mindshare of Qualys Multi-Vector EDR is 0.2%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Market Share Distribution
ProductMarket Share (%)
Cortex XDR by Palo Alto Networks3.8%
Qualys Multi-Vector EDR0.2%
Other96.0%
Endpoint Detection and Response (EDR)
 

Featured Reviews

NiteshSharma - PeerSpot reviewer
Automated threat response and behavioral control improve security measures
I recommend adding a data loss prevention (DLP) solution to Cortex XDR by Palo Alto Networks. The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products. Additionally, multi-tenancy and multi-cloud features are not available and should be considered for inclusion.
reviewer1668453 - PeerSpot reviewer
Provides contextual alerts and risk ratings on findings
It's kind of difficult to quantify areas for improvement. In the larger picture, one challenge is that the NDR space is very crowded today. I can mention half a dozen names just off the top of my head. There are at least 12 to 20 different players. All of them are well-known brand names, and it's difficult to compare them. They all claim to be giving you the same network difference capability: catching malware, dealing with all the minor taxonomy of attack, all that. Still, it's very difficult to compare them side by side because they all do things a little differently, and they all have different presentations and output. We haven't deployed it, so I can't give you what we felt about it exactly. But in the larger perspective, the critical feature is really giving a clear separation between a low, high, and medium criticality. You need a rating that is really true to the actual attack. There's one other capability we are evaluating them for, and it's for custom alerts detection. A lot of these products are trying to profile the threats that are already out there in the industry. They're very well known and published. Today, there are targeted acts being played against organizations, so you have to be sensitive to how your firewalls, protocols, and your HTTP are all operating. You might have some fine-tuned threats that are targeting you, and you should be able to build custom defenses. They should have some openness in terms of how you specify your threats. You get a standard library of threats. On top of it, every organization builds its own.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The product's most valuable features are massive user and feature intelligence exploit detection."
"It blocks malicious files. It prevents attacks. It doesn't require many updates, it's a very light application."
"One of the things that I enjoy the most is using policy extensions. It's like having host firewalls to control USB connections. I think it's a wonderful tool to restrict use when connecting to our computers. Another important tool is Home Insights. That is an add-on to the Cortex solution. I like that because we can see all the vulnerabilities in the environment and control what assets are connected to our network."
"It has pretty much everything we need and works well within the Palo Alto ecosystem."
"Its ability to react to cyber data attacks is awesome. That is pretty much the use of it. What blows your mind is the ability to access your assets remotely and see what is actually going on with them. You can not only see them in a console. You can also react very rapidly to your assets that are compromised."
"Stability is a primary factor, and then there's the ease of distribution and policy management."
"The stability of the solution is very good. We have about 100 users on it right now, and we use it twice a week."
"Since they've done their most recent update, the ease to isolate endpoints is valuable. If we find one where there is a virus on it, we can easily isolate it. We don't even have to contact the user. We don't have to manually take them off the network. We can easily isolate them."
"They can provide you very contextual alerts on if something bad is happening—coming into your network or going out of your network. As part of that, they gather a lot of threat intelligence and map your connections against that. The larger benefit is that they give you a risk rating on their findings."
 

Cons

"If they had pulse rate detection, it would be better."
"It would be good if they could make an exception for applications. Sometimes, it can be a bit of a challenge to make exceptions for certain applications that have been used as rogue."
"Every 30 or 40 days, there's a new version and we need to go and make sure our customer's laptops are upgraded."
"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."
"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."
"In reporting they should have a customizable dashboard due to the fact that C-level people don't like reporting to the IT department. They prefer to have a real-time dashboard. That kind of dashboard needs to have various customizations."
"It'll help if customization was easier."
"The dashboard is the area that needs to improve so that we can have the ability to drill down without having to go elsewhere to verify results."
"My challenge is actually comparing offerings from different vendors across a threat spectrum that is very large. We are talking about millions of threats. How are you confident that Blue Hexagon is catching all one million of them and Palo Alto is doing the same thing? They all have their strengths. Within that, Blue Hexagon might cover 990,000 of them. Palo Alto might cover another 990,000. It's a bit difficult to compare them and say, "Oh, are they catching the same 990,000?" I don't know."
 

Pricing and Cost Advice

"The pricing is okay, although direct support can be expensive."
"I don't recall what the cost was, but it wasn't really that expensive."
"The tool's price is moderate."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"The pricing is a little bit on the expensive side."
"It has a yearly renewal."
"I don't have any issues with the pricing. We are satisfied with the price."
"I don't like that they have different types of licenses."
"It's difficult to state the setup cost. All the NDRs range anywhere between $500,000, plus or minus, to $2 million. There's a spread of pricing here, depending on who you are talking to. Obviously the major brand names want more money. They typically bundle it with their other offerings. With Cisco, for example, you don't just buy an NDR. So, typically it gets rolled into the cost."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
868,759 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Financial Services Firm
10%
Manufacturing Company
8%
Government
7%
Financial Services Firm
14%
Computer Software Company
9%
Retailer
9%
University
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business41
Midsize Enterprise18
Large Enterprise36
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. The ability to reverse damage caused by ransomware with minimal interruptions to...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Ask a question
Earn 20 points
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Blue Hexagon
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Pacific Dental Services, Greenhill and Co, Heffernan Insurance Brokers
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
868,759 professionals have used our research since 2012.