No more typing reviews! Try our Samantha, our new voice AI agent.

Expel vs Palo Alto Networks Cortex XSOAR comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Expel
Ranking in SOC as a Service
5th
Average Rating
8.6
Reviews Sentiment
7.8
Number of Reviews
2
Ranking in other categories
Managed Detection and Response (MDR) (14th)
Palo Alto Networks Cortex X...
Ranking in SOC as a Service
3rd
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
62
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd)
 

Mindshare comparison

As of November 2026, in the SOC as a Service category, the mindshare of Expel is 7.9%, down from 9.1% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 5.8%, down from 9.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
SOC as a Service Mindshare Distribution
ProductMindshare (%)
Palo Alto Networks Cortex XSOAR5.8%
Expel7.9%
Other86.3%
SOC as a Service
 

Featured Reviews

reviewer2917971 - PeerSpot reviewer
Founder And Principal Technical Consultant at a consultancy with 51-200 employees
Expel has transformed MDR workflows and now streamlines phishing response and SOC 2 audits
Some of the best features Expel offers is the ease of use. Ease of use is top of mind. It also provides an opportunity for me to replace my SOC. Not necessarily replace my SOC because I utilize contractors on an as-needed basis, but it allows me to stay lean. I do get 24/7 monitoring, although they recently shortened up on the 24/7 monitoring offering. It also allows me to augment the existing SOC that I have for larger companies or larger enterprises that rely on me for that. It then extends the use of the tools I already have, as I mentioned with SentinelOne. Octa is another that comes to mind, and then for larger organizations that use CrowdStrike.
EricRise - PeerSpot reviewer
Noc Network Engineer at a outsourcing company with 51-200 employees
Automation playbooks have reduced soc noise and now streamline daily incident response
To improve Palo Alto Networks Cortex XSOAR, there can be a learning curve to it. It is not a very user-friendly product; it is complex. It handles debugs and automation playbooks. You have to really spend some time dedicated to learning the product, scripting, and acquiring your certifications on it. Cost is another item as well. That can be quite significant; it does depend on other tools for EDR, whether you are using Palo Alto's XDR system or any number of third-party products for that. There are some reporting and logging restrictions and limitations. Some of those are going to be constraints, including window size limits. Database use with it has limited scalability for that type of application.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Expel's customer support is great."
"Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses."
"For each SOC and MSS environment, I would recommend using Cortex XSOAR for better productivity, scalability, performance, and efficiency."
"The time to respond was reduced by approximately sixty percent, which specifically reduced the manual effort required from analysts."
"What I like about the Cortex team is that they have a dedicated select center where you can get service in minutes and that's extremely helpful."
"I am satisfied with the product overall."
"The product is quite easy to use."
"It is quite scalable. I would rate it a ten out of ten."
"I'm using Cortex XSOAR to manage our network security."
"The most valuable features are the orchestration because of the way in which it coordinates the loss from all the devices and it provides us with a high-level overview of the critical log information."
 

Cons

"I think the 24/7 SOC could be improved."
"The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management."
"To improve Palo Alto Networks Cortex XSOAR, there can be a learning curve to it. It is not a very user-friendly product; it is complex."
"Creating complex playbooks using coding languages, such as Python, could be easier."
"It was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider."
"The integration could be better. Cortex, for example, does not work with iPhone."
"Palo Alto Networks Cortex XSOAR could improve the Panorama feature. We had to turn it off because it was not working properly."
"The existing model is good, but if we go for big deployments, I think there are a few challenges in scalability. They use their internal BoltDB, which is good for a medium organization, but for large organizations, they support Elasticsearch, which is too costly."
"I believe ease of use would be an improvement for Palo Alto Networks Cortex XSOAR, as I see this as a valuable feature for future iterations."
"The solution is not a Palo Alto product so technical support is inadequate."
 

Pricing and Cost Advice

Information not available
"When I first looked at Demisto, it had a price tag of $250,000 but when we finally purchased it, it was $345,000."
"There is a yearly license required for this solution and it is expensive."
"It's cheaper compared to its competitors."
"The solution's cost is high."
"There is a perception that it is priced very high compared to other solutions."
"On a scale of one to ten, where one is a low price, and ten is a high price, I rate the pricing a nine."
"The solution is a bit on the expensive side."
"The solution's cost is reasonable."
report
Use our free recommendation engine to learn which SOC as a Service solutions are best for your needs.
920,939 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Construction Company
10%
Computer Software Company
8%
Manufacturing Company
7%
Financial Services Firm
13%
Manufacturing Company
8%
Outsourcing Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business26
Midsize Enterprise9
Large Enterprise33
 

Questions from the Community

What is your experience regarding pricing and costs for Expel?
Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.
What needs improvement with Expel?
The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for m...
What is your primary use case for Expel?
I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
We can quantify the reduction. It is more than sixty to seventy percent reduction in the MTTR, as per documents from Palo Alto, and with proper implementation, we can improve MTTR by up to sixty-fi...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The negative aspect of Palo Alto Networks Cortex XSOAR is the price; cost-wise, it is a bit higher. Other than enterprise clients, they might need to push their management to get additional approva...
What is your primary use case for Palo Alto Networks Cortex XSOAR?
We are a partner for Palo Alto as a service provider. Palo Alto Networks Cortex XSOAR is used as a SIEM solution or XDR-type solutions.
 

Also Known As

Workbench, Expel SOC-as-a-Service
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Amanda Fennell CSO
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Arctic Wolf Networks, LevelBlue, Palo Alto Networks and others in SOC as a Service. Updated: October 2026.
920,939 professionals have used our research since 2012.