Rapid7 InsightIDR vs SentinelOne Singularity Endpoint comparison

Rapid7 InsightIDR vs. SentinelOne Singularity Endpoint

Download the complete report

Helped 914,262 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of September 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.6%, down from 3.9% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.3%, up from 1.2% compared to the previous year. The mindshare of SentinelOne Singularity Endpoint is 5.3%, down from 5.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
SentinelOne Singularity Endpoint	5.3%
Cortex XDR by Palo Alto Networks	3.6%
Rapid7 InsightIDR	1.3%
Other	89.8%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Prajwal Chougale

SOC L2 Analyst at a tech services company with 51-200 employees

Centralized threat hunting has improved alert accuracy and simplifies incident investigations

I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or monthly lacks detailed information about how logs are being ingested. While the details are there, they could be more concise and easier to understand for any level of authority. The second area is alert tuning; compared to Microsoft Sentinel, Rapid7 InsightIDR provides fewer alerts with more static alert functionality and lacks dynamic alerting exposures. There could be improvements to learn from past alert activities for more dynamic alert configurations. These two areas are the main areas for improvement; everything else is good.

Read full review

Vaibhav Mahendra Kolhe

Soc Analyst at Softcell Technologies Limited

Automation has reduced alerts and freed the soc team to focus on faster incident response

Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The tool is designed to scale for large enterprises and handle large volumes of data."

"Its ability to react to cyber data attacks is awesome."

"The good thing about the product is that it's always scanning."

"On a scale from one to ten, I would rate Cortex XDR by Palo Alto Networks a nine."

"The most valuable features are the fact that it was running in the background and it would intercept any weird stuff, and the fact that it would send things directly to the cloud for sandboxing. It's quite practical."

"I can highlight that we have not faced any security incidents with Cortex XDR by Palo Alto Networks, and even though our environment is quite dynamic, we have not faced any security incident with Cortex XDR by Palo Alto Networks until now."

"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."

"The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices."

More Cortex XDR by Palo Alto Networks pros

"The web interface is great — very useful and user-friendly."

"It improves because several sensors are deployed within the on-premise environment. It can be very efficient if the customer implements and operates it effectively."

"InsightIDR has allowed us to find potential security issues that we did not know existed, and get remediation quickly."

"Integration with threat modeling from the Metasploit and InsightIDR repositories."

"The most valuable features have to do with ease-of-use, as it is easy to check the events, investigate suspicious activities, and do forensic analysis, and the web interface is great — very useful and user-friendly."

"If you were on other solutions, you would notice that they use agents from third-party, from open-source, from a native OS, or from other tools. Here, however, it is an agent from Rapid7 itself. This adds to the solution's overall capabilities."

"I like the tool's user analysis feature."

"Scalability-wise, I rate the solution a ten out of ten. As a cloud tool, the product is highly scalable."

More Rapid7 InsightIDR pros

"SentinelOne Singularity Endpoint offers the best features in the market at an affordable rate, providing a secure solution."

"Singularity's rollback feature is one of the primary reasons we bought the product. If there's an attack on the machine, the system can automatically roll back the data and the hard drive of the machine that was attacked."

"The most valuable features are asset tracking, patching, endpoint tagging, and policy updates."

"Deep visibility, full disk scan, and rollback features are impressive, especially in cases of ransomware attacks."

"SentinelOne is stable and reliable."

"It recently stopped a ransomware attack at one of my clients, proving its reliability."

"As a reseller and user, I would say that SentinelOne Singularity Complete is better than its competition; I have evaluated Palo Alto, Trellix, and CrowdStrike as well, and SentinelOne EDR is much better than all of them as the capability and technical capabilities are superior with efficient and faster detection."

"SentinelOne Singularity Endpoint scales well and is scalable."

More SentinelOne Singularity Endpoint pros

Cons

"A better pricing plan would make this product more competitive."

"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."

"There are some default policies which sometimes affect our applications and cause them to run around. In the hotel industry, we use a different type of data versus Oracle and SQL. By default, there are some policies which stop us from running properly. Because of this, the support level is also not that strong. We have to wait to get a results."

"For Cortex XDR by Palo Alto Networks, if I had to point out improvements, I would say the UI is still somewhat difficult for beginners."

"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."

"The dashboard is the area that needs to improve so that we can have the ability to drill down without having to go elsewhere to verify results."

"It would be good if they could make an exception for applications. Sometimes, it can be a bit of a challenge to make exceptions for certain applications that have been used as rogue."

"There's room for improvement with Mac device installations, which can be challenging."

More Cortex XDR by Palo Alto Networks cons

"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."

"One of the things that could be better is digital forensics. It is there, but it can be better. They could provide more on the endpoint detection level."

