Cybereason Endpoint Detection &amp; Response vs Morphisec comparison

Cybereason Endpoint Detection & Response vs. Morphisec

Download the complete report

Helped 900,838 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of June 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.7%, down from 3.8% compared to the previous year. The mindshare of Cybereason Endpoint Detection & Response is 1.0%, up from 0.8% compared to the previous year. The mindshare of Morphisec is 0.9%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Protection Platform (EPP) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.7%
Cybereason Endpoint Detection & Response	1.0%
Morphisec	0.9%
Other	94.4%

Endpoint Protection Platform (EPP)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Ivan Burke

Head of Research Development and Innovation at CSIR

Offers useful threat hunting and response capabilities but struggles to justify cost for smaller deployments

I mostly work with incident response, so I work with a bunch of them interchangeably, but mostly with the EDR components; I also get involved with some of the XDR components, especially for the cloud. Regarding analysis features, such as deep behavioral detection, I do use it sometimes; I usually don't use the automated version of it, as I prefer threat hunting directly, depending on if the season is available. I know some of them have pretty good analytics engines, but I tend to do the threat hunting on my own. I manage incident response for a bunch of companies, so some of them have Cybereason Endpoint Detection & Response integrated into Sentinel, some into Fortinet, and others into various tools. When considering cost-effectiveness, their pricing structure works such that if you're a large organization with more than a thousand endpoints to deploy to, then Cybereason Endpoint Detection & Response is worthwhile. But for anything less than 300, it's too expensive; obviously, the more you buy, the better the price, making it cheaper for you. Cybereason Endpoint Detection & Response best fits enterprise-level businesses such as huge corporations; however, we are in the process of removing it from many of our endpoint clients because it's not really showing enough value for them at the moment. We're trying to see how we can improve it with some of our clients, but at the moment, it's struggling compared to other EDR solutions that we have deployed. On a scale of one to ten, I rate Cybereason Endpoint Detection & Response a six.

Read full review

Rick Schibler

VP of Information Technology at Kentucky Trailer

Offers in-memory protection at a lower price than competitors

Morphisec's in-memory protection is probably the most valuable feature because it stops malicious activity from occurring. If something tries to install or act as a sleeper agent, Morphisec will detect and stop it. Morphisec's Moving Target Defense is critical to hardening our attack surface. If it detects something, it indicates whether it's valid. That means you've got a breach requiring investigation. It detects anomalies but doesn't necessarily point to what caused them. You still need to do that work. The solution is reasonably easy to administer. They made some changes last year, adding a cloud-based monitoring solution that makes deploying and monitoring our endpoints easy.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It has pretty much everything we need and works well within the Palo Alto ecosystem."

"Stability is a primary factor, and then there's the ease of distribution and policy management; Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them."

"Implementing Cortex XDR by Palo Alto Networks has had a significant impact on my security analyst workload because it becomes much easier."

"Traps has drastically reduced our endpoint attack surface via advanced detection capabilities, sandboxing of never before seen programs, and by drastically limiting where executables can launch in the first place."

"Cortex XDR can integrate the firewalls and determine the tendencies of the attacks. It's a new generation antivirus, with protection endpoints and detection response. It is very easy to use and everybody can operate the solution."

"From the Palo Alto side, whatever they buy, they integrate that really well into their integration suite, and that makes a massive difference."

"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."

"We use it for malicious connections from malicious websites, to identify payloads that might be inside the traffic, to identify malicious processes or bugs that are running on the network, and any activities that tend to lead to data infiltration."

More Cortex XDR by Palo Alto Networks pros

"It has reduced the amount of time that we spend responding to threats by at least 50%."

"Cybereason's threat hunting and investigation are the most valuable features. Threat hunting is a user-friendly feature that keeps you safe. Investigation offers an added value that I haven't seen with other EDR services. It allows you to find specific policy problems within your environment."

"Cybereason absolutely enables us to mitigate and isolate on the fly. Our managed detection response telemetry has dropped dramatically since we began using it. It's very top-of-mind. We were running some tabletop exercises and none of the detections were getting triggered by the managed security services provider. So we needed to find a solution that would trigger high-fidelity alerts. That was Cybereason and it dramatically changed our landscape from the detection and response perspective."

"I haven't had any issues with the solution. Stability-wise, I rate the solution a ten out of ten."

"We didn't have the visibility that we now have. It has increased our visibility by a lot. So, we put a lot more time into really looking at our environment and what is happening throughout our different networks. It has increased our visibility by around fivefold."

