Try our new research platform with insights from 80,000+ expert users

CrowdStrike Falcon vs Palo Alto Networks Cortex XSOAR vs VMware Carbon Black Endpoint comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
7.0
CrowdStrike Falcon boosts efficiency and ROI by reducing costs, enhancing security, and streamlining deployment and maintenance.
Sentiment score
5.7
Palo Alto Networks Cortex XSOAR enhances security efficiency by automating tasks and significantly improves ROI with mature SOC processes.
Sentiment score
5.6
VMware Carbon Black Endpoint offers strong protection, reducing malware and saving 10% in costs, showing significant value within six months.
CrowdStrike Falcon saves time and offers good value for money, especially for enterprise companies, because it can stop breaches.
IT consultant at Asuransi Ramayana
It's very easy to deploy without many IT admins, saving time.
IT Manager at Jord International Pty Ltd
We are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer.
Vice President, Technology at Cache Digitech Pvt Ltd.
 

Customer Service

Sentiment score
7.0
CrowdStrike Falcon offers efficient customer service with knowledgeable support, though some users report response time issues on weekends.
Sentiment score
6.6
Palo Alto Networks Cortex XSOAR support is praised for expertise but criticized for occasional delays and impersonal interactions.
Sentiment score
6.3
VMware Carbon Black's support is knowledgeable yet occasionally slow, with variability in global and local assistance quality.
On a scale of one to ten, I would rate the technical support as a 10 because they resolve many issues for us.
CyberSecurity Architects at VaporVM
The CrowdStrike team is very efficient; I would rate them ten out of ten.
Security Analyst at NTT Ltd
They could improve by initiating calls for high-priority cases instead of just opening tickets.
Information Security Specialist at Arab Open University
Their support has been better than Anomali's and they are more responsive.
Enterprise Security Architect V at FirstEnergy
The technical support provided by Palo Alto Networks Cortex XSOAR is good.
Vice President, Technology at Cache Digitech Pvt Ltd.
Regarding the technical support of Broadcom, they are responsive and helpful.
Senior VP, Technology & Leading Technology Office at a outsourcing company with 1,001-5,000 employees
 

Scalability Issues

Sentiment score
7.8
CrowdStrike Falcon offers scalable, cloud-based security with seamless deployment, efficiently handling numerous endpoints while maintaining stable performance.
Sentiment score
7.2
Palo Alto Networks Cortex XSOAR is scalable with smooth API integration, though planning is crucial for large deployments.
Sentiment score
7.1
VMware Carbon Black Endpoint is praised for scalability and ease of deployment, despite some challenges with report generation.
It has adequate coverage and is easy to deploy.
Senior Principal Information Security Analyst at Veritas Technologies LLC
In terms of scalability, I find CrowdStrike to be stable, and I have not encountered any limitations with it.
CyberSecurity Architects at VaporVM
There's no scalability limitation from CrowdStrike itself, as it just requires agent deployment.
Large account Manager at Softcell Technologies Limited
The scalability of Palo Alto Networks Cortex XSOAR supports our growth and security needs because we can integrate various tools and continuously add more capability.
Enterprise Security Architect V at FirstEnergy
 

Stability Issues

Sentiment score
8.1
CrowdStrike Falcon offers stable, reliable performance with minimal downtime, promptly addressing minor glitches, ensuring seamless upgrades and protection.
Sentiment score
7.4
Palo Alto Networks Cortex XSOAR is highly reliable and stable, with occasional issues primarily related to configuration or updates.
Sentiment score
7.5
VMware Carbon Black Endpoint is generally stable and efficient, with minor integration issues and occasional latency quickly addressed.
I have never seen instability in the CrowdStrike tool.
Security Analyst at NTT Ltd
We are following N-1 versions across our environment, which is stable.
Senior Principal Information Security Analyst at Veritas Technologies LLC
The biggest issue occurred when every computer worldwide experienced a blue screen.
Information Security Specialist at Arab Open University
 

Room For Improvement

CrowdStrike Falcon could improve by enhancing features, reducing false positives, user interface complexity, and offering better support and pricing.
Cortex XSOAR requires simpler setup, affordability, improved UI, more integrations, and enhanced features for better user experience and scalability.
VMware Carbon Black Endpoint needs better integration, user interface, system compatibility, pricing, support, and enhanced features for improved client satisfaction.
Simplifying the querying process, such as using double quote queries or directly obtaining logs based on IP addresses or usernames, would be beneficial.
Security Analyst at NTT Ltd
Another concern is CrowdStrike's GUI. It changes annually, making it hard to work and find options.
Senior Principal Information Security Analyst at Veritas Technologies LLC
Threat prevention should be their first priority.
Group Manager at HCLSoftware
The deployment requires integration and the development of integration modules.
Presale Engineer at Westcon-Comstor
One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation.
Enterprise Security Architect V at FirstEnergy
To improve the solution, it needs to have complete features that are low-code, no-code, and should be plug-and-play.
Vice President, Technology at Cache Digitech Pvt Ltd.
 

Setup Cost

CrowdStrike Falcon's pricing is flexible but often higher than competitors, with customizable features and straightforward setup.
Palo Alto Networks Cortex XSOAR is costly but valued for features, mainly suited for medium and large enterprises.
VMware Carbon Black's pricing is high and inflexible, with users preferring user-based over endpoint-based licensing options.
It is expensive compared to SentinelOne, but as the market leader, it is worth it.
Senior Principal Information Security Analyst at Veritas Technologies LLC
The licensing cost and setup costs are affordable.
Computer Engineer at OIC, Alshirawi
The solution is a bit expensive.
Information Security Specialist at Arab Open University
For customers, it is zero versus $20 million, which is why they have to make a decision.
Vice President, Technology at Cache Digitech Pvt Ltd.
 

