Morphisec vs NetWitness NDR comparison

Morphisec and NetWitness are both solutions in the Endpoint Protection Platform (EPP) category. Morphisec is ranked #49, while NetWitness is ranked #50. Morphisec holds a 0.6% mindshare in EPP, compared to NetWitness’s 0.7% mindshare. Additionally, 100% of Morphisec users are willing to recommend the solution, compared to 87% of NetWitness users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

NetWitness NDR and Morphisec are two prominent solutions in network detection and response. Morphisec stands out due to its proactive approach to security, though some users feel it is worth the higher price.

Features: Users highly value NetWitness NDR for its comprehensive network monitoring and analytics. NetWitness NDR excels in detailed forensic analysis. Morphisec is praised for its advanced threat prevention capabilities and lightweight design. Morphisec's strength lies in its proactive defense mechanisms.

Room for Improvement: NetWitness NDR users seek enhancements in its integration capabilities. They also desire a more intuitive learning curve and better scalability. Morphisec users desire expanded reporting features and better scalability. Enhanced integration is also sought after in both products.

Ease of Deployment and Customer Service: NetWitness NDR offers flexible deployment options but receives mixed feedback on complexity. Customer service for NetWitness is well-regarded. Morphisec, noted for its simplicity in deployment, garners positive reviews for customer service efficiency. Morphisec’s ease of deployment is a distinct advantage.

Pricing and ROI: NetWitness NDR is perceived to have higher initial setup costs, yet users acknowledge substantial long-term ROI. Morphisec, despite a higher price point, is seen as an investment worth the cost due to its effective threat mitigation. Morphisec users report quicker ROI due to reduced incidents.

To learn more, read our detailed Morphisec vs. NetWitness NDR Report (Updated: March 2026).

Buyer's Guide

Morphisec vs. NetWitness NDR

March 2026

Download the complete report

Helped 885,264 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of March 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.5%, down from 4.0% compared to the previous year. The mindshare of Morphisec is 0.6%, up from 0.4% compared to the previous year. The mindshare of NetWitness NDR is 0.7%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Protection Platform (EPP) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.5%
Morphisec	0.6%
NetWitness NDR	0.7%
Other	95.2%

Endpoint Protection Platform (EPP)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Rick Schibler

VP of Information Technology at Kentucky Trailer

Offers in-memory protection at a lower price than competitors

Morphisec's in-memory protection is probably the most valuable feature because it stops malicious activity from occurring. If something tries to install or act as a sleeper agent, Morphisec will detect and stop it. Morphisec's Moving Target Defense is critical to hardening our attack surface. If it detects something, it indicates whether it's valid. That means you've got a breach requiring investigation. It detects anomalies but doesn't necessarily point to what caused them. You still need to do that work. The solution is reasonably easy to administer. They made some changes last year, adding a cloud-based monitoring solution that makes deploying and monitoring our endpoints easy.

Read full review

reviewer1799727

Manager, IT Security Operations at a non-profit with 11-50 employees

Reliable and good support but can be expensive

I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"They have a new GUI which is just fantastic."

"The tool is easy to use."

"It integrates well into the environment."

"When the pandemic started, Palo Alto came up with many solutions, which helped with the quick shift from on-premises to the cloud."

"The behavior-based detection feature is valuable."

"Technical support is the best in class, in my opinion, because they have invested heavily in research and development."

"We think that this product will help us grow, as it meets our needs currently and we can grow with it over time."

"If any application performs suspicious activities, such as changing registries or modifying other applications, Cortex XDR detects and blocks the entire application."

More Cortex XDR by Palo Alto Networks pros

"The simplicity of the solution, how easy it is to deploy and how small it is when deployed as an agent on a device, is probably the biggest aspect, given what it can do."

"Morphisec has absolutely helped save money on our security stack; the ransomware at the end of the day can cost organizations millions upon millions of dollars, and if I can spend $10,000 in a year to protect assets that could be ransomed for $20,000,000, that's definitely a bet that one should pursue."

"The biggest feature is that it hides everything from your operating system that's running in-memory from anything to try to run against it. That's the most unique thing that's on the market. There's nothing else out there that's quite like that. That's a big selling point and why we went with it. It does exactly what the design does. If you can't find it, you can't execute against it."

"The ability to stop attacks without having to detect or have a signature for the attack is the most valuable feature."

