No more typing reviews! Try our Samantha, our new voice AI agent.

FortiXDR vs Vectra AI comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
118
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
FortiXDR
Ranking in Extended Detection and Response (XDR)
24th
Average Rating
8.0
Reviews Sentiment
6.6
Number of Reviews
4
Ranking in other categories
No ranking in other categories
Vectra AI
Ranking in Extended Detection and Response (XDR)
16th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
48
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (5th), Network Detection and Response (NDR) (3rd), Identity Threat Detection and Response (ITDR) (11th), AI-Powered Cybersecurity Platforms (7th)
 

Mindshare comparison

As of September 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.8%, down from 6.1% compared to the previous year. The mindshare of FortiXDR is 1.5%, up from 1.0% compared to the previous year. The mindshare of Vectra AI is 2.4%, down from 4.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.8%
Vectra AI2.4%
FortiXDR1.5%
Other91.3%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
LL
Integration capabilities enhance compatibility across various cloud environments
I have extensive experience using Fortinet solutions, especially FortiXDR. I have implemented perimeter security in Azure, utilizing features such as web application firewall, application control, and security management.  I specialize in security for data centers, using various Fortinet solutions…
RR
Consultant at a retailer with 5,001-10,000 employees
Threat detection has improved and malicious emails are now identified quickly
Vectra AI offers artificial intelligence capabilities with visibility that can be integrated into our day-to-day operations and other tools, including malware detection tools and cyber threat tools. Vectra AI has positively impacted my organization. Last year while using it, we received many malicious email threats and virus incidents, including a trojan virus that had reportedly been deployed by someone. Our company used Vectra AI to detect the malicious threats and viruses before they could cause more damage, and we successfully stopped the threats. Using Vectra AI, I notice that server downtime has decreased significantly. We now experience only two to three hours of downtime, whereas without Vectra AI and other tools, our downtime would exceed 48 to 72 hours.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cortex XDR lets us manage several clients from the same console, and its endpoint defense is more advanced than traditional antivirus."
"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."
"The initial setup is easy."
"Cortex XDR by Palo Alto Networks is easy to use and does not consume a lot of hardware resources."
"Cortex XDR by Palo Alto Networks is specifically designed to prevent zero-day attacks and is part of an ecosystem of Palo Alto, providing customers with a long-term vision to modify and redesign how security is applied in their company."
"I have found the solution to be very easy in respect of the integration and configurable."
"Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
"The product's most valuable features are massive user and feature intelligence exploit detection."
"The most valuable feature of FortiXDR is it integrates well with other Fortinet solutions, such as Fortinet firewall, FortiMail, FortiSandbox, Forti Fabric, switches, and access points. Whatever the flow of the traffic comes in or goes out, the entire traffic can be managed and monitored properly."
"Our customers are satisfied with FortiXDR."
"The most valuable feature of FortiXDR is its ability to block clients, providing comprehensive endpoint protection."
"The product is stable enough."
"FortiXDR is valuable for its integration capabilities with one hundred percent compatibility with other vendors in cloud environments like Google, Oracle, and Microsoft."
"It is doing some artificial intelligence. If it sees a server doing a lot of things, then it will assume that is normal. So, it is looking for anomalous behavior, things that are out of context which helps us reduce time. Therefore, we don't have to look in all the logs. We just wait for Vectra to say, "This one is behaving strange," then we can investigate that part."
"One of the key advantages for us is we define a 24/7 service around it. We use far more of Vectra alerts than we do with our SIEM product because we understand that when we get an alert from Vectra we actually need to do something about it."
"It does a reliable job of parsing out the logs of all the network traffic so that we can ingest them into our SIEM and utilize them for threat hunting and case investigations. It is pretty robust and reliable. The administration time that we spend maintaining it or troubleshooting it is very low. So, the labor hour overhead is probably our largest benefit from it. We spend 99% of our time in Vectra investigating cases, responding to incidents, or hunting, and only around 1% of our time is spent patching, troubleshooting, or doing anything else. That's our largest benefit from Vectra."
"Using this tool for automation has provided more benefits to our processes."
"One of the most valuable features is all the correlation that it does using AI and machine learning. An example would be alerting on a host and then alerting on other things, like abnormal behavior, that it has noticed coming from the same host. It's valuable because we're a very lean team."
"Some valuable features of Vectra AI are that it is very intuitive and that there are only a small amount of false positives. Therefore, it's an effective solution."
"Vectra was the only tool that picked up almost all the red team penetration activities, helped us detect threats in their initial recon phase before they caused damage, and has significantly reduced the time it takes us to respond to attacks."
"Vectra AI can bring the ability to detect intrusion on the network more so than legacy IDS tools."
 

