No more typing reviews! Try our Samantha, our new voice AI agent.

Kaspersky Next XDR Expert vs Sangfor Endpoint Secure comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 9, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
112
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Kaspersky Next XDR Expert
Ranking in Endpoint Detection and Response (EDR)
35th
Average Rating
7.8
Reviews Sentiment
6.3
Number of Reviews
19
Ranking in other categories
Extended Detection and Response (XDR) (20th)
Sangfor Endpoint Secure
Ranking in Endpoint Detection and Response (EDR)
32nd
Average Rating
8.2
Reviews Sentiment
7.4
Number of Reviews
11
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Kaspersky Next XDR Expert is 1.0%, down from 1.7% compared to the previous year. The mindshare of Sangfor Endpoint Secure is 0.8%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.4%
Sangfor Endpoint Secure0.8%
Kaspersky Next XDR Expert1.0%
Other94.8%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Manikumar David - PeerSpot reviewer
IT Manager at R K Khanna and Associates
Experienced weak security checks and increased system load with limited control
Kaspersky Endpoint Detection and Response is not up to the mark compared to what I have seen from earlier products. I was using CrowdStrike, and Kaspersky Endpoint Detection and Response is not up to the mark compared to CrowdStrike and other products. Kaspersky Endpoint Detection and Response sometimes seems to allow certain files which should not be allowed on its own. I trust Kaspersky Endpoint Detection and Response to check the files, but I cannot sit and check all the files that are coming in. Kaspersky Endpoint Detection and Response has its own weaknesses. Kaspersky Endpoint Detection and Response slows the system slightly. It uses more resources than what CrowdStrike does. When any attack happens or something is happening with other products I am using, Kaspersky Endpoint Detection and Response stops certain things. However, it does not take me to the file, and it is not user-friendly.
OA
Coordinator Associate at National Institute of Cardiovascular Diseases
Quick threat response and behavior analysis while enhancing network security
The main use case is usually related to security. It deals with attacks that come day-to-day such as zero-day attacks and APT attacks. Our main task is to secure the network infrastructure in the hospital where I work It facilitates the departments of IT and other departments to procure and…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"They did what they said. This solution could apply to any scenario."
"The good thing about the product is that it's always scanning."
"It's a nice product that's stable and scalable."
"Automation and playbooks have helped me significantly, as Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context, efficiently detecting and blocking malicious attacks with firewalls while eliminating workload and speeding responses for next-generation operations."
"Implementing Cortex XDR by Palo Alto Networks has had a significant impact on my security analyst workload because it becomes much easier."
"One of the main benefits of the solution is its intelligence to correlate the events into an incident."
"The solution doesn't need a high level of technical training."
"I have found the solution to be very easy in respect of the integration and configurable."
"One of the good features is the provider's Faulting capability. If any of our systems detect malware, we can check the behavior of the malware by sending it to Kaspersky's sandbox environment. This helps us assess how destructive the malware is. After analyzing it, we can create use cases and protection measures based on that behavior. So, this is the best feature of Kaspersky."
"Kaspersky offers more visible and comprehensive features compared to other products."
"One of the most valuable aspects of Endpoint Detection and Response (EDR) solutions is their ability to detect and respond to spam and viruses in their early stages."
"The product is integrated with endpoint protection. We don't have to implement a separate technology. It provides visibility over the endpoints."
"I have Kaspersky Endpoint Detection and Response firewall on my computer, which sits at the gate, so I manage maximum things through that."
"Regarding the machine learning capability in Kaspersky Endpoint Detection and Response, it performs adequately when considering its improvement in detection accuracy and reduction of false positives."
"The advanced detection features are valuable."
"Kaspersky EDR is far superior to other products. It gives detailed information about malware, geolocation, and more. Also, the agent itself is very lightweight compared to other products. The packages and updates were quite small in size, just a few KBs."
"The real-time monitoring feature of Sangfor Endpoint Secure is truly real-time, with no delay compared to other solutions."
"I like the tool's honeypot feature. Some features include having a honeypot to detect attacks in a certain area. Additionally, there is RDP protection, which means that when we remote into our server or any endpoint, we must enter a password as a second layer of security. It can also integrate with next-generation firewalls."
"The product's initial setup phase was straightforward."
"The most valuable feature I have found in the system is its comprehensive end-to-end protection."
"It has a quick response time, threat intelligence, cybersecurity features, quick report generation, behavior analysis, dynamic detection, and quarantine features."
"We use the product for network protection from any malicious threat."
"The tool's AI feature is helpful in endpoint security."
"What stands out to me is the dual-end user interface they provide."
 

