NetWitness NDR vs Stormshield Endpoint Security comparison

Why PeerSpot?

NetWitness and Stormshield are both solutions in the Endpoint Protection Platform (EPP) category. NetWitness is ranked #47, while Stormshield is ranked #50. NetWitness holds a 1.0% mindshare in EPP, compared to Stormshield’s 0.8% mindshare. Additionally, 87% of NetWitness users are willing to recommend the solution, compared to 100% of Stormshield users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

Stormshield Endpoint Security and NetWitness NDR compete in the cybersecurity sector, focusing on endpoint protection and network detection and response, respectively. NetWitness NDR appears to have the upper hand due to its advanced features, making it worth the higher cost.

Features: Stormshield Endpoint Security users value its strong malware protection, firewall capabilities, and ease of use in diverse environments. NetWitness NDR is known for comprehensive threat detection, automated response features, and deep packet inspection.

Room for Improvement: Users of Stormshield Endpoint Security indicate a need for better reporting tools, improved customization options, and enhanced analytics. NetWitness NDR users suggest reducing setup complexity, better training resources, and a more user-friendly interface.

Ease of Deployment and Customer Service: Stormshield Endpoint Security is noted for quick and straightforward deployment, supported by responsive customer service. NetWitness NDR deployment is seen as more complex, but customer service is effective once the product is in use.

Pricing and ROI: Stormshield Endpoint Security is considered cost-effective with a solid ROI, making it appealing for budget-conscious buyers. NetWitness NDR, though more expensive, is deemed worth the investment due to its robust capabilities and the perceived higher return on investment.

To learn more, read our detailed NetWitness NDR vs. Stormshield Endpoint Security Report (Updated: September 2026).

Buyer's Guide

NetWitness NDR vs. Stormshield Endpoint Security

September 2026

Download the complete report

Helped 915,341 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of October 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, up from 3.7% compared to the previous year. The mindshare of NetWitness NDR is 1.0%, up from 0.3% compared to the previous year. The mindshare of Stormshield Endpoint Security is 0.8%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Protection Platform (EPP) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.8%
NetWitness NDR	1.0%
Stormshield Endpoint Security	0.8%
Other	94.4%

Endpoint Protection Platform (EPP)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

reviewer1799727

Manager, IT Security Operations at a non-profit with 11-50 employees

Reliable and good support but can be expensive

I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.

Read full review

it_user745593

Senior Project Manager, PMP at a transportation company with 10,001+ employees

Protects the global station and has good stability

The feature I find most valuable is that it protects the global station The solution's integration with the Windows environment could be better. The solution needs better integration with products, if it did, it would have the assumption of better security. I've been using the solution since…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"In one single alert, we are getting the network telemetry, endpoint telemetry, email security telemetry, and proxy telemetry all in one single ticket, making it very easy."

"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."

"It collects and caches and the knowledge of machine learning from different customers to take to the cloud, it makes it better to use for everybody, it allows for quick learning and updates and can, therefore, offer zero-day malware security, and this sharing of metadata helps make the solution very safe."

"The initial setup is easy."

"Cortex XDR by Palo Alto Networks has accelerated the response time for my security team, so we have been able to resolve issues faster than usual."

"The initial setup is pretty easy."

"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."

"The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly. The way they have done everything and integrated all the solutions that they've purchased over the years to make it a very seamless, effective product is very good. One thing about Palo Alto is that they take the products or services that they purchase and make them seamless for the end user as compared to some companies that purchase other companies and then just kind of have their products off to the side or keep different interfaces. Palo Alto doesn't do that."

More Cortex XDR by Palo Alto Networks pros

"The detection rate and tracking features including historical tracking, tracking of the fires on the desk, and tracking of the file last monitored are all quite valuable for us."

"Technical support is knowledgeable."

"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."

"I would highly recommend the solution. Just go ahead and get it."

"NetWitness Endpoint has enabled us to detect attacks that bypass the first stage of cybersecurity, like zero-day and advanced attacks."

"It is stable. We have been using it for some time, without any issues."

"This solution allows us to locate the malware in real-time."

"The log correlation is good."

More NetWitness NDR pros

"If you need a Windows based multi-functional end-point security solution then this product is for you."

"It is very good for preventing cryptolocker attacks."

"The feature I find most valuable is that it protects the global station."

Cons

"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis."

"Limited remote connection."

"The solution could improve by providing better integration with their own products and others."

"Based on our experience so far, its implementation is quite complex."

"I have run into some detection issues with Cortex XDR. It needs to be better at detection of internal attacks."

"The onboarding process could be better."

"A potential area of improvement for Cortex XDR by Palo Alto Networks is the cost."

"The solution should force customers to integrate with network traffic to see the full benefits of XDR."

More Cortex XDR by Palo Alto Networks cons

"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."

"The solution doesn't have a reporting engine which would be helpful."

"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."

"When analyzing something, you have to click several times. It requires a lot of effort to find something."

"The problem with this product is that it's a bit slow."

"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."

"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."

"RSA NetWitness Endpoint is a scalable solution. However, the problem which we normally face is in terms of the migration of the solution."

More NetWitness NDR cons

"Only Windows based. Dependence on MS updates and service start-up priority."

"Release speed for newer versions. When a new OS is released, you've got to wait half year to get the new version that covers the new Windows OS."

"The solution's integration with the Windows environment could be better."

Pricing and Cost Advice

"Our license will require renewal in August, after which the maintenance will continue as usual."

"I don't have any issues with the pricing. We are satisfied with the price."

"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."

"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."

"Compared to CrowdStrike, Cortex XDR is an expensive solution."

"The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."

"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."

"It has reasonable pricing for the use cases it provides to the company."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"I do not have any opinion on the pricing or licensing of the product."

"It is an expensive product."