Cons

"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."
"Additionally, I think the price is very high, and if it can be adjusted, I believe it will be a very good solution."
"The encryption is not up to the mark."
"They've been having some issues with updating their endpoint agents, and it has been quite frustrating."
"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."
"The solution eats memory of the computer, unlike anything I've ever seen."
"Improvement is needed in the intuitiveness and integration measures of FortiXDR, especially in terms of compatibility."
"The pricing of FortiXDR should be improved. It's a point of concern for us."
"They could change their licensing costs to make it more affordable for smaller businesses."
"Many of the solutions, such as CrowdStrike have an MDR solution where remediation can be provided by the vendor. For example, if there is any zero data threat found, a new threat that the customer is not able to recognize, fix, or understand what needs to be done this feature has to be added in FortiXDR so that the customer feels comfortable."
"The solution's ability to reduce false positives wasn't very good, initially, because it was picking up so much information."
"The reporting from Cognito Detect is very limited and doesn't give you too many options."
"An area for improvement in Vectra AI is reporting because it currently lacks some details."
"We had another product with Vectra AI and used the MDR solution as an add-on. Initially, it wasn't fully appropriately configured, so we didn't get the expected results. Even once configured correctly, we weren't fully satisfied with its response. The issue was both with their service response and the product's capabilities."
"One area where there's room for improvement is the absence of a comprehensive TCP recording and replay feature."
"You are always limited with visibility on the host due to the fact that it is a network based tool. It gives you visibility on certain elements of the attack path, but it doesn't necessarily give you visibility on everything. Specifically, the initial intrusion side of things that doesn't necessarily see the initial compromise. It doesn't see stuff that goes on the host, such as where scripts are run. Even though you are seeing traffic, it doesn't necessarily see the malicious payload. Therefore, it's very difficult for it to identify these type of host-driven complex attacks."
"The solution's marketing is not good."
"They use a proprietary logging format that is probably 90% similar to Bro Logs. Their biggest area of improvement is finishing out the remaining 10%. That 10% might not be beneficial to their ML engine, but that's fine. The industry standard is Zeek Logs or Bro Logs, or Bro or Zeek, depending on how old you are. While they have 90% of those fields, they're still missing some fields. In very rare instances, some community rules do not have the fields that they need, and we had to modify community rules for our logs. So, their biggest area of improvement would be to just finish their matching of the Zeek standard."
 

Pricing and Cost Advice

"Our license will require renewal in August, after which the maintenance will continue as usual."
"Cortex XDR's pricing is ok."
"Very costly product."
"I don't like that they have different types of licenses."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"It has reasonable pricing for the use cases it provides to the company."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"The price is on the higher side, but it's okay."
"This is an expensive solution compared to other vendors, such as Check Point."
"We have a desire to increase our use. However, it all comes down to budget. It's a very expensive tool that is very difficult to prove business support for. We would like to have two separate networks. We have our corporate network and PCI network, which is segregated due to payment processing. We don't have it for deployed in the PCI network. It would be good to have it fully deployed there to provide us with additional monitoring and control, but the cost associated with their licensing model makes it prohibitively expensive to deploy."
"We are running at about 90,000 pounds per year. The solution is a licensed cost. The hardware that they gave us was pretty much next to nothing. It is the license that we're paying for."
"The pricing is very good. It's less expensive than many of the tools out there."
"The license is based on the concurrent IP addresses that it's investigating. We have 9,800 to 10,000 IP addresses."
"There are additional features that can be purchased in addition to the standard licensing fee, such as Cognito Recall and Stream."
"Vectra's licensing model could scale to our research network, which has multiple, 100-gigabit links."
"The pricing is high."
"The upfront pricing model that we have would have been more beneficial if it had been a recurring license fee, but that wasn't a massive issue for us. It's fairly priced."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
914,805 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
12%
Comms Service Provider
12%
Construction Company
11%
Manufacturing Company
9%
Comms Service Provider
16%
Outsourcing Company
9%
Construction Company
7%
Manufacturing Company
6%
Manufacturing Company
10%
Financial Services Firm
9%
Computer Software Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise21
Large Enterprise55
No data available
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise10
Large Enterprise29
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for FortiXDR?
Comparing to the enterprise level, the pricing is reasonable. However, for some companies, it might be a little high.
What needs improvement with FortiXDR?
They could change their licensing costs to make it more affordable for smaller businesses.
What is your primary use case for FortiXDR?
We are a system integrator and cloud service provider. Although I am in sales and not technical, I am involved with t...
What is your experience regarding pricing and costs for Vectra AI?
I find the pricing of Vectra AI to be one of the best we have seen as feedback from customers and partners indicates ...
What needs improvement with Vectra AI?
I think one area that could be improved about Vectra AI is their marketing. One of the aspects that Darktrace excels ...
What is your primary use case for Vectra AI?
I primarily use Vectra AI for customers, and I only provide Vectra AI.
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
Vectra Networks, Vectra AI NDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association
Find out what your peers are saying about FortiXDR vs. Vectra AI and other solutions. Updated: August 2026.
914,805 professionals have used our research since 2012.