Valuable Features

CrowdStrike Falcon offers exceptional endpoint visibility, low impact performance, advanced AI threat detection, and effective global threat remediation.
Cortex XSOAR offers seamless integration, extensive automation, robust playbooks, and user-friendly interface, simplifying incident management and enhancing efficiency.
VMware Carbon Black Endpoint offers advanced threat detection, cloud management, machine learning, and centralized control for efficient incident management.
I can investigate by accessing the customer's host based on the RTR environment and utilize host search to know details for the past seven days, including logins, processes, file installations, malicious processes, and network connections.
Security Analyst at NTT Ltd
The real-time analytics aspect of CrowdStrike performs well because we get all logs in real-time, with no delay, allowing us to take action immediately.
CyberSecurity Architects at VaporVM
Being an EDR solution, it helps us identify attacks in real-time.
Information Security Specialist at Arab Open University
Execution of automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies.
Presale Engineer at Westcon-Comstor
If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier.
Enterprise Security Architect V at FirstEnergy
We have implemented automation features, such as automated responses to email threats and automatic configuration of target devices for blocking specific IPs.
Vice President, Technology at Cache Digitech Pvt Ltd.
I assess VMware Carbon Black Endpoint's machine learning capabilities in detecting unknown threats as fantastic.
Senior VP, Technology & Leading Technology Office at a outsourcing company with 1,001-5,000 employees
 

Mindshare comparison

Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
CrowdStrike Falcon10.1%
Wazuh7.2%
SentinelOne Singularity Complete5.8%
Other76.9%
Extended Detection and Response (XDR)
Security Orchestration Automation and Response (SOAR) Market Share Distribution
ProductMarket Share (%)
Palo Alto Networks Cortex XSOAR9.0%
Microsoft Sentinel12.4%
Splunk SOAR8.0%
Other70.6%
Security Orchestration Automation and Response (SOAR)
Endpoint Protection Platform (EPP) Market Share Distribution
ProductMarket Share (%)
VMware Carbon Black Endpoint1.8%
Microsoft Defender for Endpoint7.8%
CrowdStrike Falcon6.7%
Other83.7%
Endpoint Protection Platform (EPP)
 

Featured Reviews

Waleed Omar - PeerSpot reviewer
Information Security Specialist at Arab Open University
Provides effective real-time threat detection with potential for cost optimization
Some features such as device control, firewall management, and file analysis are standalone products that we need to purchase separately. If these features came out of the box within the product, it would be much more beneficial for us. Other providers such as SentinelOne include these features in their base product. We attended a CrowdStrike Falcon event where they discussed some shallow AI features, but we cannot see these in our panel yet. We work with different solutions such as Darktrace and SocRadar, where AI features are automatically displayed in our dashboards after release. However, for CrowdStrike Falcon, we cannot see these features.
CC
Enterprise Security Architect V at FirstEnergy
Customization supports seamless workflow while data influx challenges response time
What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali. I can create various custom automations and custom fields. There is significant customization ability in this platform. If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier. All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools. This serves as our central location where our SOC analysts can work and determine if incident response is needed. The platform provides data enrichment capabilities, offering information upfront so analysts do not have to search for it. They can access details such as username, phone number, email address, and workplace information. For malware files, they can retrieve details from VirusTotal, including file names and environment presence. We have built substantial automation around these features, which also helps us track case metrics, investigation time, and threat mitigation duration.
reviewer2689206 - PeerSpot reviewer
Senior VP, Technology & Leading Technology Office at a outsourcing company with 1,001-5,000 employees
Behavior analytics has strengthened threat prediction yet still needs to improve overall standing
Regarding the real-time monitoring feature with VMware Carbon Black Endpoint, it is helpful in addressing unseen threats. I find the behavior analysis feature beneficial. I assess VMware Carbon Black Endpoint's machine learning capabilities in detecting unknown threats as fantastic. The behavior and analytics feature employs machine learning, and these are features which make the product and give that distinguishing, differentiating factor. The intelligent threat hunting capabilities have impacted my customers' cybersecurity efforts by giving them the edge to be prepared well in advance. Whenever this feature provides prediction, you know what action to take. You are aware of a possible attack and what kind of attack it may be, so you are much better prepared.
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
881,821 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
11%
Financial Services Firm
10%
Manufacturing Company
9%
Government
6%
Financial Services Firm
12%
Computer Software Company
11%
Manufacturing Company
8%
Government
7%
Financial Services Firm
12%
Government
9%
Computer Software Company
8%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise34
Large Enterprise62
By reviewers
Company SizeCount
Small Business19
Midsize Enterprise9
Large Enterprise25
By reviewers
Company SizeCount
Small Business31
Midsize Enterprise9
Large Enterprise31
 

Questions from the Community

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is ze...
What needs improvement with Palo Alto Networks Cortex XSOAR?
To improve the solution, it needs to have complete features that are low-code, no-code, and should be plug-and-play. ...
What to choose: an endpoint antivirus, an EDR solution or both?
I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) s...
What's the difference between Carbon Black CB Response and Carbon Black CB Defense?
Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoin...
What do you like most about Carbon Black CB Defense?
VMware Carbon Black Endpoint is a highly stable solution.
 

Also Known As

CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface, CrowdStrike Falcon Platform
Demisto Enterprise, Cortex XSOAR, Demisto
Carbon Black CB Defense, Bit9, Confer
 

Overview

 

Sample Customers

Information Not Available
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America
Find out what your peers are saying about CrowdStrike, TrendAI, SentinelOne and others in Extended Detection and Response (XDR). Updated: January 2026.
881,821 professionals have used our research since 2012.