"If a file was infected on somebody's laptop or workstation, then it is now easier for us to understand what the impact is on the environment, as the Cybereason product enables me to go directly into the software, look up the process, see who were the dealers, what were the websites, what were the IP addresses which were contacted, and detect if there were other systems which were impacted or if my environment was compromised."

"The initial setup process is straightforward."

"We like that it is a hybrid; it’s flexible, you can really do whatever you need to do, the initial setup is not overly complicated, the solution can scale, and it is stable and reliable."

More Cybereason Endpoint Detection & Response pros

"Morphisec has been a real lifesaver."

"The ability to stop attacks without having to detect or have a signature for the attack is the most valuable feature."

"Morphisec has given our security team's operations peace of mind and more time for patching."

"What's valuable is really the whole kit and caboodle of the Morphisec agent. What it does is genius, in a way, until the bad guys get wise to it. You set it up and then you watch the dashboard. There isn't really much tinkering."

"We don't have to do anything as a user or as an admin. It does everything by default with its coding and inbuilt AI-based intelligence. We don't have to instruct it about what to do. It automatically takes corrective actions and quarantines or deletes a virus, malware, etc. That is the best part that I like about it."

"All the alerts are on the dashboard, which is quite simple and useful for us. You can easily check all the alerts that are being blocked or allowed, or whatever the action is. You can easily see that and you can take the necessary actions. You can add a PowerShell extension or any activities for blocking at your network level or for endpoints."

"Since we started using Morphisec, that hasn't happened even once."

"Morphisec stops attacks without needing to know what type of threat it is, just that it is foreign. It is based on injections, so it would know when a software launches. If a software launches and something else also launches, then it would count that as anomalous and block it. Because the software looks at the code, and if it executes something else that is not related, then Morphisec would block it. That is how it works."

More Morphisec pros

Cons

"The deployment is pretty hard."

"There is also no recovery feature; if some endpoint is under attack there must be the possibility of recovering it or restoring it to a normal state."

"The playbooks could be improved to include more functionalities or actions."

"Cortex XDR by Palo Alto Networks is not only pricey; it is extremely expensive."

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."

"The configuration could be simplified. I would like to see better protection, specifically to protect email applications."

"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."

"It'll help if customization was easier."

More Cortex XDR by Palo Alto Networks cons

"Linux was a bad experience and Micro OS was a disaster."

"Reporting could be a bit more granular so that we had the ability to check regions and countries. I just noticed that, for instance, if I look at our servers, it's either "contained" or it's "not contained". I don't have the option, for instance, to look at countries. It only allows me to look at users as one big group."

"One area for improvement is that this solution isn't so easy for the end-user, especially at level 1."

"I would like to see improvements on the operational side, specifically in grouping."

"Its Microsoft PowerShell protections still need some compatibility improvements. We have run across just a few. It is compatible with 90% of what we have in our network, but there is that 10% that we are still struggling with as far as compatibility with the type of PowerShell scripts needed to run our day-to-day business."

"Compared to our previous endpoint, we have a lot more false positives and a lot more duplication of alerts. So we're chasing more alerts."

"Technical support needs to improve."

"The product's reporting isn't great."

More Cybereason Endpoint Detection & Response cons

"It would be nice if they could integrate Morphisec with other traditional antivirus solutions beyond Microsoft Defender. That is probably my biggest gripe."

"It would be useful for them if they had some kind of network discovery. That kind of functionality I think would give IT administrators a little bit more confidence that they have 100 percent coverage, and it gives them something to audit against. Network discovery would be one area I would definitely suggest that they put some effort into."

"I haven't been able to get the cloud deployment to work."

"Right now, it's just their auto-update feature. I know they are currently working on that. When they release a new version of the threat prevention platform, I do have to update that, rolling out to every computer. They have said, "From version 5, you would be able to do an auto-update." While this is very minor, that is the only thing that I would say needs to be upgraded. It would just make life a lot easier for other IT teams. However, I have simplified the process, so all I need to do is just download one file."

"It would be useful for them if they had some kind of network discovery."

"Sometimes it generates false positive alerts. They need to continue working on that. They have provided solutions for it and have fixed issues with updated versions. The service is quite good but they need to work on it more so that there are no false positive alerts."

"From a company standpoint, a little more interaction with the customers throughout the year might be beneficial. I would like check-ins from the Morphisec account executives about any type of Morphisec news as well as a bit more interaction with customers throughout the year to know if anything new is coming out with Morphisec, e.g., what they are working on in regards to their development roadmap. We tend not to get that up until the time that we go for a yearly renewal. So, we end up talking to people from Morphisec once a year, but it is usually at renewal time."

