No more typing reviews! Try our Samantha, our new voice AI agent.

Expel vs Palo Alto Networks Cortex XSOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Expel
Ranking in SOC as a Service
4th
Average Rating
9.0
Reviews Sentiment
7.6
Number of Reviews
1
Ranking in other categories
Managed Detection and Response (MDR) (15th)
Palo Alto Networks Cortex X...
Ranking in SOC as a Service
2nd
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
51
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (3rd)
 

Mindshare comparison

As of May 2026, in the SOC as a Service category, the mindshare of Expel is 7.7%, down from 9.1% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 5.1%, down from 20.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
SOC as a Service Mindshare Distribution
ProductMindshare (%)
Palo Alto Networks Cortex XSOAR5.1%
Expel7.7%
Other87.2%
SOC as a Service
 

Featured Reviews

reviewer2578461 - PeerSpot reviewer
MDR Specialist at a tech services company with 201-500 employees
Rapid threat management and diverse technology integration for effective monitoring
Expel has made it easier for companies to monitor and manage various log sources. With its vast integration portfolio, customers can efficiently monitor diverse environments. Time to value is quick, as Expel can turn their service up very rapidly. They have both automated active responses and human processes that quicken threat resolution.
CC
Enterprise Security Architect V at FirstEnergy
Customization supports seamless workflow while data influx challenges response time
What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali. I can create various custom automations and custom fields. There is significant customization ability in this platform. If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier. All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools. This serves as our central location where our SOC analysts can work and determine if incident response is needed. The platform provides data enrichment capabilities, offering information upfront so analysts do not have to search for it. They can access details such as username, phone number, email address, and workplace information. For malware files, they can retrieve details from VirusTotal, including file names and environment presence. We have built substantial automation around these features, which also helps us track case metrics, investigation time, and threat mitigation duration.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses."
"Many different playbooks are available and can be customized."
"Palo Alto Networks Cortex XSOAR has had a huge impact on our organization's mean time to resolution for incidents, improving the security SOC operations efficiency tremendously, by more than 80% to 90%."
"It was easy to integrate Cortex with existing infrastructure and other tech tools."
"The most valuable features are simplicity and ease of integration."
"What I like about the Cortex team is that they have a dedicated select center where you can get service in minutes and that's extremely helpful."
"The automation part and the playbook creation part are awesome. The way it is responding to the customers and incidents is also very good. In the SOC environment, I guess it will carry out around 50% of the work."
"It is a scalable solution."
"Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents."
 

Cons

"The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management."
"The integration could be better. Cortex, for example, does not work with iPhone."
"Implementing this solution requires a lot of involvement from the vendor and it should be made easier for the partners."
"For building automation, there is not a lot of good documentation. The documentation is there, but it is not very good from my perspective. There should be an improvement in this area. I don't see issues with anything else. In terms of new features, I have heard that other products have EBA functionality. It would be good if this functionality could be added."
"Creating complex playbooks using coding languages, such as Python, could be easier."
"For building automation, there is not a lot of good documentation. The documentation is there, but it is not very good from my perspective."
"The licensing is paid on a yearly basis. It is quite expensive."
"In terms of improvement, it needs to be more modular. It's not. When you're working in layouts and you create specific apps within layouts, there's no portability right now in order to reuse that code across multiple layouts."
"I would love to see more flexibility on what we can display and design on the dashboards."
 

Pricing and Cost Advice

Information not available
"The solution is expensive."
"There is a perception that it is priced very high compared to other solutions."
"The solution's cost is reasonable."
"Palo Alto offers significant discounts to customers who purchase the products repeatedly."
"Cortex XSOAR's price could be lower."
"The solution is a bit on the expensive side."
"The solution's cost is high."
"The price of Palo Alto Networks Cortex XSOAR is expensive."
report
Use our free recommendation engine to learn which SOC as a Service solutions are best for your needs.
893,438 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
11%
Construction Company
10%
Retailer
8%
Financial Services Firm
13%
Computer Software Company
10%
Manufacturing Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business21
Midsize Enterprise9
Large Enterprise26
 

Questions from the Community

What is your experience regarding pricing and costs for Expel?
Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.
What needs improvement with Expel?
The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for m...
What is your primary use case for Expel?
I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is zero versus $20 million, which is why they have to make a decision.
What needs improvement with Palo Alto Networks Cortex XSOAR?
Regarding areas for improvement in Palo Alto Networks Cortex XSOAR, I want to highlight one concern about playbook creation. While I personally appreciate this approach, I have observed that junior...
What is your primary use case for Palo Alto Networks Cortex XSOAR?
My primary use cases for Palo Alto Networks Cortex XSOAR are malware incidents, specifically phishing-related incidents, Trojan horses, spyware, and similar threats.
 

Also Known As

Workbench, Expel SOC-as-a-Service
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Amanda Fennell CSO
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Arctic Wolf Networks, Palo Alto Networks, LevelBlue and others in SOC as a Service. Updated: May 2026.
893,438 professionals have used our research since 2012.