Lookout vs Trellix Endpoint Detection and Response (EDR) comparison

Lookout vs. Trellix Endpoint Detection and Response (EDR)

Download the complete report

Helped 902,417 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of June 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.5%, down from 4.0% compared to the previous year. The mindshare of Lookout is 0.8%, up from 0.4% compared to the previous year. The mindshare of Trellix Endpoint Detection and Response (EDR) is 1.0%, down from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.5%
Trellix Endpoint Detection and Response (EDR)	1.0%
Lookout	0.8%
Other	94.7%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

David Baynton

IT Manager at NHS Trust

Enhanced mobile security with visibility into app and website usage, but installation challenges remain

We use Lookout for mobile devices, such as phones It has reduced our risk around mobile devices. I like the security features and being able to see what apps and websites people are using. There is nothing we have come across that we've desired. We have been using Lookout for one year. The…

Read full review

Duncan Kims

Business Development Manager at a retailer with 10,001+ employees

Advanced detection has reduced targeted attacks and builds daily confidence in our defenses

Trellix Endpoint Detection and Response (EDR) has a very low false positive rate compared to other products, thus increasing the SOC efficiency in how my team relies on the solution day-to-day.With the best features Trellix Endpoint Detection and Response (EDR) offers, ease of SOAR integration helps to automate the IOC distribution, and our security team and management trust the product. Advanced detection capabilities ensure that targeted attacks will be detected and blocked before they arrive at our network. SOAR integration has assisted our security team and management in trusting the product.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It can automatically correlate events and logs, which is very helpful for an IT administrator. It can correlate different kinds of malware activities over a network, agent, or host system. You do not need to do it manually. It is a good feature. It is also a user-friendly solution. We have deployed it on the cloud because our space does not provide any flexibility for on-premises deployment, but Palo Alto has added some flexibility to install it on-premises. It must be like the same Cortex XDR agent for all the VPN services, web filtering services, and everything else."

"Automation and playbooks have helped me significantly, as Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context, efficiently detecting and blocking malicious attacks with firewalls while eliminating workload and speeding responses for next-generation operations."

"The most valuable for us is the correlation feature."

"Cortex XDR is a very capable solution for protecting large networks and a lot of endpoints. It's very useful because the automation is very high, and if you combine it with the features on Palo Alto firewalls, it provides very strong protection."

"The scalability of Cortex XDR by Palo Alto Networks is very good."

"When the pandemic started, Palo Alto came up with many solutions, which helped with the quick shift from on-premises to the cloud."

"It has absolutely improved the way our organization functions, we are more secure, it is giving us more peace of mind, and it has found malicious activity happening on our endpoints that probably would not have been detected if we didn't have it."

"I generally believe that Cortex XDR by Palo Alto Networks is probably the best in the market right now."

More Cortex XDR by Palo Alto Networks pros

"The protection offered by the product is the most valuable feature. It detects vulnerabilities or traps on our users' phones and then prompts them to clean up their devices. Tools we used previously would only discover, which required us to gather information on the backend, so Lookout is a welcome upgrade."

"The most valuable features are the antivirus as a whole, the anti-malware, and all of the protection features that scan our enterprise devices."

"We have not had any issues with bugs or breakdowns."

"It has been helpful in terms of identifying unknown threats."

"Trellix Endpoint Detection and Response (EDR) is valuable because we have a Wide Area Network with many sites, and the EDR is cross-site since it is installed and managed from the cloud."

"Blocking browser navigation is a feature of the solution with which we have experienced success."

"Trellix Endpoint Detection and Response (EDR) has positively impacted my organization with threat exchange and intel, low false positive ratios, and very high uptime values for both inline and spam modes, along with advanced detection and mitigation capabilities ensuring the highest level of protection and proper detection for command and control and bot attacks."

"The most valuable features of the solution are the ability to isolate or quarantine devices and block or detect Ransomware and other well-known tools that are used to exploit vulnerabilities on devices."

"Trellix Endpoint Detection and Response (EDR) scores highly because of its sheer depth of endpoint visibility, the precision of its behavior-based detection, and the massive time savings we get from its AI-guided investigations."

"The product's initial setup phase was very straightforward since you just need to install it, and it works."

"The dashboard makes it easier and more effective to analyze data."

More Trellix Endpoint Detection and Response (EDR) pros

Cons

"The solution should force customers to integrate with network traffic to see the full benefits of XDR."

"There are some limitations on the Traps agents."

"It'll help if customization was easier."

"There is also no recovery feature; if some endpoint is under attack there must be the possibility of recovering it or restoring it to a normal state."

"The playbooks could be improved to include more functionalities or actions."

"They are charging for Network Traffic Analyzer (NTA) services, so if the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better."

