No more typing reviews! Try our Samantha, our new voice AI agent.

Kandji vs Rapid7 InsightIDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Kandji
Ranking in Endpoint Detection and Response (EDR)
13th
Average Rating
8.8
Reviews Sentiment
6.4
Number of Reviews
18
Ranking in other categories
Vulnerability Management (20th), Mobile Device Management (MDM) (3rd), Enterprise Mobility Management (EMM) (5th)
Rapid7 InsightIDR
Ranking in Endpoint Detection and Response (EDR)
39th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
32
Ranking in other categories
Security Information and Event Management (SIEM) (23rd), User Entity Behavior Analytics (UEBA) (10th), Threat Deception Platforms (6th), Extended Detection and Response (XDR) (23rd)
 

Mindshare comparison

As of May 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Kandji is 0.5%, up from 0.3% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.2%, up from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.4%
Kandji0.5%
Rapid7 InsightIDR1.2%
Other94.9%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
CD
SysAdmin at a recreational facilities/services company with 11-50 employees
Strong security structure has supported fast Mac and iOS administration with minimal IT effort
One area for improvement for Kandji would be having a bigger suite of applications. I noticed that some of the niche apps our data software firm needs were not in the regular library. We were able to use the custom app feature to create those apps ourselves, but I would love it if Kandji could expand the library. I also wish Kandji could lock down different ports on MacBooks based on which ones we wanted to shut down, and I hope there is an easier way to sandbox people's bring your own device devices because when we're doing SOC 2, it really wants us to sandbox things so that if someone were to take a device that is not ours, we could delete just our data off there and not theirs. An improvement needed for Kandji would be the ability to remote into devices. I would appreciate something that is really reliable for that without having to buy third-party software.
SohailHyder - PeerSpot reviewer
Head Of Cyber Security at Super Secure
Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration
If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Previously, we had to install endpoint protection per machine and then scan and update, but Cortex XDR basically does that centrally and predictably, so we have more time to do day-to-day work rather than spend time chasing those endpoints."
"If you are looking to deploy a security solution as a whole, this is a good option."
"The tool's use cases are relevant to security."
"The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly. The way they have done everything and integrated all the solutions that they've purchased over the years to make it a very seamless, effective product is very good. One thing about Palo Alto is that they take the products or services that they purchase and make them seamless for the end user as compared to some companies that purchase other companies and then just kind of have their products off to the side or keep different interfaces. Palo Alto doesn't do that."
"The normal protection was really effective, and we detected situations that if we didn't have Cortex XDR by Palo Alto Networks, it's highly likely that we would have been affected, but it protected the infrastructure."
"After deploying Traps, we saw the performance of the network improve by 65 to 70 percent."
"It detected stuff that other things wouldn't detect."
"Their XDR agent and their behavioral indicators of compromise (BIOC) are pretty nice. Their managed threat hunting is also pretty nice. They also have WildFire, which is a service for actively looking for malware. It's quite useful."
"Kandji has positively impacted our organization by making it easy to manage all of our MacBook devices and applications."
"I have seen a return on investment with Kandji, as I save time."
"It's a very easy plug-and-play solution where you can just enroll the devices and choose the features you want."
"Kandji has positively impacted my organization because it was very easy to implement and manage all of our devices, especially when we manage with the ISO and SOC 2 certifications that we need for our organization."
"I highly recommend Kandji to others looking into using it since I have not seen any game-breaking issues; it is highly reliable, scalable, improves security, and reduces the time individuals need to spend on system configuration for security updates."
"Kandji has positively impacted my organization by simplifying the management of the Apple fleet."
"Everything is now compliant and controlled, and we know where each device is, with all updates pushed and managed and licenses that they do not require."
"Kandji has positively impacted my organization by providing remote and quick support."
"The solution's initial setup is easy."
"The platform offers unlimited storage and agent-based solutions."
"Integration with threat modeling from the Metasploit and InsightIDR repositories."
"The biggest reason why we chose Rapid7 was to gain value in a really quick time. Its deployment doesn't take months. It just takes a few days."
"InsightIDR has allowed us to find potential security issues that we did not know existed, and get remediation quickly."
"The solution is very stable and works very well for what I need it to do."
"The solution is very cost-effective because they are not charging based on the EPS but on the number of assets."
"Previously, when something happened, such as when a hacker was attacking one of our customers, we were always behind, or we did not know that we were hacked until the ransomware started, but with the Rapid7 solution, at every step, we could online see what a person was doing, and we could prevent ransomware."
 

