No more typing reviews! Try our Samantha, our new voice AI agent.

Galvanize IncidentBond [EOL] vs Palo Alto Networks Cortex XSOAR comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Galvanize IncidentBond [EOL]
Average Rating
9.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
Palo Alto Networks Cortex X...
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
62
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd), SOC as a Service (3rd)
 

Featured Reviews

DE
Information Security Engineer at a financial services firm with 1,001-5,000 employees
Customization and transparency of data, while maintaining a mostly user-friendly UI
Sadly, I can’t provide specific examples due to the nature of the content of the improvements. I will say that, prior to implementation, and post-implementation, we saw a nearly 800% increase in volume of completed and correctly completed documentation in regards to specific tasks being completed. Rsam puts the workflow first, and lets the record follow it. It literally puts a task on rails and the person needing to do the work only need respond to the prompts accordingly and let Rsam automate the rest. The data is cleaner, more uniform, and there’s simply more of it created more quickly, as a result.
EricRise - PeerSpot reviewer
Noc Network Engineer at a outsourcing company with 51-200 employees
Automation playbooks have reduced soc noise and now streamline daily incident response
To improve Palo Alto Networks Cortex XSOAR, there can be a learning curve to it. It is not a very user-friendly product; it is complex. It handles debugs and automation playbooks. You have to really spend some time dedicated to learning the product, scripting, and acquiring your certifications on it. Cost is another item as well. That can be quite significant; it does depend on other tools for EDR, whether you are using Palo Alto's XDR system or any number of third-party products for that. There are some reporting and logging restrictions and limitations. Some of those are going to be constraints, including window size limits. Database use with it has limited scalability for that type of application.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The customization and the transparency of data while still maintaining a mostly user-friendly UI, are key features. It allows for me, as an engineer, to evolve the individual components and modules, and to create a much more meaningful picture than the individual pieces in isolation ever could."
"Rsam puts the workflow first, and lets the record follow it, literally putting a task on rails so the person needing to do the work only needs to respond to the prompts accordingly and let Rsam automate the rest."
"I have not faced any challenges with the deployment of Palo Alto Networks Cortex XSOAR at this stage."
"The performance is great."
"The most valuable features are simplicity and ease of integration."
"Palo Alto Networks Cortex XSOAR is a good product with enhanced and efficient playbooks, as demonstrated during our use case simulations."
"The product can automate security tasks."
"The most valuable feature is automation, as there is a huge variety of automation that can help any team and there is a threat model."
"The most valuable features of Palo Alto Networks Cortex XSOAR are its overall track record and features that fit our use case."
"In my opinion, the best features offered by Palo Alto Networks Cortex XSOAR are the automation, the graphical incident interface, the assignment functionality, and automatically closing the incident with closure reasons."
 

Cons

"Stable – Release – Experimental" system with their releases, and all the proper checks and balances, I’d be an incredibly happy individual. I can appreciate the cause and affect, wherein the customization of the tool drives rapid release schedules, and the paradox that creates with the idea of stable releases. I’d also like more transparency about known bugs and issues."
"Hands down, if Rsam adopted a more industry proper "End of life – Deprecated – Stable – Release – Experimental" system with their releases, and all the proper checks and balances, I’d be an incredibly happy individual."
"Customization and performance can be improved. For example, some formats were incompatible when integrating, and they said we needed to work with the vendor to fix this issue because some logs that AVA logs were not compatible, and it did not readily recognize the format."
"XSOAR could have more integration options."
"The existing model is good, but if we go for big deployments, I think there are a few challenges in scalability. They use their internal BoltDB, which is good for a medium organization, but for large organizations, they support Elasticsearch, which is too costly."
"There is room for improvement in support. The response time could be faster."
"Another area I can suggest is the searching or reporting feature where you have to write a query, which is definitely good for searching your incidents."
"For building automation, there is not a lot of good documentation. The documentation is there, but it is not very good from my perspective. There should be an improvement in this area. I don't see issues with anything else. In terms of new features, I have heard that other products have EBA functionality. It would be good if this functionality could be added."
"Palo Alto Networks Cortex XSOAR has not had a positive impact on my organization or my work personally because we are currently in the process of putting Palo Alto Networks Cortex XSOAR into production to improve it, so I do not yet know the full impact."
"The negative aspect of Palo Alto Networks Cortex XSOAR is the price; cost-wise, it is a bit higher."
 

Pricing and Cost Advice

Information not available
"It is expensive."
"There is a perception that it is priced very high compared to other solutions."
"From the cost perspective, I have heard that its price is a bit high as compared to other similar products."
"The solution is based on an annual licensing model that is expensive."
"The solution is expensive."
"It's cheaper compared to its competitors."
"The solution's pricing needs improvement."
"The price of Palo Alto Networks Cortex XSOAR is expensive."
report
Use our free recommendation engine to learn which Security Incident Response solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
No data available
Financial Services Firm
13%
Manufacturing Company
8%
Outsourcing Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business26
Midsize Enterprise9
Large Enterprise33
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
We can quantify the reduction. It is more than sixty to seventy percent reduction in the MTTR, as per documents from Palo Alto, and with proper implementation, we can improve MTTR by up to sixty-fi...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The negative aspect of Palo Alto Networks Cortex XSOAR is the price; cost-wise, it is a bit higher. Other than enterprise clients, they might need to push their management to get additional approva...
What is your primary use case for Palo Alto Networks Cortex XSOAR?
We are a partner for Palo Alto as a service provider. Palo Alto Networks Cortex XSOAR is used as a SIEM solution or XDR-type solutions.
 

Also Known As

IncidentBond, Rsam SIRP, Rsam Incident Management, Rsam Security Incident Response Platform
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Information Not Available
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about ServiceNow, Proofpoint, Broadcom and others in Security Incident Response. Updated: October 2026.
920,929 professionals have used our research since 2012.