No more typing reviews! Try our Samantha, our new voice AI agent.

Datto Endpoint Detection and Response (EDR) vs LevelBlue USM Anywhere comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 24, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Datto Endpoint Detection an...
Ranking in Endpoint Detection and Response (EDR)
47th
Average Rating
7.6
Reviews Sentiment
7.0
Number of Reviews
4
Ranking in other categories
No ranking in other categories
LevelBlue USM Anywhere
Ranking in Endpoint Detection and Response (EDR)
33rd
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Log Management (27th), Security Information and Event Management (SIEM) (26th), Compliance Management (12th)
 

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of Datto Endpoint Detection and Response (EDR) is 1.1%, down from 1.6% compared to the previous year. The mindshare of LevelBlue USM Anywhere is 1.4%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
LevelBlue USM Anywhere1.4%
Datto Endpoint Detection and Response (EDR)1.1%
Other93.7%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
reviewer2406663 - PeerSpot reviewer
Director at a computer software company with 11-50 employees
Effective risk response, easy deployment, and enhanced security
They use Datto EDR as part of the solutions that we supply Datto EDR has helped reduce overall security incident costs by fifteen percent. The ease of deployment has been good, and the responsiveness of the application to risks has been quite effective. The inclusion of web filtering would be…
Kris Nawani - PeerSpot reviewer
Co-Founder/Director at Bangkok MSP Company Limited
Offers complete coverage without the need to install additional software
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools The solution offers complete coverage without the need to install additional software, as it is maintained by the vendor. It helps in saving…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."
"The product's initial setup phase is very easy."
"Everything is organized straightforwardly; all the incidents are clearly described and everything you need is essentially in one menu and one UI interface, which is quite beneficial for me and also for the customer."
"Cortex XDR alerts us on the dashboard when there's a threat, which allows us to restrict that user and helps secure our infrastructure."
"The initial setup is easy."
"They have a new GUI which is just fantastic."
"Threat identification and detection are the most valuable features of this solution."
"The level of security I get for my endpoints and servers is extremely valuable."
"The insight that the solution provides is the most valuable aspect. The security scanning they do is excellent."
"The ease of deployment has been good."
"Datto Endpoint Detection and Response is a perfect product for endpoint security."
"The most valuable feature of Datto EDR is the visibility of the endpoints."
"There are multiple tools for information security. The solution includes all the latest advances on the network and host intrusion detection systems."
"The pricing and licensing are at its best in the market when compared with other vendor's SIEM products."
"Students becoming acclimated to the product can go out into the field and have first-hand knowledge on how to use a USM or SIEM product."
"SIEM log collection is great, and all of the rules that support updates with maintenance."
"The setup of AlienVault is extremely easy; it is very simple to understand for someone who is trying a SIEM solution for the first time, and the integration of servers and other devices is extremely easy, as it is a piece of cake where you just double-click and start, and you are up and running."
"It’s pretty easy to setup but to really take advantage you should have a dedicated person who will devote their time to customizing and utilizing the power this solution has."
"It has allowed us to see what is happening on our servers."
"Ease of deployment across various environments."
 

Cons

"The GUI could be improved."
"The solution should add unwanted malicious hash values to a block list so that whenever the action is triggered, it will automatically prevent the malicious content."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"Currently, we are monitoring all USB drives and ports but we would like to improve our device control capabilities."
"Impact on system performance is horrible, adding a lot of delays for users."
"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."
"The solution should force customers to integrate with network traffic to see the full benefits of XDR."
"We would also like to have advanced tech protection and email scanning."
"The inclusion of web filtering would be good."
"The deployment of the solution right now is terrible. We find it to be very bad. It could be improved enormously."
"The solution should allow the automation of playbooks."
"The solution could improve by having more deployment methods."
"Support can be slow at times, but the quality is high. Posted knowledge base articles could use improvement."
"We've had some stability problems, not a lot, but a few. Updates seem to be the worst. That seems to be when the stability problems come up."
"I had a renegade plugin that was installed by the company who helped me with the initial setup. The plugin was missing a command to rotate logs and would fill my hard drives capacity to full quickly."
"In emergency cases, it is difficult to reach them."
"There could be some type of integration with our existing portal."
"Reporting and Windows log collection is the biggest drawback."
"Its reporting tools need improvements. It would be good if they can provide integration with other ticketing systems. Currently, we only have integration with Slack and Jira. It is also a bit slow, and its replication engine can be improved."
"Search performance can be slow. The Raw Logs feature is painfully slow."
 

Pricing and Cost Advice

"The price of the product is not very economical."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"This is an expensive solution."
"The pricing is okay, although direct support can be expensive."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"I feel it is fairly priced."
"The solution is expensive. It's pricing is on a yearly-basis."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"Datto Endpoint Detection and Response is not an expensive solution."
"There is an annual license to use this solution. The price of the solution can be expensive depending on the company."
"Do the one month trial and try to work out the kinks during it, as it has free support and service hours."
"QRadar, ArcSight and Splunk are some of the most expensive SIEM products out there in the market and not everyone has the budget to buy them. In such cases, AV USM is a very cost effective alternative."
"They are a little more expensive than Microsoft."
"It is a product that is priced in a medium range, making it neither a cheap nor a costly product."
"Use the AlienVault team. They are helpful and the documentation that they provide is second to none."
"We checked out several competitors. For what it can do and the cost, it was the best option!"
"We ran a few PoCs. The price and feature set were the best with AlienVault."
"The price of this solution is reasonable, which is one of the reasons why we selected it over other solutions."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
920,939 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Comms Service Provider
11%
Computer Software Company
7%
Manufacturing Company
7%
Retailer
6%
Outsourcing Company
16%
Construction Company
16%
Comms Service Provider
9%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
No data available
By reviewers
Company SizeCount
Small Business65
Midsize Enterprise29
Large Enterprise25
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Ask a question
Earn 20 points
What needs improvement with AT&T AlienVault USM?
There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also...
What is your primary use case for AT&T AlienVault USM?
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Infocyte HUNT
AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Check Point Software, PwC, Grant Thornton, AT&T, DHL, U.S. Department of Defense
Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Find out what your peers are saying about Datto Endpoint Detection and Response (EDR) vs. LevelBlue USM Anywhere and other solutions. Updated: September 2026.
920,939 professionals have used our research since 2012.