ExtraHop Reveal(x) 360 vs UnderDefense comparison

Why PeerSpot?

ExtraHop Networks and UnderDefense are both solutions in the Extended Detection and Response (XDR) category. ExtraHop Networks is ranked #27 with an average rating of 8.5, while UnderDefense is ranked #15 with an average rating of 10.0. ExtraHop Networks holds a 1.2% mindshare in XDR, compared to UnderDefense’s 0.2% mindshare. Additionally, 100% of ExtraHop Networks users are willing to recommend the solution, compared to 100% of UnderDefense users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jul 24, 2026

ExtraHop Reveal(x) 360 and UnderDefense MDR compete in cybersecurity. ExtraHop Reveal(x) 360 often holds an advantage in real-time threat detection and network visibility, while UnderDefense MDR gains favor for its proactive threat response capabilities.

Features: ExtraHop Reveal(x) 360 offers advanced network analysis, precise real-time detection, and rapid processing speed. UnderDefense MDR provides thorough incident response, effective proactive threat hunting, and extensive security measures.

Ease of Deployment and Customer Service: ExtraHop Reveal(x) 360 integrates smoothly and offers swift setup supported by professional service. UnderDefense MDR requires more effort for deployment but offers superior customer service and incident response support post-deployment.

Pricing and ROI: ExtraHop Reveal(x) 360 has a higher setup cost with justified ROI due to its real-time capabilities. UnderDefense MDR presents a more cost-effective setup with long-term savings through strategic threat management.

To learn more, read our detailed Extended Detection and Response (XDR) Report (Updated: October 2026).

Buyer's Guide

Extended Detection and Response (XDR)

October 2026

Download the complete report

Helped 921,523 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of November 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.8% compared to the previous year. The mindshare of ExtraHop Reveal(x) 360 is 1.2%, up from 0.7% compared to the previous year. The mindshare of UnderDefense is 0.2%, up from 0.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Extended Detection and Response (XDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	4.7%
UnderDefense	0.2%
ExtraHop Reveal(x) 360	1.2%
Other	93.9%

Extended Detection and Response (XDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Umair Shahid

Senior Network Consultant at a insurance company with 1,001-5,000 employees

Improved threat detection has transformed our investigation speed and network visibility

In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms. Second, some of the alert accuracy can be improved and simplified, since there are sometimes false positives. Lastly, dashboard customization could be more flexible, allowing engineers to create role-based dashboards rather than just application-based ones. I would say scalability is another area worth considering for ExtraHop Reveal(x) 360, particularly in large enterprise environments such as ours. As the network grows across data centers, cloud platforms, and distributed infrastructure, the platform needs to scale efficiently without compromising packet capture analytics or detection performance. I would also like to see simpler capacity planning and, if possible, more flexible hardware expansion and improved visibility into appliance resource utilization.

Read full review

Ivan Voitovych

Founder at Urlicer

AI-driven SOC triage has transformed threat monitoring and keeps our security work focused

The best features UnderDefense offers include mostly triage in-context signals read together across my stack, where one finding replaces many separate checks. A good thing too is its false positive suppression, as I do not get false notifications. Normal activity such as traffic spikes during customer events is recognized and documented, and only the unusual cases reach me. It has full-time support 24/7 with proactive reports, and monitoring runs around the clock. Reports and alerts come to me without even noticing or asking, so it is very useful. My team sees what happened without having to chase it. I find the proactive reporting and 24/7 support to have definitely made a real difference. Proactive reports mean I hear about what happened without having to ask, so I know the state of things at the start of the day, and 24/7 support matters most for traffic spikes and other events outside busy working hours, as I get an answer when I need one without keeping someone on call just in case, saving me a lot of time. Together, they let my team stay on infrastructure work and step in only when a decision is needed. Regarding UnderDefense's AI capabilities, I think the governance and security is the best there is, as the decisions that matter stay with my team and each finding is documented, allowing me to review afterwards how a conclusion was reached. That control and traceability is what I need from AI in a security role. The accuracy and reliability of UnderDefense's AI output is accurate and steady, as findings have matched what I saw when I checked them, and the pattern assessments are consistent, especially during large traffic events or spikes, which is when I depend on them most. When a case needs judgment, the reasoning is there so I can confirm it myself.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Cortex XDR is a simple platform that's easy for administrators and users. You have a lot of flexibility to change or customize the features."

"Its ability to react to cyber data attacks is awesome."

