No more typing reviews! Try our Samantha, our new voice AI agent.

Intercept X Endpoint vs Zscaler Client Connector comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Intercept X Endpoint
Ranking in Endpoint Detection and Response (EDR)
13th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (15th), ZTNA (12th), Managed Detection and Response (MDR) (15th), Extended Detection and Response (XDR) (16th), Ransomware Protection (3rd)
Zscaler Client Connector
Ranking in Endpoint Detection and Response (EDR)
23rd
Average Rating
8.8
Reviews Sentiment
5.9
Number of Reviews
6
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of Intercept X Endpoint is 2.1%, up from 1.8% compared to the previous year. The mindshare of Zscaler Client Connector is 0.7%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
Intercept X Endpoint2.1%
Zscaler Client Connector0.7%
Other93.4%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Ashutosh Jha - PeerSpot reviewer
Project engineer at IT Solution india private limited
Endpoint protection has prevented attacks and keeps our daily work productive and secure
I rate Intercept X Endpoint a 10 out of 10 because it is working very fine for my environment and has prevented loss of productivity. I choose 10 out of 10 because Intercept X Endpoint protects my environment well, featuring web control, peripheral control, Threat Analysis Center, application control, and DLP alongside being accessible from cloud services. I advise others looking into using Intercept X Endpoint to choose Sophos for a cloud solution due to its AI and behavior-based detection capabilities. I believe Intercept X Endpoint is the best EDR solution, and I would always recommend it to customers because it is very effective. My overall review rating for Intercept X Endpoint is 10 out of 10.
DA
IT Support Admin at Kuehne & Nagel Inc.
Client activity has been monitored efficiently through in-depth log analysis and traffic filtering
I use the Zscaler speed test, and it is very nice. We use some logs from Zscaler Client Connector to collect data and see what is happening, such as if there is an interruption or something. There is a specific tunnel version that we have to use because, depending on the internet provider, some of them have lower speed, so we have some issues. This is because of the provider, not from Zscaler. We use Office 365 services and Office applications, and because some connections are slow and they do not have full coverage from the internet provider, we have some issues. If the speed is slow for Zscaler Client Connector connection, then we have issues because if the speed is not good, then Zscaler Client Connector goes down. This may be because they put some policy. Of course, if you use Office 365 services such as Outlook, the minimum bandwidth is 5 megabits and more, so this causes issues if the users do not have a good remote connection. This depends on the companies and the users, so they need to fix it. This is not from us or our company. It is very useful, and the logs are very helpful. When we go to logs, we understand what is happening.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The integrations are out-of-the-box, as are the playbooks."
"From the Palo Alto side, whatever they buy, they integrate that really well into their integration suite, and that makes a massive difference."
"Its ability to react to cyber data attacks is awesome. That is pretty much the use of it. What blows your mind is the ability to access your assets remotely and see what is actually going on with them. You can not only see them in a console. You can also react very rapidly to your assets that are compromised."
"If any application performs suspicious activities, such as changing registries or modifying other applications, Cortex XDR detects and blocks the entire application."
"It's a perfect solution. It integrates well into the environment."
"After installing this solution, it identified, blocked, and provided the complete attack chain, which was very helpful."
"The solution's most valuable feature is its ability to rapidly detect certain hardware files."
"Palo Alto is the core of the security infrastructure in the environment."
"Sophos Intercept X is a good protection service package for small businesses and large corporations."
"The most valuable feature of Sophos Intercept X is cloud management."
"The solution is scalable."
"It is a very scalable solution."
"Sophos Intercept X is a complete endpoint solution."
"It is a practically maintenance free intelligent system that independently protects environments from malicious attacks."
"For someone contemplating implementing the solution who is looking for a single product containing many features, Sophos Intercept X is the best available."
"Its AI algorithms provide excellent protection against attackers."
"The solution operates in the background seamlessly without the user noticing."
"It is very useful, and the logs are very helpful; when we go to logs, we understand what is happening."
"The best features of Zscaler Client Connector are that it gives the client a much more transparent experience, as they don't have to worry about connecting to a VPN."
"Zscaler Client Connector has eliminated VPN bottlenecks and outages, improved user productivity with instant secure access, and reduced help desk tickets related to VPN issues, overcoming 60% of VPN-related problems while allowing faster onboarding of remote users and better enforcement of zero-trust security policies."
"I'd rate the solution nine out of ten."
"It is very important to see what is happening between the user and the applications that we have, and to filter the traffic from outbound traffic and inside traffic."
"The real-time analytics feature in Zscaler Client Connector is another valuable feature called Digital Experience, or ZDX, which can easily identify the root cause of issues accessing public or internal resources and provide good analysis so relevant teams can quickly resolve them, making it a very good tool that helps customers."
"Zscaler Client Connector is quite scalable, and I would rate its scalability as nine or ten out of ten."
 