Cons

"There are some third-party solutions that are difficult to integrate with, which is something that can be improved."
"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"It'll help if customization was easier."
"Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."
"There is a severe gap in functionality between Windows, Linux, and Mac versions."
"There are some false positives."
"In terms of areas of improvement, we have not completed our review of the product. We're also looking at other products. So, it's a little bit hard to tell what could be different because we have not completed the review of this product, but based on our experience so far, its implementation is quite complex."
"It should support more mobile operating systems. That is one of the cons of their infrastructure right now."
"In Kandji, I see a drawback related to the remote wipe function."
"The Windows part needs a lot of work."
"One area for improvement for Kandji would be having a bigger suite of applications."
"One way Kandji can be improved is through pricing, as other market providers comparatively have a lower price."
"I rated Kandji an eight because the laptop needs to be connected to Wi-Fi to erase it."
"While I do not have anything specific to add about the features, I do think there is a lack of flexibility in Kandji."
"Kandji should give open customization."
"While it might be on the expensive side compared to Jamf Pro, it is closer in pricing to other MDMs such as Microsoft Intune, which comes with the EMS E3 license, making it potentially pricey for startups, yet a good cost for established enterprises."
"Rapid7 doesn't integrate well with all our security tools from various vendors, so we plan to switch. Many of our solutions work with Rapid7, but some do not. We are already searching for a replacement already."
"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."
"One of the things that could be better is digital forensics. It is there, but it can be better."
"The reporting is the weakest aspect. There needs to be multi-level grouping for events (for example, group by user and destination)."
"Lacks a mobile application."
"I'd like to see a mobile application included and some feature related to the generality of segregation for internal users that access the application."
"The APIs can be further improved in Rapid7."
"The reporting is the weakest aspect. There needs to be multi-level grouping for events (for example, group by user and destination). Right now, we can do a group by user and a separate table or group by destination. But I'd be more interested in where a person was logging into instead of who was logging in or where he was logging in."
 

Pricing and Cost Advice

"It has a yearly renewal."
"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"It's about $55 per license on a yearly basis."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"Very costly product."
"Our customers have expressed that the price is high."
"It has reasonable pricing for the use cases it provides to the company."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"Users have to pay a yearly licensing fee for Kandji, which is expensive."
"It is more reasonably priced than other vendors."
"The pricing of the solution depends on the user. But there is a yearly licensing cost."
"​I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability.​"
"It is a reasonably priced solution."
"The solution has a mid-range price point in the market"
"The pricing is good, and it is not very expensive."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
"Rapid7 InsightIDR is priced very well and is cost-effective."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
894,738 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Financial Services Firm
13%
Computer Software Company
9%
Comms Service Provider
9%
Manufacturing Company
7%
Financial Services Firm
9%
Manufacturing Company
9%
Computer Software Company
9%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise49
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise5
Large Enterprise6
By reviewers
Company SizeCount
Small Business21
Midsize Enterprise5
Large Enterprise6
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Kandji?
The pricing, setup cost, and licensing experience are good. It is cheap, and we do not encounter any hassle during se...
What needs improvement with Kandji?
In Kandji, I see a drawback related to the remote wipe function. When we need to wipe a MacBook, sometimes the remote...
What is your primary use case for Kandji?
Kandji is used in our organization to manage all of our Mac devices. Kandji is an MDM tool which we use to manage our...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...
What needs improvement with Rapid7 InsightIDR?
If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
InsightIDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Kandji vs. Rapid7 InsightIDR and other solutions. Updated: April 2026.
894,738 professionals have used our research since 2012.