"I would like to see more development in InsightIDR towards building their SIEM solution and converting it to XDR."

"I would like the ability to adjust the threshold of certain existing alerts. Currently the only option is to change the notifications or create my own alert."

"Inability to get access to compliance reports within the solution."

"I chose eight out of ten because of the analytical rules; they lack dynamic rules, and also due to the dashboard and reporting part."

"The integration capabilities of the solution have certain shortcomings where improvements are required."

"The main problem lies in the processes within the client's operating systems."

More Rapid7 InsightIDR cons

"However, competitors such as Trellix and Trend Micro have features for web protection with category-based web protection for web security."

"The MDM functionality and maturity still need improvement."

"However, the price and the fact that each functionality such as vulnerability management or cloud funnel requires additional licenses raises the yearly cost for the company."

"For ingestion and correlation across security solutions, the agent is quite heavier when compared to other competition."

"It is not so much on the Singularity platform itself, but they have their own built-in SIEM that is included with it. That needs to evolve a little bit. It is relatively basic in its capabilities. They have potential there for a great product and a needed product too. Having some kind of SIEM capability with the endpoint solution will save me from buying a bigger SIEM or buying another one. I could just use the one that comes with my endpoint solution."

"I would have liked the dashboard to be more user-friendly."

"As a customer, the price is also high for me."

"Initially, it creates a lot of false positive alerts, which can be improved."

More SentinelOne Singularity Endpoint cons

Pricing and Cost Advice

"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."

"I feel it is fairly priced."

"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."

"It's about $55 per license on a yearly basis."

"It is "expensive" and flexible."

"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."

"I don't recall what the cost was, but it wasn't really that expensive."

"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"Accurately predict your licensing counts as this is a subscription based product."

"The team is very willing to work with companies. My suggestion is to call the Rapid7 sales department and see how they can help."

"Rapid7 InsightIDR charges us based on the endpoints we connect to."

"The pricing of the solution depends on the user. But there is a yearly licensing cost."

"I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability."

"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."

"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."

"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."

More Rapid7 InsightIDR pricing and cost advice

"We pay $30,000 a year for 275 endpoints. We're growing, so I plan to buy another 75 endpoints. There is still a year and a half left in my three-year subscription, so I'm going to increase my endpoint count by 30 percent."

"The pricing was very similar in terms of its competitors, but I believe SentinelOne's capability and willingness to attract new business allowed us to save some extra money."

"I don't know about the licensing model. It seems easy, but it's not my area of expertise. I don't have information on how it compares to its competitors, but the pricing is per device."

"While the cost of SentinelOne Singularity Complete might seem high at first glance, it's important to consider the value it offers."

"The price of SentinelOne is on the higher side compared to other solutions, such as Symantec."

"The pricing of SentinelOne is less than McAfee."

"Its cost is yearly. It is not much costlier than other leading products available in the market. I would rate it a four out of five in terms of pricing."

"SentinelOne is significantly less expensive than CrowdStrike. I recently did a price comparison between CrowdStrike and SentinelOne to determine where we are going for the next three years. CrowdStrike is 200% to 300% the cost."

More SentinelOne Singularity Endpoint pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

914,262 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Outsourcing Company

12%

Comms Service Provider

12%

Construction Company

11%

Financial Services Firm

Manufacturing Company

Comms Service Provider

Computer Software Company

Outsourcing Company

11%

Manufacturing Company

Computer Software Company

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	47
Midsize Enterprise	21
Large Enterprise	55

By reviewers
Company Size	Count
Small Business	22
Midsize Enterprise	5
Large Enterprise	6

By reviewers
Company Size	Count
Small Business	138
Midsize Enterprise	75
Large Enterprise	98

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

My experience with pricing, setup costs, and licensing has been very positive; it is cost-effective and offers great ...

What needs improvement with Rapid7 InsightIDR?

I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or ...

Which is better - SentinelOne or Darktrace?

Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...

What is your experience regarding pricing and costs for SentinelOne Singularity?

It is neither too costly, but definitely, it is one of the advantages that SentinelOne is quite adapted towards the p...

What needs improvement with SentinelOne Singularity?

I have encountered an issue related to the alerting mechanism in SentinelOne Singularity Complete. Sometimes I need t...

