No more typing reviews! Try our Samantha, our new voice AI agent.

Mandiant Advantage vs Recorded Future comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
108
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Endpoint Detection and Response (EDR) (7th), Extended Detection and Response (XDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Mandiant Advantage
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
7
Ranking in other categories
Extended Detection and Response (XDR) (24th), Attack Surface Management (ASM) (9th)
Recorded Future
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
14
Ranking in other categories
Threat Intelligence Platforms (TIP) (2nd), Digital Risk Protection (2nd)
 

Mindshare comparison

Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Mandiant Advantage1.3%
CrowdStrike Falcon9.9%
Wazuh6.8%
Other82.0%
Extended Detection and Response (XDR)
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
Recorded Future7.6%
CrowdStrike Falcon4.7%
Anomali3.9%
Other83.8%
Threat Intelligence Platforms (TIP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
LF
Head Of Cyber Threat Intelligence at Discount Bank
Brand threats have been monitored proactively and intelligence now drives daily security decisions
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic. I would rate Mandiant Advantage an 8 out of 10. I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive. The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.
Derek  Lewis - PeerSpot reviewer
Account Manager at Chevron
Continuous threat intelligence has improved brand monitoring and protects against leaked credentials
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Sometimes alerts pop up for articles that have been published years ago but were just recently discovered by Recorded Future. For the browser extension, since the main purpose is to present information regarding IPs, I think it would be best to provide us with an idea of where the IP originates or some additional information about the organization it belongs to. API capabilities in Recorded Future are improving, but there are still some features that are missing and some errors that are hard to handle and understand. The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very effective and relatively competitive for large organizations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The one feature of Palo Alto Networks Traps that our organization finds most valuable is the App ID service."
"Cortex XDR by Palo Alto Networks has helped lighten the load of our security analysts because it was the major tool that we were using and the one we utilized most."
"It blocks malicious files. It prevents attacks. It doesn't require many updates, it's a very light application."
"Cortex XDR features advanced threat detection capabilities."
"I recommend this solution to others because it is easy to manage, reliable, and overall good to use."
"The initial setup isn't too bad."
"Palo Alto is the best security solution in the market."
"It is easy to use."
"I have never faced stability issues."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"The live IOC feed identifies the type, technique, and tactics used."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk, and the YARA rules I wrote within the platform help me understand better what my threat landscape is."
"The intel that they were providing us over the emails was very good. If it found any hashtag in our organization's name on the dark web, a rogue IP, or a marketplace, it would send us an email and notify us that this is being mentioned, and if we want, they can take some action."
"The most valuable features of Recorded Future are the useful alerts it provides. If we are monitoring a domain, the solution will provide us with an alert in a prompt manner. It is simple for clients to receive alerts. The advanced search is useful for more accurate filter results."
"The tool can integrate with a lot of security control and proactive protection devices."
"As a threat intelligence tool, it's very helpful."
"Recorded Future allows me to maintain very accurate alerts."
"Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry."
"Recorded Future has positively impacted our organization as we are able to cover a lot of sources with only this intelligence provider, not having to have specific tools for clear web or social media monitoring."
"The tool is helpful in vulnerability assessment of zero-day vulnerabilities and phishing domains. The solution provides information on any domains of the organization that has undergone phishing or any other cyberattacks."
 

Cons

"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"The technical support is not very good. I find the process difficult."
"They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone. They don't know what they are talking about when you get them on the phone. They don't like to respond to messages when you send them to them. They like to "research problems" for weeks on end, then pass you off to somebody else."
"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."
"While using Cortex, I noticed some aspects that could be improved, such as increasing the synchronization speed between XDR and Xnor."
"We have found that there are times Cortex XDR by Palo Alto Networks does not detect some of the viruses, we have to use another protection solution called Kaspersky."
"There is a severe gap in functionality between Windows, Linux, and Mac versions. For example all folder restriction settings are Windows only. Traps 5.0+ does not have SAML / LDAP integration."
"The MAC agent is not as robust feature-wise as the PC version."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"There is a semantic oncology dynamic relationship between how the MIGR Tech framework needs more data infusion enrichment capabilities."
"While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate."
"The solution could improve in reducing the false positives. However, most of the other tools on the market have false positives. If they enhance their data algorithm, it could improve the accuracy of results and minimize false positives. Identifying patterns of false possibilities can aid in developing better reporting features that could potentially eliminate them in the future. This recording feature tool could benefit from adopting similar techniques utilized by other tools to enhance its functionality. By doing so, it could minimize the need for manual efforts in distinguishing true positives from false positives, ultimately reducing the workload."
"The tool should improve its third-party supply chain risks because there is a lack of visibility."
"It sometimes detects false positives and reduces the overall accuracy of the system."
"The solution would benefit from introducing automation."
"When you add one website to Recorded Future, it should automatically call all other websites and social media platforms."
"The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very effective and relatively competitive for large organizations."
 

Pricing and Cost Advice

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"Very costly product."
"The price was fine."
"The price of the solution is high for the license and in general."
"Cortex XDR’s pricing is very reasonable."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"I don't have any issues with the pricing. We are satisfied with the price."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
Information not available
"I would rate the solution’s pricing a seven out of ten."
"The biggest disadvantage of Recorded Future is the cost here in Eastern Europe. The solution is correctly priced for big companies who have the money to invest in such solutions. Also, the solution is useless on its own, which means that you have to invest in other solutions with which Recorded Future can be integrated. At present, Recorded Future can cost 60,000 euros per year. I am able to offer my clients a 5% to 10% discount, but in this region, the cost is still prohibitive even with the discount. If Recorded Future were more flexible in terms of price, there would be better sales opportunities in Europe and Eastern Europe, in particular, because we have more small- and medium-sized companies here."
"The price of the solution is worth it. The overall performance of the solution outweighs the cost."
"There appear to be up to five different levels, with the most expensive version costing around $95,000 to $105,000 a year for subscription services."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
885,444 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
15%
Manufacturing Company
8%
Computer Software Company
8%
Financial Services Firm
7%
Financial Services Firm
15%
Computer Software Company
8%
Manufacturing Company
7%
Healthcare Company
6%
Financial Services Firm
15%
Computer Software Company
11%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise47
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise2
Large Enterprise2
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise11
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Mandiant Advantage?
I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, thei...
What is your primary use case for Mandiant Advantage?
I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to ...
What advice do you have for others considering Mandiant Advantage?
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the...
What is your experience regarding pricing and costs for Recorded Future?
The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very ef...
What needs improvement with Recorded Future?
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Som...
What is your primary use case for Recorded Future?
Our main use case for Recorded Future is brand monitoring, reputation, and risk assessment, as it is one of the best ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Mandiant Threat Intelligence
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Fujitsu, Regions, SITA, St. Jude Medical, Accenture, T-Mobile, TIAA, Intel Security, Armor, Alert Logic, NTT, Splunk
Find out what your peers are saying about CrowdStrike, SentinelOne, TrendAI and others in Extended Detection and Response (XDR). Updated: February 2026.
885,444 professionals have used our research since 2012.