


Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
With Cortex XDR by Palo Alto Networks' incident correlation, behavioral detection, and process tree visibility, similar initial triage can often be completed in roughly 10 to 20 minutes, depending on the incident.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
The impact of this consolidation has resulted in greater team cohesion, greater team efficacy, and greater speed of response.
The impact on our operations has been positive, as we have moved several functions from another platform into CrowdStrike Falcon Next-Gen SIEM, resulting in savings in both money and time.
Return on investment with CrowdStrike Falcon Next-Gen SIEM comes from reducing investigation time, consolidating tools, and improving my productivity as an analyst.
The return on investment with Cynet is pretty good, as it doesn't require a dedicated resource to manage, being highly automated.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
What makes the customer service great is that support is both technically sound and empathetic in their understanding of different situations.
We have never had an issue, and if we ask, somebody answers quickly, either our account rep or if we submit a ticket, they are very quick about getting back to us.
The quality is strongest when issues are documented clearly with examples and business impact.
Their SOC side support, when a threat is detected, is excellent.
My experience with the technical support of Cynet is excellent; they are just one click away.
Based on our needs, they schedule remote sessions and resolve the issues.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
CrowdStrike Falcon Next-Gen SIEM scales effectively with the growing needs of my organization.
I would say that CrowdStrike Falcon Next-Gen SIEM scales with the growing needs of my organization.
The scalability of CrowdStrike Falcon Next-Gen SIEM is great as it adapts perfectly well when the number of clients or the volume of data increases.
The solution is highly scalable.
We can deploy Cynet for 50,000 users, and we have deployed it at that scale, with the capability to scale higher to 100,000 users without any challenges.
Cynet is very scalable.
Cortex remains fast and responsive, even with increasing data and alerts.
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Cortex XDR by Palo Alto Networks can be trusted completely.
We have never had issues with reliability or it being down or unavailable, or unreasonably long search times.
I have experienced very minimal downtime, crashes, or performance issues with CrowdStrike Falcon Next-Gen SIEM.
I would describe the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as really good, as it is stable and reliable, triggering everything and figuring out everything, so it saves a lot of time.
Within six years of usage, we have not had any issues such as outages or downtime.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
When a Cortex XDR by Palo Alto Networks incident is confirmed, it would be useful to automatically create a ServiceNow or Jira ticket with the incident summary, including affected endpoints, user indicators, process tree, severity, and recommended response actions.
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
An agent that advises me or notifies me what changes have happened since my last login to the platform, what has changed, what errors it has detected, what connector or parsing failures there have been, and that it gives me a prioritization approach indicating which of these failures are more important and where I should start applying fixes or resolving them.
Necessary improvements revolve around being able to store information in third-party repositories and being able to do federated searches without having to connect to third-party systems.
I would suggest including data normalization, specifically a way to easily normalize data from different sources, as currently you can do it, but it is a little bit more labor-intensive.
There should be more options than deploying solely through group policy, as the assumption that GPO is working isn’t always the case.
Having a DLP feature would also add value.
Integration with local Active Directory, not only Azure AD, is a must.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Compared to CrowdStrike, which is very costly, and SentinelOne, which is also very costly, Cortex XDR by Palo Alto Networks is a medium cost-efficient solution.
there are cheaper vendors, there are more expensive vendors, but in general, I think it is well positioned.
This consolidation has helped us free up a huge cost by being able to remove other tools in favor of a single one.
There have been cases where it has turned out positive and cases where prices have been higher, depending on the specific circumstances and ecosystem of each client.
I think the pricing of Cynet is fair and one of the better options in the market.
The price of Cynet is reasonable considering its features and support.
Cynet does not ask for additional costs for add-on features.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
CrowdStrike Falcon Next-Gen SIEM has had a significant impact on alert volume, false positives, and analyst workload by using lookup tables to improve detection context.
CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events, with things going from days to minutes or hours.
One of the features offered by CrowdStrike Falcon Next-Gen SIEM that is quite useful is Fleet Manager Management, from which I can manage and deploy configurations to LogScale Collectors remotely without needing access to the machines where I collect logs.
When Cynet detected suspicious PowerShell activity, the timeline provided a clear understanding of the sequence of events and the root cause without manually reviewing multiple logs.
The valuable aspects of Cynet are its EDR and XDR components, which are available at a reasonable price point.
The most effective features of Cynet are its ransomware protection and lateral movement deception.


| Company Size | Count |
|---|---|
| Small Business | 50 |
| Midsize Enterprise | 21 |
| Large Enterprise | 57 |
| Company Size | Count |
|---|---|
| Midsize Enterprise | 3 |
| Large Enterprise | 17 |
| Company Size | Count |
|---|---|
| Small Business | 30 |
| Midsize Enterprise | 9 |
| Large Enterprise | 12 |
Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.
Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.
What are the key features of Cortex XDR?Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.
CrowdStrike Falcon Next-Gen SIEM is the execution engine of the Agentic SOC, delivering AI-powered detection, investigation, and response across endpoint, cloud, identity, and third-party data. Built on a data fabric designed for AI, it replaces fragmented legacy SIEM architectures with a unified source of security context, helping analysts and AI agents detect and stop threats faster.
What features make CrowdStrike Falcon Next-Gen SIEM stand out?
What benefits can users expect?
Across industries, CrowdStrike Falcon Next-Gen SIEM helps organizations modernize the SOC, improve analyst productivity, and respond to sophisticated threats with greater speed and efficiency.
Cynet offers robust threat detection and management with automated features, strong endpoint performance, and seamless integration, providing reliable security for businesses of all sizes.
Cynet delivers comprehensive threat protection utilizing automation and 24/7 SOC services. Its user behavior analysis and endpoint performance play a significant role in its functionality. The platform integrates smoothly, promoting high visibility and rapid deployment with minimal memory use. Its intuitive interface and automated breach protection emphasize a user-focused design. Competitive pricing and strong support enhance Cynet's scalability, ensuring efficient threat responses.
What are Cynet's most valuable features?Organizations across sectors, including SMBs, government entities, educational institutions, and financial environments, implement Cynet for endpoint protection, threat detection, and automated incident response. By leveraging tools like EDR, UBA, and NGAV, entities streamline security processes, enhancing protection with minimal staffing and consolidating multiple systems into one unified platform.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.