"Fine-tuning the detection policy requires experience because the policy is very complex in Cortex XDR by Palo Alto Networks, and we get high false positive alerts."

"There are some default policies which sometimes affect our applications and cause them to run around."

More Cortex XDR by Palo Alto Networks cons

"From the analysis that we've done, they do seem to be maybe a step behind in trying to enter the market with a new solution. But when they do pick up, they do come out with some good products."

"The initial setup requires a little bit of experience with configuration."

"We just submitted an enhancement request reflecting the main area we want to see improvement in; the APIs. Currently, we're able to build dashboards, but it's somewhat backward because we use our MDM API to create them. Lookout should provide API to customers so we can query our data and use it in our cloud, and this is the only outstanding area for improvement with the product right now."

"One of their issues is that they were very much based on agents, whereas most of the other solutions are clientless."

"The console has a lot of bugs, and it creates many issues."

"The main drawbacks are resources and processing time, as it consumes a lot of CPU and RAM."

"The solution's downside stems from the fact that Trellix Endpoint Detection and Response (EDR) and McAfee MVISION Endpoint are not combined into a single solution, so from an improvement perspective, they need to be combined into a single solution."

"For Spanish users, it is necessary to have a knowledge base specifically designed for them, which is currently not available."

"Trellix does not support Linux and Mac."

"Some modules that are doing machine learning and artificial intelligence are blocking our processes."

"McAfee technical support has been not that great in the past two months, and it could be because they just merged with another company."

More Trellix Endpoint Detection and Response (EDR) cons

Pricing and Cost Advice

"I am using the Community edition."

"Compared to CrowdStrike, Cortex XDR is an expensive solution."

"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."

"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."

"I feel it is fairly priced."

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."

"The pricing is a little bit on the expensive side."

"It's the most expensive solution, but features-wise, it's quite strong. It's very good for protection, so the results are very good in the case of protection. I would rate it a two out of ten in terms of pricing."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"Lookout is definitely on the lower end when it comes to price point and that seems to be the only differentiator. The technology is in place in this space and it's really about who is coming in at the better price point now."

"The pricing is fair; it's comparable to our previous solution, and we carried out multiple POCs and POVs (proof of value). The product is worth the money we pay for it."

"Speaking about the price, you must use the product to find the product's cost for you."

"Pricing is a problem in South Africa. It could be cheaper here. The rand-to-dollar exchange rate makes it expensive for us. A 25 dollar endpoint cost becomes quite significant when converted to rand."

"The price is reasonable."

"On a scale of one to ten, where one is low and ten is high, I rate the solution's pricing an eight out of ten."

"Pricing for McAfee MVISION Endpoint Detection and Response is not that expensive, but it's not something that a startup could buy. Pricing for it is for midsized businesses. There's an additional payment if you want data retention for more than thirty days. They gave us data retention for thirty days. Then if you want longer data retention, they have the paid option for a three-month data retention period and for a one-year data retention period."

"The product’s pricing is reasonable."

"The licensing costs attached to the solution are very easy to manage. There is a need to make yearly payments towards the licensing costs."

"McAfee MVISION Endpoint Detection and Response is reasonable in terms of cost. It's a tool my company has been using for a few years now. It costs $25,000 to $30,000 for six hundred users."

More Trellix Endpoint Detection and Response (EDR) pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

902,417 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

12%

Financial Services Firm

11%

Manufacturing Company

10%

Comms Service Provider

Manufacturing Company

12%

Financial Services Firm

10%

Construction Company

Government

Financial Services Firm

15%

Construction Company

Manufacturing Company

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	46
Midsize Enterprise	21
Large Enterprise	52

By reviewers
Company Size	Count
Small Business	2
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	16
Midsize Enterprise	3
Large Enterprise	14

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

What is your experience regarding pricing and costs for Lookout?

The pricing is a little expensive. We are currently looking at comparisons with other solutions, including Umbrella.

What needs improvement with Lookout?

There is nothing we have come across that we've desired.

What is your primary use case for Lookout?

We use Lookout for mobile devices, such as phones.

What is your experience regarding pricing and costs for McAfee MVISION Endpoint Detection and Response?

My experience with pricing, setup cost, and licensing is very cost-effective, but for small organizations working und...

What needs improvement with McAfee MVISION Endpoint Detection and Response?

One area where Trellix Endpoint Detection and Response (EDR) can be improved is the lack of device or user mapping.I ...

What is your primary use case for McAfee MVISION Endpoint Detection and Response?

Trellix Endpoint Detection and Response (EDR) is my organization's main solution for threat detection and mitigation ...