"With Morphisec, at least when it does happen, I feel confident that we have in place solutions that will not only prevent it, but also let us know when something has happened."

"Morphisec has given our security team's operations peace of mind and more time for patching."

"We have seen it successfully block attacks that a traditional antivirus did not pick up."

"Since we started using Morphisec, that hasn't happened even once."

More Morphisec pros

"Technical support is knowledgeable."

"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."

"The solution is scalable; it creates 3,000 lab logs per second, and I think the solution is suitable for large companies or medium to large companies."

"One of the most valuable features is the Orchestrator."

"This solution allows us to locate the malware in real-time."

"In my opinion, this is the best platform, world-wide, and I am happy with it."

"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."

"The log correlation is good."

More NetWitness NDR pros

Cons

"The downsides of Cortex XDR by Palo Alto Networks are that in many incidents, when I enter the causality chain, there are numerous logs."

"Cortex XDR by Palo Alto Networks can improve mobile integration to allow access to the console."

"The solution should add unwanted malicious hash values to a block list so that whenever the action is triggered, it will automatically prevent the malicious content."

"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control."

"There are some false positives."

"Based on our experience so far, its implementation is quite complex."

"For working with the solution, you only really need a web browser, however, we've found that working on Chrome, for example, is horrible."

More Cortex XDR by Palo Alto Networks cons

"We started in the Linux platform and we deployed to Linux. The licensing of that has been confusing between Linux licensing and Windows licensing."

"Automating reports needs improvement. I would like to have better reporting capabilities within it or automated reporting to be a little bit more dynamic. That's something I know they're working on. We literally are in the process. We started the process a week and a half ago of going to their latest version, so I've not seen their latest one up and running yet."

"We have only had four attacks in the last year, "attacks" being some benign PDF from a vendor that, for some reason, were triggered. There were no actual attacks. They were just four false positives, or something lowly like adware. There have been false positives with both the on-premises solution and the cloud solution."

"We wanted to have multi-tenants in their cloud platform, so every entity can look into their own systems and not see other systems in other entities. I have a beta version on that now. I would like them to incorporate that in the cloud solution."

"The weakest point of this product is how difficult it is to understand the reasons for an alert. This is a problem because it is hard to determine whether an attack is real or not."

"Sometimes it generates false positive alerts. They need to continue working on that."

"We wanted to have multi-tenants in their cloud platform, so every entity can look into their own systems and not see other systems in other entities."

"The only area that really needs improvement is the reporting functionality. Gathering the detailed information that is in the system for an executive, or for me as a director, could be better. Some of the interface and reporting aspects are a little bit dated. They're working on it."

More Morphisec cons

"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."

"RSA NetWitness Network could improve on integration with non-native application integration."

"The initial setup requires a high level of skill."

"I would like to see Security Orchestration and Response Automation (SOAR) integration."

"The contamination feature could be improved."

"This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available."

"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."

"Its price could be improved. It is an expensive product."

More NetWitness NDR cons

Pricing and Cost Advice

"Cortex XDR is a costly solution."

"It's about $55 per license on a yearly basis."

"The tool's price is moderate."

"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."

"Cortex XDR's pricing is ok."

"This is an expensive solution."

"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."

"The solution is expensive. It's pricing is on a yearly-basis."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"Compared to their competitors, the price of Morphisec is not that high. You can easily deploy it on a large-scale or small-scale network."

"Licenses are per endpoint, and that's true for the cloud version as well. The only difference is that there is a little extra charge for the cloud version."

"It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately."

"It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off."

"It is an annual subscription basis per device. For the devices that we have in scope right now, it is about $25,000 a year."

"It does not have multi-tenants. If South Africa wants to show only the machines that they have, they need their own cloud incidence. It is not possible to have that in a single cloud incidence with multiple tenants in it, instead you need to have multiple cloud incidences. Then, if you have that, it will be more expensive. However, they are going to change that, which is good."

"Morphisec is reasonably priced because our parent company's other subsidiaries use different products like CrowdStrike. CrowdStrike is four or five times more expensive than Morphisec. The competitive pricing saves us money in our overall security stack."

"Price-wise, it's on the higher side. A traditional antivirus solution is cheaper, but in terms of security and manageability, its ROI is better than a traditional antivirus. I would recommend it to anybody evaluating or considering an antivirus solution. If your system gets compromised, the cost of ransom would be a lot more. This way, it saves a lot of cost."

