No more typing reviews! Try our Samantha, our new voice AI agent.

Intercept X Endpoint vs Rapid7 InsightIDR comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
5th
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Intercept X Endpoint
Ranking in Endpoint Detection and Response (EDR)
13th
Ranking in Extended Detection and Response (XDR)
16th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (15th), ZTNA (12th), Managed Detection and Response (MDR) (15th), Ransomware Protection (3rd)
Rapid7 InsightIDR
Ranking in Endpoint Detection and Response (EDR)
32nd
Ranking in Extended Detection and Response (XDR)
20th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
33
Ranking in other categories
Security Information and Event Management (SIEM) (22nd), User Entity Behavior Analytics (UEBA) (11th), Threat Deception Platforms (6th)
 

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of Intercept X Endpoint is 2.1%, up from 1.8% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.3%, up from 1.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
Intercept X Endpoint2.1%
Rapid7 InsightIDR1.3%
Other92.8%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Ashutosh Jha - PeerSpot reviewer
Project engineer at IT Solution india private limited
Endpoint protection has prevented attacks and keeps our daily work productive and secure
I rate Intercept X Endpoint a 10 out of 10 because it is working very fine for my environment and has prevented loss of productivity. I choose 10 out of 10 because Intercept X Endpoint protects my environment well, featuring web control, peripheral control, Threat Analysis Center, application control, and DLP alongside being accessible from cloud services. I advise others looking into using Intercept X Endpoint to choose Sophos for a cloud solution due to its AI and behavior-based detection capabilities. I believe Intercept X Endpoint is the best EDR solution, and I would always recommend it to customers because it is very effective. My overall review rating for Intercept X Endpoint is 10 out of 10.
Prajwal Chougale - PeerSpot reviewer
SOC L2 Analyst at a tech services company with 51-200 employees
Centralized threat hunting has improved alert accuracy and simplifies incident investigations
I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or monthly lacks detailed information about how logs are being ingested. While the details are there, they could be more concise and easier to understand for any level of authority. The second area is alert tuning; compared to Microsoft Sentinel, Rapid7 InsightIDR provides fewer alerts with more static alert functionality and lacks dynamic alerting exposures. There could be improvements to learn from past alert activities for more dynamic alert configurations. These two areas are the main areas for improvement; everything else is good.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Its ability to react to cyber data attacks is awesome. That is pretty much the use of it. What blows your mind is the ability to access your assets remotely and see what is actually going on with them. You can not only see them in a console. You can also react very rapidly to your assets that are compromised."
"Cortex XDR by Palo Alto Networks has helped lighten the load of our security analysts because it was the major tool that we were using and the one we utilized most."
"I like that the product has behavior-based detection which offers many benefits over signature-based detection."
"My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one."
"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"On a scale from one to ten, I would rate Cortex XDR by Palo Alto Networks a nine."
"The solution allows control over the user and his machine through Cortex XDR security policies."
"Stability is a primary factor, and then there's the ease of distribution and policy management; Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them."
"This is really good because it's applicable to zero-day threats."
"Intercept X helps with internal alerts, application access, and triggering support teams."
"We find all features valuable. It has zero-day protection, which is the most valuable feature of Intercept X. We have Intercept X with EDR. EDR is a very important feature. It gives an idea about the source of a particular attack. An administrator gets to know everything, which helps in understanding the things that need to be done or protected in the organization. Based on this information, an administrator can decide what needs to open or allowed in the network. Without EDR, Intercept X is like an antivirus, and the administrator won't get to know the things going on at the organizational level. I recommend purchasing an EDR solution for every organization."
"Its AI algorithms provide excellent protection against attackers."
"It is easy to interact with, and its cost is also good."
"The anti-exploit technology within Intercept X Endpoint is excellent."
"We use Sophos Intercept X for Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in our organization."
"I would definitely recommend this solution."
"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."
"The solution provides satisfying native integration features"
"Rapid7 InsightIDR is budget-friendly and has a good market position because not everybody can afford to go for LogRhythm or Splunk or QRadar."
"Rapid7 InsightIDR has positively impacted my organization by capturing most logs and every minute detail, including endpoint logs, network logs, and any email-related logs if a malicious link has been clicked."
"Previously, when something happened, such as when a hacker was attacking one of our customers, we were always behind, or we did not know that we were hacked until the ransomware started, but with the Rapid7 solution, at every step, we could online see what a person was doing, and we could prevent ransomware."
"The ability to ingest Office 365 log files, then process them into events and display them on a map."
"I definitely recommend Rapid7 InsightIDR."
"During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an application belongs to a known ransomware group. The system rates the threat, offering a clear detection ratio, such as 97 out of 100. It not only identifies threats but also illustrates the associated behaviors, helping us understand the potential risk to a particular endpoint."
 