Cons

"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."
"I have faced some issues with Cortex XDR by Palo Alto Networks; there is room for improvement in the sense that certain options prevent us from seeing and segregating data."
"Enhancing UI simplicity and playbook flexibility are areas that could benefit from more low-code automation options for smoother integrations."
"It'll help if customization was easier."
"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."
"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."
"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."
"The downsides of Cortex XDR by Palo Alto Networks are that in many incidents, when I enter the causality chain, there are numerous logs."
"The choices offered for the on-premises and cloud-based platforms are the reverse of each other, such as the one responsible for allowing or denying access."
"I would like the solution to have more functions and to be more user-friendly."
"From the management side, we receive detailed information. Sophos has many features, such as Threat Hunting but that comes with the XDR version of the solution. There's Sophos Intercept X and then there's Sophos Intercept X with XDR technology. We bought the XDR and then now the MTR, Managed Threat Response version available too. They have different packages for clients which gives them different options to pick from. If Sophos could combine more features into one package it would be beneficial."
"The initial setup was not very user-friendly, but it improved during the evolution."
"Stability-wise, we had issues with some clients which had to be dealt with manually. The issue was with that installation part."
"To be a perfect product, the price would have to be a bit better."
"Sophos has a lot of different features. Some of them are tied to different clients, which may mean that different prices or licenses have to be added on. It can be a little bit confusing if you're not familiar with the logic of how they work. They can make it a little bit clearer."
"The after sales service and support could be improved, particularly on the technical side."
"If the speed is slow for Zscaler Client Connector connection, then we have issues because if the speed is not good, then Zscaler Client Connector goes down."
"There is a hard learning curve for Zscaler Client Connector; their support isn't the greatest all the time."
"Zscaler Client Connector is not low in cost; it is definitely on the higher side."
"There is room for improvement regarding the price of Zscaler Client Connector, as it is one of the most expensive solutions available."
"The stability of Zscaler Client Connector needs improvement, as it often disconnects and reconnects."
"I rate this product nine out of ten because I have seen some minor instability issues after updates and some room for UI improvement for deeper analytics, with instances of major issues after updating the GCC that required rollbacks."
 

Pricing and Cost Advice

"I am using the Community edition."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"The price is on the higher side, but it's okay."
"It is "expensive" and flexible."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"Very costly product."
"Cortex XDR by Palo Alto Networks is an expensive solution."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"We have an annual subscription."
"The cost of Sophos Intercept X is reasonable."
"There is a yearly payment to be made. For each client, it costs around 15 dollars. There are no additional costs besides the licensing price we pay to use the solution."
"Licensing fees are paid monthly."
"The solution’s pricing is high."
"I would rate the price 7 out of 10, where 1 is most expensive and 10 is cheapest. Also, a little reduction in price can be a great move for Intercept X Endpoint."
"I find the pricing to be a little bit expensive, although it is acceptable, for now."
"It was fairly and reasonably priced."
Information not available
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Outsourcing Company
12%
Construction Company
10%
Comms Service Provider
9%
Manufacturing Company
9%
Manufacturing Company
17%
Comms Service Provider
10%
Financial Services Firm
8%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business76
Midsize Enterprise21
Large Enterprise22
By reviewers
Company SizeCount
Small Business3
Large Enterprise5
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
How does Crodwstrike Falcon compare with Sophos Intercept X?
I like that Crowdstrike Falcon allows me to easily correlate data between my firewalls. Its detection and machine lea...
What is your experience regarding pricing and costs for Sophos Intercept X?
Intercept X Endpoint has some impact on the budget. It is quite costly when measuring Intercept X Endpoint's protecti...
What needs improvement with Sophos Intercept X?
Intercept X Endpoint can be improved in several ways. Currently, it is only available on the cloud, and having it ava...
What is your experience regarding pricing and costs for Zscaler Client Connector?
My experience with pricing, setup cost, and licensing is that the pricing is fair, though it is a bit costly. It oper...
What needs improvement with Zscaler Client Connector?
For Zscaler Client Connector, I would appreciate more granular control over the client update rollout and slightly fa...
What is your primary use case for Zscaler Client Connector?
My main use case of Zscaler Client Connector is to provide secure, seamless access to the internet and internal appli...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Sophos Intercept X
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Flexible Systems
Information Not Available
Find out what your peers are saying about Intercept X Endpoint vs. Zscaler Client Connector and other solutions. Updated: September 2026.
920,929 professionals have used our research since 2012.