No more typing reviews! Try our Samantha, our new voice AI agent.

Cybereason XDR vs Trellix XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
5th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cybereason XDR
Ranking in Extended Detection and Response (XDR)
25th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
3
Ranking in other categories
No ranking in other categories
Trellix XDR
Ranking in Extended Detection and Response (XDR)
35th
Average Rating
7.4
Reviews Sentiment
7.3
Number of Reviews
5
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.1% compared to the previous year. The mindshare of Cybereason XDR is 1.1%, up from 0.6% compared to the previous year. The mindshare of Trellix XDR is 0.8%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.7%
Cybereason XDR1.1%
Trellix XDR0.8%
Other93.4%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Peter Nowak - PeerSpot reviewer
Business Development Manager for Cybereason at Bechtle
Integration of multiple firewalls enables advanced threat detection
The integration of data from firewalls and Active Directory is most valuable. Cybereason XDR facilitates two-way communication, where the firewall sends data to the Cybereason system, and it can communicate with the firewall to stop unwanted communication. Customers can deal with multiple types of firewalls with ease. The behavioral analytics help detect advanced threats when attackers use existing software. The multilayered protection approach, including NGAV, integrates XDR detection with antivirus to assess and counter threats effectively.
reviewer2840397 - PeerSpot reviewer
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Automated response has reduced manual workloads but setup complexity and support still need work
Trellix XDR can be improved because it has a complex initial setup. We personally had trouble in the initial configuration of Trellix XDR and it was very time-consuming for us. It requires careful planning and expertise as well because the syntaxes are not that user-friendly and the UI/UX is not that user-friendly either. For the first-time user, the designing part will be a bit tricky and it will be a bit annoying as well because there's no readily available documentation for this. There is the false positive problem which Trellix XDR is known for, which can lead to alert fatigue and increased workload for the security analyst. The product also has poor SKU guidance from the sales team, and the support team is also not that well-versed in what they are doing. Trellix support team is not highly regarded because they follow a whole hierarchical process to escalate the complaints and the feedback requests, and the resolution can take very long, from two to three weeks to a month, which is not really viable in a cyber security landscape which is moving this fast.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"One of the main benefits of the solution is its intelligence to correlate the events into an incident."
"We have a complete overview of all our PCs and it's very easy to handle and to use the interface."
"Monitoring is most valuable."
"It blocks malicious files. It prevents attacks. It doesn't require many updates, it's a very light application."
"Overall, it's a great platform; it integrates very well with other solutions from Palo Alto and also with our vendors, the ease of use is excellent, I love the root cause analysis from Cortex, which is amazing, and in a few clicks you can have the full root cause."
"After installing this solution, it identified, blocked, and provided the complete attack chain, which was very helpful."
"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"It detected stuff that other things wouldn't detect."
"Cybereason XDR's most useful feature is the investigation."
"The solution has an investigation feature, which is useful for building storylines."
"The integration of data from firewalls and Active Directory is most valuable."
"The integration of data from firewalls and Active Directory is most valuable."
"Trellix XDR is an excellent solution that is continually improving."
"The AI-assisted troubleshooting and threat hunting capabilities, along with the machine learning functionality, are the biggest advantages of Trellix XDR that stand out for me."
"The analytics assessment and flexibility of the platform are valuable."
"Because Trellix gives us multiple types of modules, we are using a single ePO console for multiple solutions including application control, DLP, and XDR."
"It contributes to our system's robust event detection and analysis, enabling us to respond effectively to incidents."
"Trellix XDR has impacted my organization positively because time was definitely saved because of the automated response, and the positive impact was definitely there in terms of both time saved and people being cut down from the team to have a more efficient and cost-saving team."
 

Cons

"I don't like that they have different types of licenses. For example, if users select a license, they think they will have all the platforms they need to improve their network or security. But after some time, Palo Alto Networks changed their licensing, and some of the features that, for example, were free at the beginning now have a cost. I think the integration can be improved. For example, a lot of tools are just integrated through APIs."
"There are some default policies which sometimes affect our applications and cause them to run around."
"It would be good if they could make an exception for applications."
"It is not easy to sell Cortex XDR, not because it isn't a good tool. Its marketing needs to be improved."
"The encryption is not up to the mark."
"Currently, if you use Palo Alto endpoint protection as the only solution it's very complicated to remove pre-existing threats."
"Every 30 or 40 days, there's a new version and we need to go and make sure our customer's laptops are upgraded."
"I recommend adding a data loss prevention (DLP) solution to Cortex XDR by Palo Alto Networks. The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products."
"Customer service is rated as a five out of ten. When they work and reach the right level, they are helpful, but getting to the right person can be time-consuming."
"There could be more integrations with other data sources like NDR systems."
"The one thing we sometimes have issues with is its integration with other security applications like antiviruses."
"Cybereason's customer support could be better."
"Technical support is crucial, especially when facing critical issues. It's rated six out of ten. Improvements are needed in the support sector, with a focus on providing expert assistance during production periods."
"The EdgeGear solution is an area that requires attention, specifically regarding AI solutions and intelligence features."
"The platform should enhance compatibility with all other SIEM solutions."
"The CPU utilization is very high with Trellix XDR; we are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization, which creates big challenges for us."
"We have left Trellix XDR. The pricing was the main factor because the features were not there and they were charging more from us."
"Trellix XDR should get involved in AI security itself."
 

Pricing and Cost Advice

"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"The pricing is a little high. It is per user per year."
"Very costly product."
"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"The tool's price is moderate."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"It is cost-effective compared to similar solutions. It fits for the small businesses through to the big businesses."
"This is an expensive solution."
"The solution is cheaper than Microsoft Defender. It has a subscription and no standard license."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
894,738 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Manufacturing Company
13%
Computer Software Company
11%
Comms Service Provider
11%
University
8%
Computer Software Company
17%
Healthcare Company
9%
Financial Services Firm
9%
Comms Service Provider
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise49
No data available
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise4
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Cybereason XDR?
There could be more integrations with other data sources like NDR systems. Additionally, technical support has been s...
What is your primary use case for Cybereason XDR?
I use Cybereason XDR for customers who don't have a SOC or managed SOC yet and want to be protected on more than thei...
What advice do you have for others considering Cybereason XDR?
I rate Cybereason XDR a nine out of ten. I recommend having hands-on experience and doing some threat hunting to fami...
What is your experience regarding pricing and costs for Trellix XDR?
Since I'm a technical engineer, I don't deal with pricing or licensing. Our sales team handles those aspects.
What needs improvement with Trellix XDR?
The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solu...
What is your primary use case for Trellix XDR?
We are selling Trellix XDR products including DLP and EPP solutions. We sell Trellix XDR for endpoint protection. We ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
MVision XDR, MVision eXtended Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
MOTOROLA MOBILITY
Information Not Available
Find out what your peers are saying about Cybereason XDR vs. Trellix XDR and other solutions. Updated: April 2026.
894,738 professionals have used our research since 2012.