No more typing reviews! Try our Samantha, our new voice AI agent.

LevelBlue USM Anywhere vs SanerNow CyberHygiene Platform comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 24, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
LevelBlue USM Anywhere
Ranking in Endpoint Detection and Response (EDR)
33rd
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Log Management (27th), Security Information and Event Management (SIEM) (26th), Compliance Management (12th)
SanerNow CyberHygiene Platform
Ranking in Endpoint Detection and Response (EDR)
59th
Average Rating
9.6
Reviews Sentiment
7.6
Number of Reviews
2
Ranking in other categories
Vulnerability Management (59th), Patch Management (21st), Risk-Based Vulnerability Management (27th)
 

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of LevelBlue USM Anywhere is 1.4%, up from 0.3% compared to the previous year. The mindshare of SanerNow CyberHygiene Platform is 0.9%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
LevelBlue USM Anywhere1.4%
SanerNow CyberHygiene Platform0.9%
Other93.9%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Kris Nawani - PeerSpot reviewer
Co-Founder/Director at Bangkok MSP Company Limited
Offers complete coverage without the need to install additional software
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools The solution offers complete coverage without the need to install additional software, as it is maintained by the vendor. It helps in saving…
JU
Information Technology Supervisor at DMCI Homes, Inc.
Can automate updates and manage software licenses more effectively
Our team uses the SanerNow CyberHygiene Platform for threat detection, focusing on features like vulnerabilities and asset exposure. The asset exposure feature is packaged with software licenses and machines. We get the latest updates and patches for Windows workstations and applications for remediation. We can automate these updates, which greatly improves our previous manual and scripting-based tools. Before, we struggled with setting policies and making changes to workstations. Now, we can automate updates and manage software licenses more effectively. We monitor who's using various licenses like Office, CAD, Visio, and Lumion.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Has great threat detection capabilities."
"The information the dashboard provides is very clear."
"The good thing about the product is that it's always scanning."
"Cortex XDR can integrate the firewalls and determine the tendencies of the attacks. It's a new generation antivirus, with protection endpoints and detection response. It is very easy to use and everybody can operate the solution."
"The dashboard is customizable."
"Once you become familiar with it, Cortex XDR by Palo Alto Networks is a more powerful tool and I would say that I prefer it over MDE because it is a stronger tool for me."
"Cortex XDR by Palo Alto Networks should be a stable solution."
"I have found the solution to be very easy in respect of the integration and configurable."
"AlienVault gave our organization a centralized tool to manage our security with its intrusion detection, asset management, vulnerability assessments, along with all of its other features, it has become an invaluable asset for our small organization."
"The Event Correlation and vulnerability scans have been the most useful. As a 24/7 SOC, we use the incoming alarms to give an overview of suspicious traffic going through the network. It's easy to look at the correlated events and see the broad picture of traffic for that customer. Vulnerability scans are good for providing patch and remediation guidelines to keep customer systems secure."
"It is the most valuable tool that I have seen of the SIEM solutions."
"We used, tested, and tried several solutions prior to this solution; this solution answered too many questions under one reasonable cost, as opposed to piecemealing everything together for more money."
"We had used previous products and found AlienVault centralized the logging for our security."
"I think this has a lot of valuable functions that really could be leveraged quite nicely."
"The other big selling feature for us was its integration capabilities with all the other security-based products."
"I highly recommend AlienVault USM for anybody that is seeking a SIEM solution that is easy to implement and easy to manage."
"Our team uses the SanerNow CyberHygiene Platform for threat detection, focusing on features like vulnerabilities and asset exposure. The asset exposure feature is packaged with software licenses and machines. We get the latest updates and patches for Windows workstations and applications for remediation. We can automate these updates, which greatly improves our previous manual and scripting-based tools."
"Although it is, in fact, a complete vulnerability management solution, the most valuable feature is the patch management functionality. Most of our customers give preference to this tool over other tools when it comes to patch management."
 

Cons

"Basically, they don't provide customer support tools just to investigate the logs."
"In some cases, there are too many options for me, and it is a bit too hard to find some settings which I really need to implement."
"They are charging for Network Traffic Analyzer (NTA) services, so if the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better."
"In an upcoming release, the solution could improve by proving hard disk encryption. If it could support this it would be a complete solution."
"There are some default policies which sometimes affect our applications and cause them to run around."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"A little bit more automation would be nice."
"In reporting they should have a customizable dashboard due to the fact that C-level people don't like reporting to the IT department. They prefer to have a real-time dashboard. That kind of dashboard needs to have various customizations."
"Technical support has been okay. It hasn't been great."
"Scaling, and it has no APIs! It would be hard for any legitimate MSSP to use it."
"It should be able to communicate with other security solutions to stop threats."
"Some customizations with the integration between AlienVault components have room for improvement and enabling users with WebUI interfaces instead of having to edit configuration files on the system to achieve certain actions would be a good improvement."
"The only complex area of the setup was writing the custom scripts."
"There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks."
"It would be great if there was a feature to add in watch lists, like McAfee or QRadar have -- to keep track of IPs, domain, etc. that I have identified as being malicious."
"Reporting is convoluted and difficult at times, although they claim to have hundreds of pre-built reports, very few of them are actually useful for anything but what the USM is doing."
"SanerNow CyberHygiene Platform needs to incorporate more documentation."
"SanerNow has good integration with the more well known ITSM tools, but at the same time there are many other ITSM (IT Service Management) tools available in the market, including local tools here in India, and I'm not sure how SanerNow plans to integrate with them all out of the box."
 

Pricing and Cost Advice

"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"The price is on the higher side, but it's okay."
"The pricing is a little bit on the expensive side."
"This is an expensive solution."
"The price was fine."
"I don't have any issues with the pricing. We are satisfied with the price."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"It is "expensive" and flexible."
"It's affordable for most customers."
"The licensing fees are dependent on usage."
"It has good pricing."
"QRadar, ArcSight and Splunk are some of the most expensive SIEM products out there in the market and not everyone has the budget to buy them. In such cases, AV USM is a very cost effective alternative."
"Negotiate the best package for your environment."
"Use an MSSP instead. It is much cheaper."
"Do the one month trial and try to work out the kinks during it, as it has free support and service hours."
"Use the AlienVault team. They are helpful and the documentation that they provide is second to none."
"As with several other solutions such as Microsoft MECM and SCCM, the licensing for SanerNow involves per-device pricing for each kind of product or service on offer."
"The pricing is reasonable - we paid about 2.5 million for 3,500 nodes."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
921,148 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Outsourcing Company
16%
Construction Company
16%
Comms Service Provider
9%
Manufacturing Company
9%
Outsourcing Company
17%
Comms Service Provider
13%
Construction Company
8%
Financial Services Firm
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business65
Midsize Enterprise29
Large Enterprise25
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with AT&T AlienVault USM?
There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also...
What is your primary use case for AT&T AlienVault USM?
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence...
Ask a question
Earn 20 points
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity
SecPod SanerNow, SanerNow RP
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Siemens, Aruba, SironLabs, POS Aviation, Kotak, Kaizen Automotive, Amagi, McNeilus Steel, Claremont, Glassbeam, Marlabs, Amazon Web Services
Find out what your peers are saying about LevelBlue USM Anywhere vs. SanerNow CyberHygiene Platform and other solutions. Updated: September 2026.
921,148 professionals have used our research since 2012.