No more typing reviews! Try our Samantha, our new voice AI agent.

Darktrace vs Secureworks Taegis XDR comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Darktrace
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
85
Ranking in other categories
Email Security (11th), Intrusion Detection and Prevention Software (IDPS) (1st), Network Traffic Analysis (NTA) (1st), Network Detection and Response (NDR) (1st), Cloud Security Posture Management (CSPM) (11th), Cloud-Native Application Protection Platforms (CNAPP) (11th), Attack Surface Management (ASM) (4th), AI-Powered Cybersecurity Platforms (4th), AI Observability (12th)
Secureworks Taegis XDR
Ranking in Extended Detection and Response (XDR)
12th
Average Rating
8.4
Reviews Sentiment
5.9
Number of Reviews
11
Ranking in other categories
Network Detection and Response (NDR) (9th)
 

Mindshare comparison

As of November 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.8% compared to the previous year. The mindshare of Darktrace is 4.5%, down from 8.0% compared to the previous year. The mindshare of Secureworks Taegis XDR is 1.2%, down from 1.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.7%
Darktrace4.5%
Secureworks Taegis XDR1.2%
Other89.6%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Pasan Jayarathna - PeerSpot reviewer
Network Security Engineer at Cyberwell Solution
Monitoring has improved data loss detection and now spots abnormal internal file transfers quickly
In my understanding, the best feature Darktrace offers is the identification of copying files, which acts as a DLP, and it is a main concern for companies because users sometimes copy data outside without knowing, especially those without a technical background. When I mention the DLP-like feature and file copying detection, the alerts have been very timely, as we get an alert within a couple of minutes, which is excellent. Even if some developers are working after hours and copying files, our SOC team detects this, and most of the time they call us so we can identify the users. The alerts are quite accurate and proactive.
Mohammad Jundiah - PeerSpot reviewer
Solutions Architect at Qatar Datamation Systems
Centralized monitoring has strengthened threat hunting and improved ransomware protection
Threat hunting and SOC augmentation represent the most special features about Secureworks Taegis XDR, where some of the best people in cybersecurity proactively search, provide reports, and deliver indicators of compromise for any activity in your network. This monitoring and reporting can be conducted weekly or monthly. Centralized security monitoring and reporting is one of the most valuable aspects, as security fundamentally revolves around compliance. Having a centralized security monitoring platform that detects endpoints, networks, and cloud environments, including servers and switches, is essential. Secureworks Taegis XDR's architecture involves a collector device that collects all your data, even from small laptops, and allows you to monitor everything in one platform. This centralized system provides compliance and security visibility, ensuring evidence and visibility for your security and any compliance requirements you have. Analytics with Secureworks Taegis XDR give you a full preview of everything on your device. It takes all the inputs and outputs of your infrastructure; for example, if it is a firewall, it scans all of the traffic. While it is not a SIEM, it is an open XDR, which excels at conducting analytics. This represents one of its best features because Secureworks has implemented a machine learning model that can detect and analyze everything independently, providing AI-driven features. Integration with third-party tools is quite seamless. Secureworks Taegis XDR can integrate with virtually anything. One of the best features of this product is its integration capabilities with multiple sources of EDRs and any operating system, whether protecting Linux or Windows servers. It boasts very good integration, and if a specific integration is not available, you can raise a ticket to Secureworks, and they will work on your integration, whatever it is, even if it is custom-built software. Secureworks Taegis XDR absolutely aids in efficiency. SOC augmentation extends an organization's existing SOC, which helps reduce alert fatigue significantly. It provides additional threat intelligence and expert investigation, making it very useful for organizations that have a security team but lack twenty-four seven coverage.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cortex XDR by Palo Alto Networks has helped us a lot with securing the whole environment and the whole IT structure, giving us full knowledge of what is happening on the client and enabling us to take action right away from a single point for managing security operations on the hosts."
"Once you become familiar with it, Cortex XDR by Palo Alto Networks is a more powerful tool and I would say that I prefer it over MDE because it is a stronger tool for me."
"Has great threat detection capabilities."
"The product has an intuitive dashboard."
"I can highlight that we have not faced any security incidents with Cortex XDR by Palo Alto Networks, and even though our environment is quite dynamic, we have not faced any security incident with Cortex XDR by Palo Alto Networks until now."
"WildFire AI is the best option for this product."
"The best feature of Cortex XDR by Palo Alto Networks is that it collects logs from different sections such as the endpoint, the network, and the cloud, making it easy to investigate alerts, collect some of the investigation packages related to the infected machines, and provide live response."
"The good thing about the product is that it's always scanning."
"We have found the product to be stable and issue-free."
"I would 100% recommend Darktrace."
"The technical support from Darktrace is very good, including support from their resellers."
"While it is complex, and difficult to use, once you understand the correct way to use it, it's a very good platform."
"The AI-based pattern is the most valuable feature."
"It's beneficial to me and I can see that with more time and energy put into optimizing it and personalizing the unit, it can be much more powerful than the way I am using it now."
"I particularly like Antigena and the analytics around the real-time monitoring of our network."
"The Antigena feature is most valuable. Once it learns your environment, Antigena can step in and block a denial of service attack, a ransomware attack, or just about anything that doesn't belong in the environment. It can detect any type of attack that hits the environment because it understands what normal looks like for the network. It is very useful for an autonomous response."
"The features I find most valuable are the fact that Secureworks Taegis XDR runs itself without any form of intervention."
"Using Secureworks Taegis XDR has positively impacted our organization overall."
"Secureworks Taegis XDR has positively impacted our organization by improving detection rates and reducing our time; as I mentioned, it saves us from manually going through all the logs, which is not practical."
"The price for Secureworks Taegis XDR is very competitive."
"It's a complete solution package."
"Definitely, Secureworks Taegis XDR is cost effective for the long run since the product is at a lower cost rather than other brands."
"The auto-triage feature of Secureworks Taegis XDR makes my workflow easier and efficient, helping me shorten the time of responding to every alert, make my activities productive, and manage everything that I need to check every alert and detection."
"Secureworks Taegis XDR helps me go from the alert to a search and investigation, which I find very helpful."
 