More Morphisec pricing and cost advice

"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."

"It is an expensive product."

"It is highly scalable. It can be bought based on your requirements."

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."

"We are on a three-year contract to use RSA NetWitness Network."

"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."

"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."

"I do not have any opinion on the pricing or licensing of the product."

More NetWitness NDR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.

See recommendations

885,264 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

Computer Software Company

Financial Services Firm

Comms Service Provider

Outsourcing Company

17%

Manufacturing Company

10%

Financial Services Firm

Computer Software Company

Financial Services Firm

Manufacturing Company

Outsourcing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	44
Midsize Enterprise	20
Large Enterprise	47

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	8
Large Enterprise	8

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	2
Large Enterprise	5

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

Ask a question

Earn 20 points

Ask a question

Earn 20 points

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 9% of the time

SentinelOne Singularity Complete vs Cortex XDR by Palo Alto Networks

Compared 6% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Halcyon vs Morphisec

Compared 7% of the time

CrowdStrike Falcon vs Morphisec

Compared 6% of the time

FortiCNAPP vs Morphisec

Compared 5% of the time

Deep Instinct Prevention Platform vs Morphisec

Compared 4% of the time

SentinelOne Singularity Complete vs Morphisec

Compared 4% of the time

More Morphisec Competitors

Trellix Endpoint Security Platform vs NetWitness NDR

Compared 6% of the time

Darktrace vs NetWitness NDR

Compared 6% of the time

ServiceNow Security Operations vs NetWitness NDR

Compared 4% of the time

ExtraHop Reveal(x) vs NetWitness NDR

Compared 4% of the time

Tanium vs NetWitness NDR

Compared 2% of the time

More NetWitness NDR Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

March 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Morphisec

March 2026

Download Morphisec product report

Buyer's Guide

NetWitness NDR

March 2026

Download NetWitness NDR product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

Morphisec, Morphisec Moving Target Defense

RSA ECAT, NetWitness Network

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Morphisec delivers signatureless endpoint-specific protection, effectively blocking zero-day threats and ransomware without affecting performance, making it a preferred choice for enhancing security strategies.

Morphisec empowers users by providing comprehensive protection against advanced threats with its innovative signatureless and in-memory security features. Its seamless integration with Microsoft Defender ensures complete visibility and automatic threat blocking through a unified dashboard. The Moving Target Defense technology enhances deployment efficiency while its lightweight design maintains system performance. Despite some challenges in cloud deployment and feature updates, users find value in its ease of use and minimal administrative effort.

What are the key features of Morphisec?

Signatureless Protection: Blocks threats without relying on signatures, ensuring up-to-date defense.
In-Memory Protection: Prevents attacks targeting system memory to safeguard endpoints.
Zero-Day Threat Blocking: Offers proactive defense against undiscovered threats.
Unified Dashboard: Provides comprehensive security event visibility and integration with Microsoft Defender.
Lightweight Design: Ensures smooth operation without system performance issues.

What benefits can users expect when evaluating Morphisec?

Enhanced Security: Strengthens defense layers against ransomware and memory attacks.
Seamless Integration: Works alongside existing antivirus solutions like Microsoft Defender.
Minimal Administration: Requires low maintenance due to its set-and-forget nature.
Automatic Updates: Keeps protection current without manual intervention.
Broad Coverage: Suitable for desktops, servers, and cloud platforms.

In industries with high security needs, deploying Morphisec adds a robust defense against advanced threats. Its compatibility with antivirus solutions and cloud platforms makes it adaptable to diverse environments, ensuring effective threat mitigation and detection.

Morphisec

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

NetWitness

Sample Customers

CBI Health Group, University Honda, VakifBank

Lenovo/Motorola, TruGreen, Covenant Health, Citizens Medical Center

ADP, Ameritas, Partners Healthcare

Buyer's Guide

Morphisec vs. NetWitness NDR

March 2026

Free Report: Morphisec vs. NetWitness NDR

Find out what your peers are saying about Morphisec vs. NetWitness NDR and other solutions. Updated: March 2026.

DOWNLOAD NOW

885,264 professionals have used our research since 2012.

See our Morphisec vs. NetWitness NDR report.

See our list of best Endpoint Protection Platform (EPP) vendors and best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Protection Platform (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.