Try our new research platform with insights from 80,000+ expert users

Cortex XDR by Palo Alto Networks vs ThreatLocker Zero Trust Endpoint Protection Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 5, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
7.3
Cortex XDR enhances security, reduces costs, boosts threat identification, compliance, and user confidence, offering cost-effective data protection.
Sentiment score
7.9
ThreatLocker Zero Trust boosts ROI by blocking threats, reducing risks, and enhancing security with seamless integration and quick adaptation.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
I have seen a return on investment with Cortex XDR by Palo Alto Networks, as this product is offered at a minimal cost, and we can find a good ROI from it.
If something were to happen without ThreatLocker, the cost would be huge, and thus, having it is definitely worth it.
The main return on investment is peace of mind, knowing that with ThreatLocker on any endpoint, it will almost always block all malicious code or exploits, even zero-day exploits.
It keeps malware, Trojans, and ransomware at bay.
 

Customer Service

Sentiment score
6.6
Cortex XDR support is responsive and knowledgeable, despite occasional delays and regional language barriers affecting resolution times.
Sentiment score
7.7
ThreatLocker offers exceptional 24/7 customer service with fast issue resolution, highly rated by users for speed and expertise.
Every vendor has similar support; it depends on how the case is handled and raised.
Their support is efficient and responsive whenever I raise a ticket through my portal.
They did well with handling high-risk threats.
They have been very responsive, helpful, and knowledgeable.
I would rate their customer support a ten out of ten.
Their support is world-class.
 

Scalability Issues

Sentiment score
7.5
Cortex XDR is praised for smooth scalability, managing diverse endpoints, and effective expansion in various organizational sizes.
Sentiment score
8.0
ThreatLocker scales efficiently, handling thousands of endpoints easily, with updates and flexible deployment supporting diverse organizational needs.
I started off with just the servers, and within a month and a half, I set up the entire company with ThreatLocker.
It seems to primarily operate on the endpoints rather than at a central location pushing out policies.
I would rate it a ten out of ten for scalability.
 

Stability Issues

Sentiment score
8.0
Cortex XDR is stable, with resolved bugs and ongoing improvements, earning high stability ratings from users.
Sentiment score
7.4
ThreatLocker Zero Trust Platform offers stable performance, minimal downtime, quick issue resolution, and seamless integration with operating systems.
Cortex XDR is stable, offering high quality and reliable performance.
For the last 11 months, we haven't faced any outage issues, so it is a stable product.
All the situations and issues were controlled in a good way by Cortex XDR by Palo Alto Networks.
For five years, we have not had a problem.
Once deployed, it downloads the policies locally, so even if the computer doesn't have internet, it doesn't matter.
It has been very stable, reliable, and accessible.
 

Room For Improvement

Cortex XDR struggles with compatibility, high memory usage, difficult management, limited features, and needs better integration, UI, and pricing.
ThreatLocker could improve by enhancing training, UI, reporting, integration, and support to address approval and update challenges.
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cortex XDR could improve its sales support team, including better commission structures and referral programs.
Controlling the cloud environment, not just endpoints, is crucial.
This is problematic when immediate attention is needed.
Comprehensive 24-hour log monitoring is a valuable enhancement for both business and enterprise-level users.
 

Setup Cost

Enterprise buyers find Cortex XDR expensive, but competitive, with flexible licensing; costs vary by usage, features, and setup.
ThreatLocker offers a cost-effective Zero Trust solution with flexible pricing, appreciated for transparency and easy setup across clients.
Cortex XDR is perceived as expensive by some customers, yet offers dynamic pricing.
Compared to competitors such as CrowdStrike and Sophos, the pricing of Cortex XDR by Palo Alto Networks is similar to CrowdStrike but more expensive than Sophos.
After conversations with other partners, it became clear we underpriced it initially, which caused most of our issues.
We are moving towards the Unified solution, where they basically bundle everything together, providing us better stability with the ability to bring in new product offerings without having to go back to the customer and say, 'This is going to cost you.'
I had a really good deal at the time, and it continues to be cost-effective.
 