Cons

"Impact on system performance is horrible, adding a lot of delays for users."
"I don't like that they have different types of licenses. For example, if users select a license, they think they will have all the platforms they need to improve their network or security. But after some time, Palo Alto Networks changed their licensing, and some of the features that, for example, were free at the beginning now have a cost. I think the integration can be improved. For example, a lot of tools are just integrated through APIs."
"Traps doesn't work with McAfee. You need to remove McAfee to install Traps. This is very common, and its nothing that should be an issue. Some antivirus engines recognize Traps as an threat component, so maybe they need to shake hands somewhere."
"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."
"Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."
"There are some default policies which sometimes affect our applications and cause them to run around."
"Whenever the tool releases a new version when deploying the product across the organization, I feel like there are some disturbances in the CPU usage after upgrading the tool to the latest version."
"I would like to see some additional features related to email protection included."
"It's a very complex platform."
"Its documentation is not up to the mark. At times, I have a lot of trouble finding a solution. Even when I posted questions on the community chats, it took a lot of time for me to get answers. That's something that can be improved. Darktrace can focus on creating a more interactive community. If there are more people from Darktrace to focus on community chats, it would be better."
"It's sometimes a challenge getting logs from different sources."
"The only thing that I can think of that would improve it would be if they had a better visualization and a reporting portal."
"There are numerous false positives."
"It would be useful if there was a way to check to see if there are certain devices that are not in sync with the solution. I'm not sure if this is an option or not."
"Darktrace needs to automate the reports of false positives, botnets and everything."
"The module can improve so that every time it's more intelligent."
"We found limitations in the XDR's detections, lacking the ability to create customized detection and log parsing rules."
"Hardware compatibility could be an area for improvement."
"To improve Secureworks Taegis XDR, we need to enhance the support part."
"I would like to see more automation and more workbooks as needed improvements."
"One negative aspect I always hear from customers is about the cost."
"Customer support for Secureworks Taegis XDR is not that bad; they are reachable but not super efficient."
"The efficiency or the smooth navigation of the website or the application can be improved in Secureworks Taegis XDR."
"The pricing could be improved."
 

Pricing and Cost Advice

"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"The price of the solution is high for the license and in general."
"Cortex XDR’s pricing is very reasonable."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"This is an expensive solution."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"The solution is expensive. It's pricing is on a yearly-basis."
"I am using the Community edition."
"Darktrace is pricey, but the price is reasonable for what the solution does, and it's comparable to other products."
"It is expensive. I don't have the price for other competitors."
"It is inexpensive considering what it can do and the competition."
"I am using a demo of Darktrace for deployment and testing which is free."
"It is pretty expensive, but it is worth it. Its licensing is yearly."
"All of the other modules, such as the licensing modules, are on par. It's one for one."
"The pricing is quite high, estimated at around $350,000 per year."
"When it comes to large installations, it can be expensive, but for small accounts it's fine."
"The pricing is six out of ten."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
921,148 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
11%
Financial Services Firm
10%
Comms Service Provider
9%
Government
7%
Financial Services Firm
17%
Manufacturing Company
12%
Comms Service Provider
9%
Construction Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise21
Large Enterprise29
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise1
Large Enterprise7
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for Darktrace?
Concerning pricing for the product, I would say it is somewhat expensive.
What needs improvement with Secureworks Taegis XDR?
If there were a next release of the product, I would like to see an increase in playbooks, specifically for augmentat...
What is your primary use case for Secureworks Taegis XDR?
Clients are primarily using Secureworks Taegis XDR for securing endpoints, networks, and extending to cloud, identity...
What advice do you have for others considering Secureworks Taegis XDR?
One of the best features of this product is its integration capabilities with multiple sources of EDRs and any operat...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
Secureworks Taegis NDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.
Information Not Available
Find out what your peers are saying about Darktrace vs. Secureworks Taegis XDR and other solutions. Updated: September 2026.
921,148 professionals have used our research since 2012.