"Everything is organized straightforwardly; all the incidents are clearly described and everything you need is essentially in one menu and one UI interface, which is quite beneficial for me and also for the customer."

"The correlation with the firewall and the creation of policies by areas have facilitated security management in my company by allowing me to create more fine-tuned policies that take into account multiple aspects of the operation, multiple effects, multiple sources, and multiple destinations."

"It collects and caches and the knowledge of machine learning from different customers to take to the cloud, it makes it better to use for everybody, it allows for quick learning and updates and can, therefore, offer zero-day malware security, and this sharing of metadata helps make the solution very safe."

"Implementing Cortex XDR by Palo Alto Networks has had a significant impact on my security analyst workload because it becomes much easier."

"We have found in our test Cortex XDR by Palo Alto Networks to be a very good tool."

"The product is mostly automated, and we do not have to make decisions, because all the decisions are made by the product itself and we are not required to create any custom policies since the policies that are created are well defined in the product itself."

More Cortex XDR by Palo Alto Networks pros

"It is scalable."

"Overall, I would say it is very valuable for real-time network visibility, behavior, and threat detection."

"ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform."

"It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic. It is also easy to handle and easy to understand."

"ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments."

"Their technical support is more effective and of better quality than other competitors."

"It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management."

"The linking, the filtering, and the readable reasoning each help on their own, but together, they allow a small security team to handle the volume our platform produces without losing sight of the cases that matter."

"UnderDefense groups it into one alert with the caller, the endpoint, and the usual pattern, which allows us to contact the customer the same day with facts in hand."

"UnderDefense Gen AI SOC flags behavior that breaks from an account's own baseline, lays out which signals triggered the alert and why it reads as different from normal activity, and helps our team decide within the same day whether we are seeing a legitimate big campaign push or a compromised login."

"Every morning we look at a short list of cases that matter instead of a long list of raw alerts, and each case comes with the full picture, so we can decide in a few minutes whether it needs action."

"Routine signals are handled and documented, and only cases that need a human decision reach my team, allowing engineers to spend their time on infrastructure hardening instead of log digging."

Cons

"Palo Alto Networks Cortex XDR does not detect malicious activity like in other anti-virus solutions like Trend Micro and Windows with Cisco."

"The downside to the solution is that there are a large number of false positives."

"We had a problem with getting our older endpoints up to date, but their newest updates have been really good. I've been pleased with it in terms of what our needs are. It's doing what we want it to do."

"A little bit more automation would be nice."

"There are some limitations on the Traps agents."

"When it comes to malware files, it should be a little quick because, at times, it would give a wrong result in the sense of what it might be on malware, even if it still might be a normal one."

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."

"The GUI could be improved."

More Cortex XDR by Palo Alto Networks cons

"They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers."

"One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace."

"There needs to be more support."

"Their professional service can be improved."

"In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms."

"I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR."

"A drawback includes bucket storage limitations for payload data, necessitating timely extraction for thorough investigations."

"UnderDefense could improve in onboarding, which takes some dedicated time because the baseline for our high volume upload events needs to be set up first."

Pricing and Cost Advice

"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."

"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."

"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."

"I don't recall what the cost was, but it wasn't really that expensive."

"Very costly product."

"I am using the Community edition."

"Our license will require renewal in August, after which the maintenance will continue as usual."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"When compared to other solutions, it aligns with the market average, indicating a competitive pricing level."

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.

See recommendations

921,523 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Comms Service Provider

14%

Outsourcing Company

12%

Construction Company

10%

Manufacturing Company

10%

Comms Service Provider

14%

Financial Services Firm

10%

Construction Company

Outsourcing Company

Manufacturing Company

39%

Construction Company

13%

Security Firm

11%

Outsourcing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	50
Midsize Enterprise	21
Large Enterprise	57

No data available

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

What needs improvement with ExtraHop Reveal(x) 360?

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. In...

See all answers

What advice do you have for others considering ExtraHop Reveal(x) 360?

We have covered most of the features over the past three years and look forward to discovering more as we work closel...

See all answers

What is your primary use case for ExtraHop Reveal(X) Cloud?

I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time ...

See all answers

What is your primary use case for UnderDefense?

Our main use case for UnderDefense Agentic AI SOC is to watch how accounts actually use our platform. Our product is ...

See all answers

What is your experience regarding pricing and costs for UnderDefense?

The experience with pricing, setup cost, and licensing has been fair for what we get. Compared with building the same...

See all answers

What needs improvement with UnderDefense?