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Comparisons

Compared 10% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Zimperium vs Lookout

Compared 10% of the time

CrowdStrike Falcon vs Lookout

Compared 5% of the time

Microsoft Defender for Endpoint vs Lookout

Compared 5% of the time

Workspace ONE UEM vs Lookout

Compared 3% of the time

Check Point Harmony Mobile vs Lookout

Compared 3% of the time

More Lookout Competitors

Trellix Endpoint Security Platform vs Trellix Endpoint Detection and Response (EDR)

Compared 14% of the time

CrowdStrike Falcon vs Trellix Endpoint Detection and Response (EDR)

Compared 8% of the time

TrendAI Vision One vs Trellix Endpoint Detection and Response (EDR)

Compared 6% of the time

Trellix Active Response vs Trellix Endpoint Detection and Response (EDR)

Compared 6% of the time

Blackberry Dynamics Apps vs Trellix Endpoint Detection and Response (EDR)

Compared 2% of the time

More Trellix Endpoint Detection and Response (EDR) Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Download Lookout product report

Mobile Threat Defense

May 2026

Trellix Endpoint Detection and Response (EDR)

Download Trellix Endpoint Detection and Response (EDR) product report

Trellix Endpoint Detection and Response (EDR) report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

CipherCloud

McAfee MVISION EDR, MVISION EDR, MVISION Endpoint Detection and Response

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Lookout offers a mobile EDR solution that uniquely addresses the challenges of iOS and Android security, providing comprehensive threat defense and visibility.

By utilizing AI-driven security and behavioral analysis, Lookout identifies and mitigates mobile threats before they escalate. Lookout's mobile threat defense system is tailored for modern risks, protecting employee devices from social engineering attacks such as phishing and smishing. It bridges the gap between mobile and traditional endpoint security, ensuring secure mobile productivity through the world's largest mobile security data set.

What are the key features of Lookout?

AI-Driven Threat Detection: Uses AI to identify and neutralize threats proactively.
Comprehensive Mobile Security: Protects against mobile malware, and network threats.
Behavioral Analysis: Evaluates device activities to detect anomalies and potential threats.
Advanced Social Engineering Defense: Guards against phishing, smishing, and other social engineering tactics.
Risk Alignment: Integrates mobile risk assessment with traditional endpoint security.

What benefits should users expect?

Enhanced Security: Ensures robust protection against emerging mobile threats.
Improved Visibility: Provides real-time insights for effective risk management.
Increased Productivity: Enables secure access to mobile apps and data.
AI-Powered Protection: Delivers smarter and faster threat detection.
Cost Efficiency: Reduces the need for multiple security solutions.

Lookout is widely implemented across industries like finance, healthcare, and government due to its ability to secure sensitive data on mobile platforms. Financial institutions value its proactive threat detection, healthcare providers rely on its compliance capabilities, and government agencies trust its robust defense against sophisticated attacks. Lookout helps organizations maintain security while enabling mobile productivity.

Lookout

Trellix Endpoint Detection and Response (EDR) offers advanced threat detection using AI-driven analytics, real-time monitoring, and integration with the MITRE Framework, enhancing security through comprehensive detection and response features.

Trellix EDR provides users with tools for threat hunting, powerful forensic capabilities, and intuitive dashboards. It integrates with diverse systems and supports cloud-based multi-site configurations, which facilitates a more robust security posture. With features like effective quarantine measures, behavior monitoring, and automation, it enhances operational efficiency. Despite its strengths, areas for refinement include better AI-driven threat analysis, improved resource efficiency, and faster processing times. Enhancing detection capabilities for unknown threats and improving integration with other tools can significantly upgrade performance and usability.

What features define Trellix EDR?

Advanced Threat Detection: Leverages AI analytics for comprehensive threat identification.
Threat Hunting: Empowers users to proactively search for threats.
Real-Time Monitoring: Provides immediate insights into security incidents and status.
Integration with MITRE Framework: Ensures thorough detection and response alignment.
Forensic Capabilities: Offers tools for detailed investigation of security events.
Cloud-Based Support: Facilitates configuration for multi-site environments.

What benefits can users expect?

Enhanced Threat Intelligence: Improved detection capabilities for seamless integration with SIEM systems.
Operational Efficiency: Automation and intuitive dashboards increase productivity.
Robust Risk Management: Comprehensive protection against advanced threats such as ransomware.
Zero Trust Compliance: Telemetry visibility aligns with compliance standards.

Trellix EDR is widely implemented in industries for endpoint protection and incident response. It helps protect workstations and improve threat intelligence by supporting integrations with cloud security and SIEM. Users benefit from its ability to identify malicious files and ransomware while adhering to zero-trust principles through improved telemetry visibility.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Information Not Available

Sutherland Global Services

Lookout vs. Trellix Endpoint Detection and Response (EDR)