"I haven't been able to get the cloud deployment to work. When there's an update, I'm supposed to be able to roll it out for the cloud solution, but right now I'm continuing to use our SCCM solution to update it."

More Morphisec cons

Pricing and Cost Advice

"Cortex XDR’s pricing is very reasonable."

"Our license will require renewal in August, after which the maintenance will continue as usual."

"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."

"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."

"I don't recall what the cost was, but it wasn't really that expensive."

"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."

"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."

"I don't like that they have different types of licenses."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"In terms of cost, this is a good choice for our needs."

"Though it is not the cheapest solution but it fits our budget. We pay an annual licensing fee."

"On a scale of one to ten, where one is cheap and ten is expensive, I rate the pricing an eight."

"The pricing is manageable."

"I had to go through a third-party to purchase it, which I wasn't really pleased about."

"In terms of pricing, it's a good solution."

"I do not have experience with the licensing of the product."

"This product is somewhat expensive and should be cheaper."

More Cybereason Endpoint Detection & Response pricing and cost advice

"It does not have multi-tenants. If South Africa wants to show only the machines that they have, they need their own cloud incidence. It is not possible to have that in a single cloud incidence with multiple tenants in it, instead you need to have multiple cloud incidences. Then, if you have that, it will be more expensive. However, they are going to change that, which is good."

"Our licensing is tied into our contract. Because we have a long-term contract, our pricing is a little bit lower. It is per year, so we don't get charged per endpoint, but we do have a cap. Our cap is 80 endpoints. If we were to go over 80, when we renewed our contract, which is not until three years are over. Then, they would reevaluate, and say, "Well, you have more than 80 devices active right now. This is going to be the price change." They know that we are installing and replacing computers, so the numbers will be all over the place depending on whether you archive or don't archive, which is the reason why we just have to keep up on that stuff."

"We are still using a separate tool. I know for our 600 or I think we're actually licensed for up to 700 users, it runs me 23 or $24,000 a year. When you're talking to that many users plus servers being protected, that's well worth the investment for that dollar amount."

"Price-wise, it's on the higher side. A traditional antivirus solution is cheaper, but in terms of security and manageability, its ROI is better than a traditional antivirus. I would recommend it to anybody evaluating or considering an antivirus solution. If your system gets compromised, the cost of ransom would be a lot more. This way, it saves a lot of cost."

"Licenses are per endpoint, and that's true for the cloud version as well. The only difference is that there is a little extra charge for the cloud version."

"It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately."

"It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off."

"It is an annual subscription basis per device. For the devices that we have in scope right now, it is about $25,000 a year."

More Morphisec pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.

See recommendations

900,838 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

12%

Financial Services Firm

11%

Manufacturing Company

10%

Comms Service Provider

Financial Services Firm

14%

Computer Software Company

10%

Manufacturing Company

Outsourcing Company

16%

Manufacturing Company

13%

Construction Company

11%

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	46
Midsize Enterprise	20
Large Enterprise	52

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	5
Large Enterprise	12

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	8
Large Enterprise	8

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

What is your primary use case for Cybereason Endpoint Detection & Response?

My main use case for Cybereason Endpoint Detection & Response is mostly for incident response.

What needs improvement with Cybereason Endpoint Detection & Response?

When it comes to advanced threats, it sometimes helps me with finding them and hunting them down with threat detectio...

What advice do you have for others considering Cybereason Endpoint Detection & Response?

I mostly work with incident response, so I work with a bunch of them interchangeably, but mostly with the EDR compone...

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Ask a question

Earn 20 points

Comparisons

Compared 10% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

CrowdStrike Falcon vs Cybereason Endpoint Detection & Response

Compared 7% of the time

SentinelOne Singularity Endpoint vs Cybereason Endpoint Detection & Response

Compared 5% of the time

Fortinet FortiEDR vs Cybereason Endpoint Detection & Response

Compared 4% of the time

Symantec Endpoint Security vs Cybereason Endpoint Detection & Response

Compared 4% of the time

BlackBerry Cylance Cybersecurity vs Cybereason Endpoint Detection & Response

Compared 3% of the time

More Cybereason Endpoint Detection & Response Competitors

Symantec Endpoint Security vs Morphisec

Compared 7% of the time

CrowdStrike Falcon vs Morphisec

Compared 5% of the time

FortiCNAPP vs Morphisec

Compared 5% of the time

Halcyon vs Morphisec

Compared 4% of the time

SentinelOne Singularity Endpoint vs Morphisec

Compared 4% of the time

More Morphisec Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Cybereason Endpoint Detection & Response