UnderDefense could improve in onboarding, which takes some dedicated time because the baseline for our high volume up...

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 16% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Vectra AI vs ExtraHop Reveal(x) 360

Compared 9% of the time

NetWitness NDR vs ExtraHop Reveal(x) 360

Compared 7% of the time

ExtraHop Reveal(x) vs ExtraHop Reveal(x) 360

Compared 5% of the time

TrendAI Vision One – Cloud Security vs ExtraHop Reveal(x) 360

Compared 5% of the time

More ExtraHop Reveal(x) 360 Competitors

SentinelOne Wayfinder Threat Detection and Response vs UnderDefense

Compared 15% of the time

Adlumin Security Operations vs UnderDefense

Compared 8% of the time

Comodo MDR vs UnderDefense

Compared 8% of the time

LevelBlue Managed Detection and Response vs UnderDefense

Compared 7% of the time

Fidelis Elevate vs UnderDefense

Compared 6% of the time

More UnderDefense Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

November 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

ExtraHop Reveal(x) 360

November 2026

Download ExtraHop Reveal(x) 360 product report

Buyer's Guide

AI-SOC

October 2026

Download UnderDefense product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

ExtraHop Reveal(X) Cloud, Reveal(X) Cloud

No data available

Interactive Demo

Demo not available

Palo Alto Networks

Demo not available

ExtraHop Networks

UnderDefense

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

ExtraHop Reveal(x) 360 offers advanced network detection and response capabilities, designed to provide real-time situational awareness and threat detection across hybrid and multi-cloud environments.

Built to meet the demands of modern enterprises, ExtraHop Reveal(x) 360 enhances visibility into network activities, delivering comprehensive security insights. It uses high-speed data analysis to identify anomalous behaviors and potential threats, helping security teams respond effectively. With centralized visibility, it ensures quick detection and thorough investigation of threats within complex infrastructures, including cloud, edge, and on-premises environments.

What key features does ExtraHop Reveal(x) 360 offer?

Real-Time Threat Detection: Monitors network traffic in real-time for immediate threat identification.
Centralized Visibility: Offers a unified dashboard for observing activities across diverse environments.
Automated Response: Enables predefined actions to mitigate threats swiftly without manual intervention.
Integration Capabilities: Seamlessly integrates with tools for enhanced incident management.
Advanced Analytics: Utilizes machine learning to detect sophisticated threats promptly.

What benefits should users look for in reviews of ExtraHop Reveal(x) 360?

Improved Security Posture: Evidence of enhanced organizational security through faster threat detection and response.
Operational Efficiency: Reduction in time and effort for IT teams due to automated processes.
Scalability: Flexibility to expand with organizational growth and technology changes.
Cost-Effectiveness: Attractive pricing compared to functionality and outcomes offered.

ExtraHop Reveal(x) 360 is implemented across industries such as financial services, healthcare, and retail, where robust security measures are paramount. In these sectors, the capabilities of ExtraHop Reveal(x) 360 align with the need for secure handling of sensitive data and compliance with industry regulations, providing valuable protection and detection capabilities.

ExtraHop Networks

AGENTIC AI SOC

UnderDefense Agentic AI SOC works on top of your existing security stack, turning every security team into a machine-speed defense unit without tool replacement or headcount expansion. It takes over the investigative routine that pulls your team away from strategic decisions: enrichment, correlation, triage.

▸ Investigation at Machine Speed: Agentic AI SOC accesses tools, enriches data, and performs deep cross-environment investigations at machine speed. It correlates, triages, and forms conclusions, offloading all repetitive work from your team.

▸ 2 Minutes Per Alert: Complete SIEM queries, threat intel checks, and cross-system correlations in 2 minutes. Every step fully observable and auditable.

▸ Human at Every Decision Point: The platform verifies suspicious activity with end-users via Slack or Teams, then routes containment decisions to your team or our 24/7 IR experts.

UnderDefense

Sample Customers

CBI Health Group, University Honda, VakifBank

Wizards of the Coast

Kyte, Betsson Grourp, Mammut, Accedian.

Buyer's Guide

Extended Detection and Response (XDR)

October 2026

Download Free Report

Find out what your peers are saying about SentinelOne, TrendAI, Palo Alto Networks and others in Extended Detection and Response (XDR). Updated: October 2026.

DOWNLOAD NOW

921,523 professionals have used our research since 2012.

See our list of best Extended Detection and Response (XDR) vendors.

We monitor all Extended Detection and Response (XDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.