Cons

"Palo Alto Networks Cortex XDR does not detect malicious activity like in other anti-virus solutions like Trend Micro and Windows with Cisco."
"If you compare it to SentinelOne, which has more functionalities and detection capabilities on an open platform, the pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks."
"The technical support is not very good. I find the process difficult."
"If he is using a smaller company, he can depend on some other tools because Cortex XDR by Palo Alto Networks is a bit expensive."
"The MAC agent is not as robust feature-wise as the PC version."
"If they had pulse rate detection, it would be better."
"I recommend adding a data loss prevention (DLP) solution to Cortex XDR by Palo Alto Networks. The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products."
"Based on our experience so far, its implementation is quite complex."
"Sophos Intercept X could improve on its setup process. They could make it easier to have a baseline set up for the system, or at least provide more understanding of what the baseline is when you first install it. This could be a matter of lack of training on my part, but it's difficult to receive training on solutions that are not Cisco. Cisco is the only vendor with classes or courses."
"We would like more application control in order to be able to schedule times and access."
"I'm not clear on what features need improvement. Everything is mostly fine."
"From the management side, we receive detailed information. Sophos has many features, such as Threat Hunting but that comes with the XDR version of the solution. There's Sophos Intercept X and then there's Sophos Intercept X with XDR technology. We bought the XDR and then now the MTR, Managed Threat Response version available too. They have different packages for clients which gives them different options to pick from. If Sophos could combine more features into one package it would be beneficial."
"If Sophos Intercept allows users to restrict website access based on specific needs, such as streaming new videos for business purposes, we would prefer to use that."
"I recommend that Intercept X Endpoint should include a patch assessment feature. Various vendors offer virtual patching solutions, which could be a game-changer, especially for the financial sector where frequent service restarts are challenging. These solutions allow patching servers without the need for restarts. Incorporating these features into Intercept X Endpoint would enhance its effectiveness in securing endpoints and servers."
"Mobile device management is a challenging area, and it can be improved. Some areas in the DLP solution can also be improved. It has the DLP capability, but it is not an all-out DLP program. I would like to see them improve the DLP solution in terms of reporting and possibly network monitoring. Currently, they only do the reporting parts of it."
"The EDR could be improved, and perhaps the User Interface."
"The searching feature in Rapid7 InsightIDR needs to evolve"
"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."
"Tenable Nessus is easier to deal with. It's more efficient and accurate. InsightIDR is heavier than Tenable in terms of performance and scanning. Rapid7 would be much easier to use if it had a network connector like Tenable. Tenable's connector allows continuous monitoring over the B caps."
"InsightIDR is only available in a cloud version. Some of our customers prefer an on-prem solution because they want to manage the security within their environment."
"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."
"Customised alert recipients need to be added to allow better first-line action and quicker response. Configurable honeypots would be a welcome addition."
"I'd like to be able to get the compliance report within the solution which is currently not possible."
"Sometimes, it is hard to get the right queries to use. Currently, the tool lacks a pre-made set of queries."
 

Pricing and Cost Advice

"I don't have any issues with the pricing. We are satisfied with the price."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"It is "expensive" and flexible."
"Its pricing is kind of in line with its competitors and everybody else out there."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."
"You are able to purchase more licenses for the number of devices or servers that you require. There are many other features available but our license does not include them, such as XDR, which is endpoint detection and response. We have not explored the new features as of yet but plan to in the coming future."
"It is not very expensive but I don't have specific pricing details. The licensing is usually done on yearly basis."
"The cost of Sophos Intercept X is reasonable."
"We are happy with the pricing across all Sophos products."
"Intercept X for endpoints is around $35 per user per year. The server version is $95 per server per year."
"You can purchase a license for one to three years."
"The price of this solution is reasonable."
"The price of this solution is a little high compared to competitors because they do not have a proper pricing structure."
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
"The pricing of the solution depends on the user. But there is a yearly licensing cost."
"​Accurately predict your licensing counts as this is a subscription based product.​"
"Rapid7 InsightIDR is priced very well and is cost-effective."
"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."
"The solution has a mid-range price point in the market"
"The pricing is good, and it is not very expensive."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
921,028 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Outsourcing Company
12%
Construction Company
10%
Comms Service Provider
9%
Manufacturing Company
9%
Manufacturing Company
10%
Financial Services Firm
9%
Comms Service Provider
8%
Outsourcing Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business76
Midsize Enterprise21
Large Enterprise22
By reviewers
Company SizeCount
Small Business22
Midsize Enterprise5
Large Enterprise6
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
How does Crodwstrike Falcon compare with Sophos Intercept X?
I like that Crowdstrike Falcon allows me to easily correlate data between my firewalls. Its detection and machine lea...
What is your experience regarding pricing and costs for Sophos Intercept X?
Intercept X Endpoint has some impact on the budget. It is quite costly when measuring Intercept X Endpoint's protecti...
What needs improvement with Sophos Intercept X?
Intercept X Endpoint can be improved in several ways. Currently, it is only available on the cloud, and having it ava...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...
What is your experience regarding pricing and costs for Rapid7 InsightIDR?
My experience with pricing, setup costs, and licensing has been very positive; it is cost-effective and offers great ...
What needs improvement with Rapid7 InsightIDR?
I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Sophos Intercept X
InsightIDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Flexible Systems
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Intercept X Endpoint vs. Rapid7 InsightIDR and other solutions. Updated: September 2026.
921,028 professionals have used our research since 2012.