Valuable Features

Cortex XDR offers robust endpoint security with advanced threat detection, ease of use, seamless integration, and real-time monitoring capabilities.
ThreatLocker enhances security and reduces costs with application control, instant support, intuitive interface, and comprehensive training resources.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
If a user doesn't click any link within 30 days and on the 31st day clicks a new link, Cortex XDR immediately alerts us that this user has clicked on an uncommon link or their behavior is uncommon.
ThreatLocker Zero Trust Endpoint Protection Platform's ability to block access to unauthorized applications has been excellent.
It protects our customers.
The major benefit is fewer breaches overall, as nothing can be run without prior approval. This helps my company protect its data and secure itself effectively.
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Ranking in Endpoint Protection Platform (EPP)
5th
Ranking in Ransomware Protection
2nd
Average Rating
8.4
Reviews Sentiment
7.3
Number of Reviews
92
Ranking in other categories
Endpoint Detection and Response (EDR) (9th), Extended Detection and Response (XDR) (7th), AI-Powered Cybersecurity Platforms (4th)
ThreatLocker Zero Trust End...
Ranking in Endpoint Protection Platform (EPP)
7th
Ranking in Ransomware Protection
1st
Average Rating
9.2
Reviews Sentiment
7.4
Number of Reviews
40
Ranking in other categories
Network Access Control (NAC) (5th), Advanced Threat Protection (ATP) (6th), Application Control (1st), ZTNA (4th)
 

Mindshare comparison

As of October 2025, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.7%, down from 4.5% compared to the previous year. The mindshare of ThreatLocker Zero Trust Endpoint Protection Platform is 0.9%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Market Share Distribution
ProductMarket Share (%)
Cortex XDR by Palo Alto Networks3.7%
ThreatLocker Zero Trust Endpoint Protection Platform0.9%
Other95.4%
Endpoint Protection Platform (EPP)
 

Featured Reviews

HectorRios - PeerSpot reviewer
Has detected high-risk threats effectively and provides strong behavioral protection
They did well with handling high-risk threats. I would rate Palo Alto support an eight or nine. I would give them an eight because in the majority of cases, we talk with local partners, and only in case of an emergency or a difficult issue, we jump to Palo Alto support. When we had that experience with Palo Alto support, it was nice service, but it was really difficult to get it. To jump from the partner to Palo Alto directly was challenging. I understand that it's part of the service, as the local partner just jumps up to Palo Alto support in case they need it. In some cases, when we faced an important issue, it was preferred to jump directly to Palo Alto to save time.
Johnathan Bodily - PeerSpot reviewer
Ensures ransomware protection and reduces phishing chaos
The application control has been great so far, and while I am still exploring the network access controls, I unfortunately don't have access to one module I would love to have due to licensing restrictions. It's easy to use in regard to reducing attack surfaces. For me, it's a piece of cake. We can have something approved within 30 seconds, thanks to the mobile app. We haven't eliminated security solutions. We just add to it, and ThreatLocker has been a great addition. We also have Kaseya and ThreatLocker as a supplement to that. It's useful. They have overlap, and we look at the overlap as a good thing. It's helped your organization save on operational costs or expenses by ensuring that many fewer hours are spent dealing with ransomware nonsense. I cannot count the amount of hours that I personally have not had to put in to recovering an environment from a ransomware event. The last big one took us about three weeks to completely recover from. Since we've grouped ThreatLocker in, the management of that whole setup has gone down to just daily help desk tasks and general server maintenance instead of having the whole system on fire. There are probably thousands of hours of saved time between our teams. It's been great so far. ThreatLocker Zero Trust Endpoint Protection Platform's ability to block access to unauthorized applications is great. It's my biggest protection, the blocked applications. In a lot of cases, you go to install something yourself that you need for management, and it comes in and says, nope. And then I have to log into the portal and approve it. I get our other guys saying, hey, why are you trying to approve something? Any of the tools that I'm using on a day-to-day basis that haven't been in the environment during the whole learning mode initially, I could go through and set extensions and all that. So, while it's a headache on that end, the amount of saved time I can't even count. It is a little frustrating on my end since I like to go as quickly as I possibly can, and it slows me down. However, that's a really good thing. Depending on the site, it can save a lot of time and cut down headaches. It's likely saved a week's worth of time. It's cut down the amount of sever help desk tickets. Those have become minimal.
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
872,706 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Financial Services Firm
10%
Manufacturing Company
8%
Government
6%
Computer Software Company
27%
Retailer
9%
Manufacturing Company
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business41
Midsize Enterprise18
Large Enterprise36
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise4
Large Enterprise3
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. The ability to reverse damage caused by ransomware with minimal interruptions to...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
What do you like most about ThreatLocker Allowlisting?
The interface is clean and well-organized, making it simple to navigate and find what we need.
What is your experience regarding pricing and costs for ThreatLocker Allowlisting?
Pricing, setup costs, and licensing have been pretty accessible and manageable. It was not too expensive to get started, especially at a small scale for a smaller MSP. It is very accessible, easy t...
What needs improvement with ThreatLocker Allowlisting?
Going with the theme of ThreatLocker Zero Trust Endpoint Protection Platform being a one-stop shop where they have just about everything, and they have a really good product stack as is. However, t...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Protect, Allowlisting, Network Control, Ringfencing
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. ThreatLocker Zero Trust Endpoint Protection Platform and other solutions. Updated: September 2025.
872,706 professionals have used our research since 2012.