Try our new research platform with insights from 80,000+ expert users

Expel vs Palo Alto Networks Cortex XSOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 9, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Expel
Ranking in SOC as a Service
4th
Average Rating
9.0
Reviews Sentiment
7.6
Number of Reviews
1
Ranking in other categories
Managed Detection and Response (MDR) (19th)
Palo Alto Networks Cortex X...
Ranking in SOC as a Service
2nd
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
46
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd)
 

Mindshare comparison

As of May 2025, in the SOC as a Service category, the mindshare of Expel is 9.0%, down from 10.7% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 20.8%, up from 11.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
SOC as a Service
 

Featured Reviews

reviewer2578461 - PeerSpot reviewer
Rapid threat management and diverse technology integration for effective monitoring
Expel has made it easier for companies to monitor and manage various log sources. With its vast integration portfolio, customers can efficiently monitor diverse environments. Time to value is quick, as Expel can turn their service up very rapidly. They have both automated active responses and human processes that quicken threat resolution.
NikhilSharma2 - PeerSpot reviewer
Ability to multiple playbooks to fetch data from multiple firewalls and utomated several tasks, including vulnerability scans and SOCL (Security Orchestration, Automation
Recently, they started implementing microservices in XSOAR, which has improved quality and addressed previous issues. However, they should focus more on licensing costs. The user licensing fees are quite high. For example, I received a quote for XSOAR, and it was $12,000 per user per year. If you have a SOC team of 30 members/analysts, you're looking at a substantial expense. They should consider reducing these costs since this high pricing seems to be more about profit. So, there is room for improvement in the pricing. Moreover, the reporting and dashboard features are decent but could be improved. The user interface (UI) is quite heavy and takes time to load, which is a major drawback.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses."
"I chose Cortex XSOAR because the client also has Palo Alto firewalls. I can incorporate the data from the Palo Alto firewalls into Cortex and send it into the same data lake to manipulate that data. It lets me manage and monitor the data in one place."
"It has an extensive list of integrations that are available out of the box which makes it easy to start."
"The orchestration in XSOAR is significantly easier compared to other SOAR tools I've used."
"The pricing is very good."
"Cortex XSOAR's playbook for incident management and automation is highly valuable."
"The automation part and the playbook creation part are awesome. The way it is responding to the customers and incidents is also very good. In the SOC environment, I guess it will carry out around 50% of the work."
"It is a scalable solution."
"Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents."
 

Cons

"The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management."
"The dashboard performance could be improved."
"The product can be tailored for each deployment to respond to specific customer needs, and this complexity may be seen as a downside."
"I think they should increase their collaboration base."
"It is not a very scalable solution."
"The solution's technical support could be better."
"There is room for improvement in support. The response time could be faster."
"The user interface (UI) is quite heavy and takes time to load, which is a major drawback."
"The complexity of Cortex XSOAR has a trade-off with its versatility. The deployment requires integration and the development of integration modules."
 

Pricing and Cost Advice

Information not available
"Cortex XSOAR's price could be lower."
"Palo Alto offers significant discounts to customers who purchase the products repeatedly."
"The pricing is fair. The pricing reflects the value and feature set it offers."
"The price of Palo Alto Networks Cortex XSOAR is comparable to other solutions in the market."
"The price of Palo Alto Networks Cortex XSOAR is expensive."
"My company did not make any payments towards the licensing costs attached to the product since we were only using its pilot version."
"The price of Palo Alto Networks Cortex XSOAR could be reduced. We are always looking for a discount. There is an annual license needed to use this solution."
"On a scale of one to ten, where one is a low price, and ten is a high price, I rate the pricing a nine."
report
Use our free recommendation engine to learn which SOC as a Service solutions are best for your needs.
849,686 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
20%
Financial Services Firm
9%
Manufacturing Company
7%
Government
7%
Financial Services Firm
15%
Computer Software Company
12%
Manufacturing Company
9%
Government
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Expel?
Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.
What needs improvement with Expel?
The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for m...
What is your primary use case for Expel?
I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Even though customers often comment on the price, the potential savings come from managing a large number of security events with a limited number of analysts. This leads to economic advantages des...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The complexity of Cortex XSOAR has a trade-off with its versatility. The product can be tailored for each deployment to respond to specific customer needs, and this complexity may be seen as a down...
 

Also Known As

Workbench, Expel SOC-as-a-Service
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Amanda Fennell CSO
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Arctic Wolf Networks, Palo Alto Networks, Netsurion and others in SOC as a Service. Updated: April 2025.
849,686 professionals have used our research since 2012.