No more typing reviews! Try our Samantha, our new voice AI agent.

Mandiant Advantage vs Recorded Future comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Mandiant Advantage
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
7
Ranking in other categories
Extended Detection and Response (XDR) (28th), Attack Surface Management (ASM) (8th)
Recorded Future
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Threat Intelligence Platforms (TIP) (2nd), Digital Risk Protection (2nd)
 

Mindshare comparison

Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Mandiant Advantage1.3%
CrowdStrike Falcon9.4%
SentinelOne Singularity Endpoint5.9%
Other83.4%
Extended Detection and Response (XDR)
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
Recorded Future7.1%
CrowdStrike Falcon4.8%
ThreatConnect Threat Intelligence Platform (TIP)3.9%
Other84.2%
Threat Intelligence Platforms (TIP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
LF
Head Of Cyber Threat Intelligence at Discount Bank
Brand threats have been monitored proactively and intelligence now drives daily security decisions
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic. I would rate Mandiant Advantage an 8 out of 10. I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive. The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.
Derek  Lewis - PeerSpot reviewer
Account Manager at Chevron
Continuous threat intelligence has improved brand monitoring and protects against leaked credentials
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Sometimes alerts pop up for articles that have been published years ago but were just recently discovered by Recorded Future. For the browser extension, since the main purpose is to present information regarding IPs, I think it would be best to provide us with an idea of where the IP originates or some additional information about the organization it belongs to. API capabilities in Recorded Future are improving, but there are still some features that are missing and some errors that are hard to handle and understand. The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very effective and relatively competitive for large organizations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We use Cortex XDR by Palo Alto Networks for its ability to detect based on behavior rather than simple virus scan to prevent malicious activities."
"We have found in our test Cortex XDR by Palo Alto Networks to be a very good tool."
"We've had a significant increase in blocking with a decrease in false positives, because it's looking at how the files work, not just a list of files that it's been told to look for."
"The behavior-based detection feature is valuable."
"The stability of this product is very good."
"Traps pays for itself within the first 16 months of a three-year subscription."
"It's very stable. I've never experienced downtime for the ASM console or ASM core."
"Technical support is the best in class, in my opinion, because they have invested heavily in research and development."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"I have never faced stability issues."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"The live IOC feed identifies the type, technique, and tactics used."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk, and the YARA rules I wrote within the platform help me understand better what my threat landscape is."
"Recorded Future has positively impacted our organization as we are able to cover a lot of sources with only this intelligence provider, not having to have specific tools for clear web or social media monitoring."
"As a threat intelligence tool, it's very helpful."
"The intel that they were providing us over the emails was very good. If it found any hashtag in our organization's name on the dark web, a rogue IP, or a marketplace, it would send us an email and notify us that this is being mentioned, and if we want, they can take some action."
"From the feedback I've received from my clients, the most valuable feature is the ability to personalize the solution. The ability to have a customized dashboard makes it easy for leadership and management to obtain details. Intelligence analysts or security engineers care about the actions and results, whereas the leadership care about graphs and reports. Recorded Future helps my clients create reports and also determine how the intelligence that is generated is consumed. They can easily show the benefits to the leadership without them having to invest 10 hours a week into transferring numbers into a graph or into creating reports."
"As a threat intelligence tool, it's very helpful."
"I have seen a return on investment as I explained earlier, it reduces the investigation time from days to minutes, and that is the biggest ROI; on a team of ten people that use it, one request can take you from three days to minutes."
"Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry."
"The most valuable feature is Recorded Future's protection of exposed customer data on the hardware side."
 

Cons

"There is a severe gap in functionality between Windows, Linux, and Mac versions. For example all folder restriction settings are Windows only. Traps 5.0+ does not have SAML / LDAP integration."
"Cortex XDR should have a lightweight agent, and the agent size should not be heavy."
"The solution lacks real-time, on-demand antivirus."
"There is a severe gap in functionality between Windows, Linux, and Mac versions."
"I would like to see them include NDR (Network Detection Response)."
"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."
"It should support more mobile operating systems. That is one of the cons of their infrastructure right now."
"Cortex XDR could improve its sales support team, including better commission structures and referral programs."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"The solution would benefit from introducing automation."
"There is a semantic oncology dynamic relationship between how the MIGR Tech framework needs more data infusion enrichment capabilities."
"It sometimes detects false positives and reduces the overall accuracy of the system."
"The tool should improve its third-party supply chain risks because there is a lack of visibility."
"The tool can be pricey, especially for smaller companies."
"While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate."
"The customer support is frustrating and not efficient. They always request logs and screenshots that seem irrelevant."
"Recorded Future is a very expensive solution, and its pricing could be improved."
 

Pricing and Cost Advice

"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."
"Its pricing is kind of in line with its competitors and everybody else out there."
"It is "expensive" and flexible."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"I feel it is fairly priced."
"The solution is expensive. It's pricing is on a yearly-basis."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"I don't recall what the cost was, but it wasn't really that expensive."
Information not available
"There appear to be up to five different levels, with the most expensive version costing around $95,000 to $105,000 a year for subscription services."
"The price of the solution is worth it. The overall performance of the solution outweighs the cost."
"I would rate the solution’s pricing a seven out of ten."
"The biggest disadvantage of Recorded Future is the cost here in Eastern Europe. The solution is correctly priced for big companies who have the money to invest in such solutions. Also, the solution is useless on its own, which means that you have to invest in other solutions with which Recorded Future can be integrated. At present, Recorded Future can cost 60,000 euros per year. I am able to offer my clients a 5% to 10% discount, but in this region, the cost is still prohibitive even with the discount. If Recorded Future were more flexible in terms of price, there would be better sales opportunities in Europe and Eastern Europe, in particular, because we have more small- and medium-sized companies here."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
894,830 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Financial Services Firm
16%
Computer Software Company
9%
Manufacturing Company
6%
Construction Company
6%
Financial Services Firm
16%
Computer Software Company
11%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise49
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise2
Large Enterprise3
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise12
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Mandiant Advantage?
I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, thei...
What is your primary use case for Mandiant Advantage?
I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to ...
What advice do you have for others considering Mandiant Advantage?
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the...
What is your experience regarding pricing and costs for Recorded Future?
The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very ef...
What needs improvement with Recorded Future?
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Som...
What is your primary use case for Recorded Future?
Our main use case for Recorded Future is brand monitoring, reputation, and risk assessment, as it is one of the best ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Mandiant Threat Intelligence
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Fujitsu, Regions, SITA, St. Jude Medical, Accenture, T-Mobile, TIAA, Intel Security, Armor, Alert Logic, NTT, Splunk
Find out what your peers are saying about CrowdStrike, SentinelOne, TrendAI and others in Extended Detection and Response (XDR). Updated: May 2026.
894,830 professionals have used our research since 2012.