Try our new research platform with insights from 80,000+ expert users

Palo Alto Networks Cortex XSOAR vs ServiceNow Security Operations comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Palo Alto Networks Cortex X...
Ranking in Security Orchestration Automation and Response (SOAR)
2nd
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
47
Ranking in other categories
SOC as a Service (2nd)
ServiceNow Security Operations
Ranking in Security Orchestration Automation and Response (SOAR)
6th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
21
Ranking in other categories
Security Incident Response (1st), Risk-Based Vulnerability Management (10th)
 

Mindshare comparison

As of July 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Palo Alto Networks Cortex XSOAR is 10.4%, down from 12.6% compared to the previous year. The mindshare of ServiceNow Security Operations is 3.6%, down from 4.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

NikhilSharma2 - PeerSpot reviewer
Ability to multiple playbooks to fetch data from multiple firewalls and utomated several tasks, including vulnerability scans and SOCL (Security Orchestration, Automation
Recently, they started implementing microservices in XSOAR, which has improved quality and addressed previous issues. However, they should focus more on licensing costs. The user licensing fees are quite high. For example, I received a quote for XSOAR, and it was $12,000 per user per year. If you have a SOC team of 30 members/analysts, you're looking at a substantial expense. They should consider reducing these costs since this high pricing seems to be more about profit. So, there is room for improvement in the pricing. Moreover, the reporting and dashboard features are decent but could be improved. The user interface (UI) is quite heavy and takes time to load, which is a major drawback.
KishoreKumar4 - PeerSpot reviewer
A low-cost and open-source tool for incident and change management
If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents."
"The strengths of Palo Alto Networks Cortex XSOAR stem from the fact that it provides functionalities related to patching and URL blocking...It is a scalable solution."
"Many different playbooks are available and can be customized."
"It is a scalable solution. I would rate scalability a ten out of ten."
"I have found the solution very useful, it integrates well with other platforms."
"It’s easy to install."
"The product can automate security tasks."
"It is a scalable solution."
"The SOAR module of ServiceNow Security Operations is the most valuable feature"
"It's stable."
"My favorite feature is the application vulnerability scanner."
"The product's most valuable features include the no-code capability for workflows and flow design, which makes it user-friendly, and the ability to perform advanced configurations."
"It gives you the ability to bring data into the system. The workflows are out of the box, and it gives you the ability to auto-assign the incidents based on criteria and vulnerabilities."
"ServiceNow Security Operations also takes care of GRC, governance, risk and compliance, enabling it to provide risk assessment."
"We refer to the setup and installation guide provided by ServiceNow. They have good documentation, which makes it easier to handle the process."
"I will recommend it to others as it is an enterprise application used by large companies for ticketing purposes."
 

Cons

"Palo Alto needs to develop more AI-centric products."
"The solution’s price and technical support could be improved."
"Implementing this solution requires a lot of involvement from the vendor and it should be made easier for the partners."
"Palo Alto Networks Cortex XSOAR lacks to offer SIEM functionalities currently."
"The user interface (UI) is quite heavy and takes time to load, which is a major drawback."
"Previously, when Demisto was, there was a community edition; we could use it, reinstall it, and customize it. Since Palo Alto took over, it has become more financially oriented. It's business, but they could offer a pro model and a lighter model for different needs."
"One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation."
"The solution should be made a bit cheaper."
"One area for improvement for the product is the need to tailor and alter some codes for customization, which can cause issues during upgrades. It does not support customized operations."
"Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time."
"Report generation within ServiceNow can take some time."
"The solution needs to make customization easier. You cannot do much customization immediately. It requires an extensive workload. If the customization process was user-friendly, it would be much better."
"The threat intelligence module needs a better dashboard."
"Customer awareness and understanding of ServiceNow's SecOps capabilities could be improved."
"It's very slow. When you click a button or update a field, it takes forever to actually react."
"There are limitations for the third-parties that are providing the inputs. They should increase the robustness of the solution."
 

Pricing and Cost Advice

"There is a perception that it is priced very high compared to other solutions."
"It is expensive."
"It is approx $10,000 or $20,000 per year for two user licenses."
"My company did not make any payments towards the licensing costs attached to the product since we were only using its pilot version."
"The solution's cost is reasonable."
"From the cost perspective, I have heard that its price is a bit high as compared to other similar products."
"Cortex XSOAR's price could be lower."
"The price of Palo Alto Networks Cortex XSOAR is comparable to other solutions in the market."
"The product is more expensive than other solutions."
"Compared to competitor tools, ServiceNow Security Operations is more affordable"
"It is an expensive product."
"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."
"This product is a good value for the money."
"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
861,803 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
12%
Manufacturing Company
9%
Government
7%
Financial Services Firm
20%
Manufacturing Company
12%
Computer Software Company
9%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Even though customers often comment on the price, the potential savings come from managing a large number of security events with a limited number of analysts. This leads to economic advantages des...
What needs improvement with Palo Alto Networks Cortex XSOAR?
For Palo Alto Networks Cortex XSOAR, there is always room for improvement. One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quic...
What do you like most about ServiceNow Security Operations?
The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product.
What is your experience regarding pricing and costs for ServiceNow Security Operations?
The product is more expensive than other solutions like Archer but offers more features, making the pricing justifiable.
What needs improvement with ServiceNow Security Operations?
In terms of improvements, there are several things that could enhance ServiceNow Security Operations in the future, especially regarding false positives or exceptions, which usually require filling...
 

Also Known As

Demisto Enterprise, Cortex XSOAR, Demisto
No data available
 

Overview

 

Sample Customers

Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services
Find out what your peers are saying about Palo Alto Networks Cortex XSOAR vs. ServiceNow Security Operations and other solutions. Updated: June 2025.
861,803 professionals have used our research since 2012.