Cons

"Cortex XDR by Palo Alto Networks could improve by offering remote management. It would be useful to look at the client's issue to fix it."
"This is a very costly product."
"I would like to see them include NDR (Network Detection Response)."
"The dashboard could use some significant improvement, just making it more useful with more information. It has a limited amount of information right now. It is customizable, but I'd love to see a better out-of-box dashboard."
"Dashboards do not allow everyone to see what's happening."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"The solution should force customers to integrate with network traffic to see the full benefits of XDR."
"In an upcoming release, the solution could improve by proving hard disk encryption. If it could support this it would be a complete solution."
"I want to be able to use the product as a patch management tool for my endpoints since it is an area that is not working effectively for me."
"It needs improvement in communication between the network and endpoint, as well as between endpoint and server."
"Kaspersky EDR could be improved by adding network detection capabilities to enhance convenience and security."
"There are certain shortcomings with the UI of the solution. The UI is not at all user-friendly."
"Kaspersky Endpoint Detection and Response is not up to the mark compared to CrowdStrike and other products."
"First, it would be beneficial if they could optimize the solution to be less resource-intensive, as it currently tends to put a heavy load on our machines and requires specialized servers for deployment."
"Kaspersky Endpoint Detection and Response needs vast resources on the central node. Not all maintenance tasks are in the GUI, so we often use commands. The lack of documentation for these processes means we frequently reach out to support, open tickets, and run complex CLI commands. It's not the most straightforward process. It should also improve stability."
"Incorporating an AI protection tool with the capability to detect and prevent zero-day threats, particularly those with a five-star rating in terms of severity would be beneficial."
"Sangfor Endpoint Secure performs poorly."
"When an issue occurs, the response time for first-level support and the time taken for meetings could be improved."
"The interface has too many buttons, making it cluttered."
"I believe Sangfor Endpoint Secure could improve in terms of its user interface and management capabilities."
"There are a few areas for improvement. We have encountered licensing issues on occasion, and sometimes updates don't apply properly."
"It would be much more convenient if the migration tool could be installed directly on the customer's VMs, enabling a smoother migration process to the new infrastructure, with potential restrictions addressed accordingly."
"Sangfor Endpoint Secure should include healing capabilities."
"It is complicated to establish a tunnel due to technical issues in the VPN system."
 

Pricing and Cost Advice

"The cost depends on your chosen license type, like Pro or other licenses."
"Cortex XDR’s pricing is very reasonable."
"I am using the Community edition."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."
"Cortex XDR's pricing is ok."
"Cortex XDR is a costly solution."
"It is cost-effective in terms of services and features compared to other more expensive EDR solutions like CrowdStrike and Trend Micro."
"I was satisfied with the pricing of Kaspersky."
"The product is cheap."
"The tool's pricing is reasonable."
"The pricing falls within the average range."
"I would say that their pricing is generally competitive and attractive."
"I rate the solution's pricing model a seven on a scale of one to ten, where one is cheap, and ten is expensive."
"The solution is not cheap, but it is not expensive."
"Sangfor Endpoint Secure's pricing is cheap. I rate it seven out of ten."
"Price-wise, Sangfor Endpoint Secure can be considered a competitively priced product in the market as it offers quite low prices compared to other solutions."
"Its "pay as you grow" model offers cost-effectiveness compared to major cloud providers."
"We were using Hyper-V. So, we switched to Sangfor because of the pricing."
"The solution is cheap. It is cheaper than other products by 15-20 percent."
"The product is expensive compared to other vendors."
"Sangfor Endpoint Secure is not a cheap solution."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
896,034 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Comms Service Provider
13%
Financial Services Firm
9%
Manufacturing Company
8%
Real Estate/Law Firm
6%
Financial Services Firm
17%
Comms Service Provider
11%
Media Company
7%
University
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise20
Large Enterprise51
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise6
Large Enterprise6
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise3
Large Enterprise3
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Kaspersky Endpoint Detection and Response?
Kaspersky Endpoint Detection and Response is not up to the mark compared to what I have seen from earlier products. I...
What advice do you have for others considering Kaspersky Endpoint Detection and Response?
It seems okay. CrowdStrike was not heavy on my network or usage. I would rate this product an 8.
What needs improvement with Sangfor Endpoint Secure?
The interface has too many buttons, making it cluttered. It would be better if it were a simplified version with fewe...
What is your primary use case for Sangfor Endpoint Secure?
Sangfor Endpoint Secure is easy to handle with its user-friendly interface. The four engines it utilizes for endpoint...
What advice do you have for others considering Sangfor Endpoint Secure?
At first, people might not understand the interface, which is why it should be simplified. However, once they underst...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Information Not Available
Find out what your peers are saying about Kaspersky Next XDR Expert vs. Sangfor Endpoint Secure and other solutions. Updated: April 2026.
896,034 professionals have used our research since 2012.