Download Cybereason Endpoint Detection & Response product report

Cybereason Endpoint Detection & Response report

Morphisec

Download Morphisec product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

Cybereason EDR, Cybereason Deep Detect & Respond

Morphisec, Morphisec Moving Target Defense

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Cybereason Endpoint Detection & Response offers advanced threat hunting, investigation, and malicious operation visualization. Its intuitive interface and AI-driven Malop engine enhance threat detection efficiency across multiple platforms.

Focused on providing detailed real-time insights, Cybereason Endpoint Detection & Response is crucial for cybersecurity operations by offering comprehensive dashboards and managed detection and response services. It ensures efficient threat isolation, supports Windows, Linux, and Mac environments, and improves network activity visibility. While its AI engine enhances threat analysis clarity, technical support and deployment complexity can be improved, particularly for smaller organizations. Some challenges include integration with Microsoft, high CPU usage, minimal dashboards, and graphics. Additionally, deployment processes need refinement for stability with new OS versions.

What are the key features of Cybereason Endpoint Detection & Response?

Threat Hunting: Actively searches for potential threats before they can cause harm.
Malop Engine: Uses AI to clearly visualize and analyze malicious operations.
Real-Time Visualization: Monitors malicious activities with intuitive dashboards.
Automation: Streamlines security processes by automating routine tasks.
Cross-Platform Support: Compatible with Windows, Linux, and Mac systems.

What benefits can users expect from using Cybereason Endpoint Detection & Response?

User-Friendly Interface: Simplifies monitoring and managing network security activities.
Operational Efficiency: Supports lightweight operations reducing resource usage.
Improved Visibility: Enhances clarity in threat detection and response.
Reduced False Positives: Accurate detections minimize unnecessary alerts.

Cybereason Endpoint Detection & Response is widely implemented to safeguard endpoints, particularly in fields requiring rigorous security measures. Many employ it for its robust incident response capabilities in finance, healthcare, and government sectors to tackle malware, malicious operations, and unusual process detection, supporting security operations centers with powerful monitoring tools.

LevelBlue

Morphisec enhances security with its signatureless attack prevention, integrating smoothly with Microsoft Defender. Users benefit from real-time threat detection and seamless system integration, protecting against zero-day threats and ransomware across networks.

Morphisec's security solution focuses on preventing cyber threats without requiring threat signatures or user action. Its integration with Microsoft Defender offers simplified visibility and management while delivering quick responses. Lightweight in nature, Morphisec ensures zero performance degradation and employs in-memory protection along with Moving Target Defense. This approach effectively counters zero-day threats and ransomware, maintaining a user-centric dashboard that eases administrative workloads. Morphisec's easy deployment also enables small teams to manage risks and uphold robust security measures efficiently.

What are Morphisec's key features?

Signatureless Threat Prevention: Stops attacks without threat signatures or user interaction.
Microsoft Defender Integration: Provides unified management and quick response capabilities.
In-Memory Protection: Shields against zero-day and ransomware threats efficiently.
Moving Target Defense: Minimizes exposure to in-memory attacks.
User-Friendly Dashboard: Simplifies administration by reducing burdens.
Easy Deployment: Facilitates straightforward setup for small teams.

What benefits and ROI should be considered in user reviews?

Real-Time Detection: Immediate identification of threats enhances proactive threat management.
Seamless Integration: Compatible with existing systems, reducing delay risks.
Cloud-Based Updates: Ensures current protection with minimal manual input.
Multi-Layered Security: Adds a solid last defense layer, supplementing other antivirus solutions.

Morphisec is widely used across industries like financial services, healthcare, and manufacturing to bolster defenses against malware and ransomware. Its deployment spans workstations and servers, integrating efficiently into existing infrastructures. Industries value real-time threat detection, ease of deployment, and cloud-based updates, noting its ability to identify threats missed by other antivirus solutions.

Morphisec

Sample Customers

CBI Health Group, University Honda, VakifBank

Lockheed Martin, Spark Capital, DocuSign, Softbank Capital

Lenovo/Motorola, TruGreen, Covenant Health, Citizens Medical Center

Cybereason Endpoint Detection & Response vs. Morphisec