"We are on a three-year contract to use RSA NetWitness Network."

"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."

"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."

"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."

"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."

More NetWitness NDR pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.

See recommendations

915,341 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Outsourcing Company

12%

Comms Service Provider

12%

Construction Company

11%

Manufacturing Company

10%

Financial Services Firm

11%

Outsourcing Company

10%

Comms Service Provider

Manufacturing Company

Comms Service Provider

18%

Construction Company

Outsourcing Company

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	47
Midsize Enterprise	21
Large Enterprise	55

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	2
Large Enterprise	6

No data available

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

Ask a question

Earn 20 points

Ask a question

Earn 20 points

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 15% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Trellix Endpoint Security Platform vs NetWitness NDR

Compared 5% of the time

Darktrace vs NetWitness NDR

Compared 5% of the time

ServiceNow Security Operations vs NetWitness NDR

Compared 4% of the time

ExtraHop Reveal(x) 360 vs NetWitness NDR

Compared 3% of the time

Symantec Endpoint Security vs NetWitness NDR

Compared 3% of the time

More NetWitness NDR Competitors

Symantec Endpoint Security vs Stormshield Endpoint Security

Compared 21% of the time

Cisco Secure Endpoint vs Stormshield Endpoint Security

Compared 11% of the time

Sophos Endpoint vs Stormshield Endpoint Security

Compared 8% of the time

Trellix Endpoint Security Platform vs Stormshield Endpoint Security

Compared 5% of the time

WithSecure Elements Endpoint Protection vs Stormshield Endpoint Security

Compared 3% of the time

More Stormshield Endpoint Security Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

October 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

NetWitness NDR

September 2026

Download NetWitness NDR product report

Buyer's Guide

Endpoint Protection Platform (EPP)

September 2026

Download Stormshield Endpoint Security product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

RSA ECAT, NetWitness Network

SkyRecon Systems StormShield Security Suite

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

NetWitness NDR provides robust network security features, offering full visibility and effective incident response. Its seamless integration and user-friendly interface support malware detection and real-time threat tracking.

NetWitness NDR stands out for its comprehensive traffic details and compatibility across operating systems. It features a unified dashboard and lightweight installation, making it user-friendly without IT support. The system supports orchestration features and user behavior analytics. While deployment is somewhat modular and complex, it serves well for network security, malware analysis, and digital forensics. NetWitness integrates smoothly with third-party apps using its intuitive API, though improvements could be made in areas like SOAR integration, hunting features, and scalability, alongside addressing pricing and licensing complexities.

What are NetWitness NDR's Key Features?

Full Visibility: Offers comprehensive insight into network activities.
User-Friendly Interface: Simplifies navigation and management.
Real-Time Threat Tracking: Enables quick detection and action against threats.
Seamless Integration: Works easily with external applications and systems.
Unified Dashboard: Provides one-stop access to all security metrics.

What Benefits Should Users Look For?

Effective Malware Detection: Identifies and mitigates threats efficiently.
Flexible Deployment: Adapts to both on-premises and IT security needs.
Comprehensive Analytics: Offers detailed traffic and behavior analysis.
Ease of Use: Minimal need for IT support.

Banks and telecom companies utilize NetWitness NDR for detecting indicators of compromise, analyzing intrusion history, and providing risk scores. It functions as both a SIEM tool and a network forensic instrument, proving essential for sectors focused on network security and threat prevention.

NetWitness

Stormshield Endpoint Security provides robust protection, safeguarding critical business operations against evolving threats. It addresses security needs with advanced solutions that ensure comprehensive threat management and mitigation.

Stormshield Endpoint Security is tailored for a tech-savvy audience seeking reliable defense mechanisms to protect sensitive data. It combines cutting-edge technologies to provide a high level of security. Whether dealing with targeted attacks or generic malware, businesses trust its versatile approach, running seamless operations while mitigating risks. It supports endpoints with minimal impact on performance, ensuring continuous productivity.

What are the key features of Stormshield Endpoint Security?

Behavioral Analysis: Detects potential threats by analyzing activity patterns, ensuring proactive security measures.
Application Control: Restricts unwanted applications, allowing only approved programs to run, reducing vulnerability.
Network Protection: Secures data in transit by monitoring network traffic and preventing unauthorized access.
Advanced Threat Intelligence: Utilizes threat intelligence to anticipate attacks and respond swiftly to new security challenges.

What benefits should users expect when evaluating Stormshield Endpoint Security?

Cost-Efficiency: Reduces potential losses from security breaches, justifying investment with strong threat prevention.
Scalability: Adapts to business growth, offering consistent protection without requiring constant upgrades.
Easy Deployment: Provides straightforward installation and configuration, allowing quick adoption and minimal downtime.
Compliance Support: Helps meet industry standards, ensuring regulatory adherence for enhanced trust and credibility.

In sectors like finance and healthcare, Stormshield Endpoint Security is implemented to safeguard sensitive client data and meet compliance standards. In manufacturing, it secures networks from industrial espionage, addressing unique challenges by providing tailored security enhancing business resilience.

Stormshield

Sample Customers

CBI Health Group, University Honda, VakifBank

ADP, Ameritas, Partners Healthcare

Arkoon, Netasq

Buyer's Guide

NetWitness NDR vs. Stormshield Endpoint Security

September 2026

Free Report: NetWitness NDR vs. Stormshield Endpoint Security

Find out what your peers are saying about NetWitness NDR vs. Stormshield Endpoint Security and other solutions. Updated: September 2026.

DOWNLOAD NOW

915,341 professionals have used our research since 2012.

See our NetWitness NDR vs. Stormshield Endpoint Security report.

See our list of best Endpoint Protection Platform (EPP) vendors.

We monitor all Endpoint Protection Platform (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.