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Comparisons

Compared 14% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Trellix Endpoint Security Platform vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 4% of the time

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 4% of the time

Adlumin Security Operations vs Rapid7 InsightIDR

Compared 3% of the time

Vectra AI vs Rapid7 InsightIDR

Compared 3% of the time

Darktrace vs Rapid7 InsightIDR

Compared 3% of the time

More Rapid7 InsightIDR Competitors

CrowdStrike Falcon vs SentinelOne Singularity Endpoint

Compared 4% of the time

Fortinet FortiEDR vs SentinelOne Singularity Endpoint

Compared 3% of the time

Microsoft Defender for Endpoint vs SentinelOne Singularity Endpoint

Compared 3% of the time

Trellix Endpoint Security Platform vs SentinelOne Singularity Endpoint

Compared 3% of the time

Huntress Managed EDR vs SentinelOne Singularity Endpoint

Compared 2% of the time

More SentinelOne Singularity Endpoint Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Rapid7 InsightIDR

Download Rapid7 InsightIDR product report

SentinelOne Singularity Endpoint

August 2026

Download SentinelOne Singularity Endpoint product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

InsightIDR

Sentinel Labs, SentinelOne Singularity, Singularity Platform

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Rapid7 InsightIDR is a cloud-based security information and event management solution known for its user behavior analytics, offering rapid detection and response capabilities while facilitating seamless integration across systems.

Rapid7 InsightIDR is designed to enhance threat detection and investigation through its efficient user behavior analytics and advanced threat intelligence framework. The platform's cloud-based deployment ensures rapid setup and comprehensive event monitoring across diverse IT environments, including endpoints and Office 365. Its intuitive interface supports seamless data collection, honing in on threat detection through honeypot utilization and intelligent alerting. However, it is noted for lacking some customization features and better integration, especially with Microsoft and ITSMs.

What are the key features of Rapid7 InsightIDR?

User Behavior Analytics: Detects threats by analyzing patterns and anomalies.
Cloud Deployment: Enables quick setup and scalability.
Comprehensive Monitoring: Monitors events across systems and platforms like Office 365.
Honeypots and Alerting: Utilizes honeypots to reduce false positives and alert fatigue.
Threat Intelligence Framework: Supports effective threat hunting and remediation.

What benefits should users consider in reviews when evaluating Rapid7 InsightIDR?

Enhanced Detection: Improves threat detection with user behavior analysis.
Easy Integration: Integrates across systems for a streamlined security approach.
Rapid Response: Facilitates quick action against identified threats.
Operational Efficiency: Offers a cohesive view of security operations.

Rapid7 InsightIDR is prominently used in security operation centers to manage events, detect threats, and respond effectively. Industries apply it for network behavior monitoring, compliance, and vulnerability management. Companies integrate it with security tools to boost threat investigation, ensuring full SIEM functionalities and robust log management capacities. Its application spans behavioral and intrusion analytics, aiding in monitoring and addressing malicious activities.

Rapid7

SentinelOne Singularity Complete is an advanced endpoint security platform featuring centralized management across multiple locations. It leverages AI-driven behavior detection, threat prioritization, and ransomware rollback for enhanced protection and streamlined operations.

With a focus on endpoint protection, threat detection, and automated response, SentinelOne Singularity Complete provides comprehensive security through AI-powered behavioral analysis and real-time threat detection. The centralized console simplifies management, offering seamless integration and minimal system impact. Its robust reporting capabilities facilitate compliance with audit-ready reports. Lightweight agents operate across diverse environments, improving visibility and performance while curbing manual efforts. To optimize its utility, faster console load times and improved customizability in reports and dashboards are recommended. Users may benefit from smoother integration with IT tools and enhanced policy management flexibility, as well as upgraded agent processes and simplified endpoint deployment. Expanding built-in analytics and refining alert management can further heighten platform efficacy.

What are the key features of SentinelOne Singularity Complete?

AI-Powered Detection: Utilizes advanced AI to identify potential threats based on behavior.
Automatic Remediation: Automatically rectifies detected issues, reducing response times.
Ransomware Rollback: Restores data to previous states if affected by ransomware attacks.
Centralized Dashboards: Provides real-time insights through intuitive dashboards.
Threat Prioritization: Identifies and ranks threats based on potential impact.

What benefits should users look for in reviews?

Integration: Seamlessly connects with security solutions to enhance risk management.
Minimal System Impact: Operates efficiently, preserving system performance.
Enhanced Protection: Delivers robust threat defense through AI-driven technology.
Compliance Support: Offers detailed reporting for audit readiness.
User Convenience: Combines autonomous decision-making with an intuitive interface.

In various industries, SentinelOne Singularity Complete is implemented for endpoint protection and incident management. Companies rely on it for its real-time threat detection and automated response capabilities, ensuring compliance and reduced manual intervention. Its adaptive nature supports diverse environments, enhancing operational efficiency.

SentinelOne

Sample Customers

CBI Health Group, University Honda, VakifBank

Liberty Wines, Pioneer Telephone, Visier

Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank

Rapid7 InsightIDR vs. SentinelOne Singularity Endpoint