Rapid7 InsightIDR vs Trellix Endpoint Security Platform comparison

Rapid7 and Trellix are both solutions in the Endpoint Detection and Response (EDR) category. Rapid7 is ranked #34 with an average rating of 7.5, while Trellix is ranked #8 with an average rating of 7.9. Rapid7 holds a 1.3% mindshare in EDR, compared to Trellix’s 3.0% mindshare. Additionally, 96% of Rapid7 users are willing to recommend the solution, compared to 88% of Trellix users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 22, 2026

Trellix Endpoint Security Platform and Rapid7 InsightIDR both compete in the cybersecurity domain, offering advanced protection solutions. Trellix appears to have the upper hand in features and integration, while Rapid7 leads in ease of deployment and customer support.

Features: Trellix Endpoint Security Platform offers Advanced Threat Prevention, customizable dashboards, and extensive integration through the ePO console. It enhances threat detection and includes DLP, CASB, encryption, and AI-driven threat prevention. Rapid7 InsightIDR excels in real-time user behavioral analytics, cloud integration, and incident management with advanced AI capabilities.

Room for Improvement: Trellix needs to enhance technical support, reduce response times, and improve automation in incident response. There are also concerns over high resource consumption and dashboard complexity. Rapid7 could develop further in threat intelligence, tool integration, and dashboard interface robustness for more management flexibility.

Ease of Deployment and Customer Service: Trellix offers hybrid, public, and on-premises deployments but is noted for complex setup and the need for skilled personnel. Its technical support has mixed reviews due to delayed responses. Rapid7 InsightIDR is praised for straightforward cloud-based deployment, offering quick time-to-value and generally well-regarded customer support.

Pricing and ROI: Trellix is considered affordable, especially for enterprises, with significant ROI by reducing recovery costs and improving IT workload efficiency. Rapid7 InsightIDR has competitive pricing but lacks flexibility for smaller customers due to the Minimum Order Quantity. It reduces hardware and maintenance overhead, yielding strong ROI for its capabilities.

To learn more, read our detailed Rapid7 InsightIDR vs. Trellix Endpoint Security Platform Report (Updated: June 2026).

Buyer's Guide

Rapid7 InsightIDR vs. Trellix Endpoint Security Platform

June 2026

Download the complete report

Helped 908,877 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of August 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.7%, down from 3.8% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.3%, up from 1.1% compared to the previous year. The mindshare of Trellix Endpoint Security Platform is 3.0%, down from 4.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.7%
Trellix Endpoint Security Platform	3.0%
Rapid7 InsightIDR	1.3%
Other	92.0%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Prajwal Chougale

System Analyst at a tech services company with 51-200 employees

Centralized threat hunting has improved alert accuracy and simplifies incident investigations

I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or monthly lacks detailed information about how logs are being ingested. While the details are there, they could be more concise and easier to understand for any level of authority. The second area is alert tuning; compared to Microsoft Sentinel, Rapid7 InsightIDR provides fewer alerts with more static alert functionality and lacks dynamic alerting exposures. There could be improvements to learn from past alert activities for more dynamic alert configurations. These two areas are the main areas for improvement; everything else is good.

Read full review

AmitKumar22

Product Manager at Frontier Business systems

Strong endpoint protection has simplified compliance and reduced effort for large user environments

One of the best features of Trellix Endpoint Security Platform is its endpoint security, and I have been using it for the last four and a half to five years, so I can say this is one of the best EDR endpoint security solutions I have ever seen. The features that make Trellix Endpoint Security Platform stand out for me are ease of use and analytics, which I really appreciate the most. Trellix Endpoint Security Platform positively impacts my organization, ensuring we are compliant with SOC 2, HIPAA, and all other compliance requirements, so there are no issues with that.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I like that the product has behavior-based detection which offers many benefits over signature-based detection."

"I have found the solution to be very easy in respect of the integration and configurable."

"The solution doesn't need a high level of technical training."

"Monitoring is most valuable."

"In one single alert, we are getting the network telemetry, endpoint telemetry, email security telemetry, and proxy telemetry all in one single ticket, making it very easy."

"It's a nice product that's stable and scalable."

"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."

"The anti-exploit is impenetrable."

More Cortex XDR by Palo Alto Networks pros

"The solution is very intuitive, it's easy to set up, is absolutely stable, and has a lot of integration with other security products."

"Great coverage of all systems within our network from endpoint to firewall."

"Dashboards, including the main screen, provide much-needed information at a glance, without hours of coding and sifting through logs to find it. In case of an actual security incident, I have faith that insightIDR has retained all logs in a secure manner that prevents log tampering as well."

"This is a great product and the team is very willing to work with companies."

"During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an application belongs to a known ransomware group. The system rates the threat, offering a clear detection ratio, such as 97 out of 100. It not only identifies threats but also illustrates the associated behaviors, helping us understand the potential risk to a particular endpoint."

"The UI is very good."

"The log aggregation and storage provided by InsightIDR has shown no issues with scalability; aggregating over one hundred millions events daily."

"User behavioral analytics allows us to pinpoint abnormal or suspicious behavior among millions of events every day."

More Rapid7 InsightIDR pros

"What I like most about McAfee MVISION Endpoint is that it's very user-friendly. You do need some knowledge on how to navigate the portal, but as soon as you've gained that knowledge, navigation will no longer be an issue. I have no complaints about McAfee MVISION Endpoint. For me, the product is perfect the way it is. It's great right now, and it's doing good as it is."

"The support from McAfee is far better than other vendors, such as Trend Micro and Symantec."

"It has been protecting us for many years, and we hope it will continue to do so for many years to come."

"The independent modules are very good."

"HIPS protects server files from being modified or deleted by unauthorized users. It's primarily deployed in the web tier."

"The response part of EDR was most valuable. We used that to separate the endpoint from the network. We utilized the solution during the instant response. We were also utilizing advanced malware detection capabilities, but we benefited the most from its help with the response."

"The most valuable feature of this solution is its simplicity."

"The solution is easy to manage, easy to implement, easy to install, and the support is excellent."

More Trellix Endpoint Security Platform pros

Cons

"The only issues that we have are, one the cost, two the dashboard is not very intuitive, even though you can drill down within the dashboard, we usually have to gather information from other sources to determine locations and if its a false positive."

"This product has not improved my organization - in fact, we are in the process of moving back to another product as a result of Cortex's horrible impact on system performance."

"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."

"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."

"They've been having some issues with updating their endpoint agents, and it has been quite frustrating."

"The playbooks could be improved to include more functionalities or actions."

"It would be good to have a better way to search for a file within the UI."

"In an upcoming release, the solution could improve by proving hard disk encryption. If it could support this it would be a complete solution."

More Cortex XDR by Palo Alto Networks cons

"One of the things that could be better is digital forensics. It is there, but it can be better. They could provide more on the endpoint detection level."

"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."

"InsightIDR is only available in a cloud version. Some of our customers prefer an on-prem solution because they want to manage the security within their environment."

"I would like to see more development in InsightIDR towards building their SIEM solution and converting it to XDR."

"The product allows us to make only 30 custom rules."

"If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is."

"The main problem lies in the processes within the client's operating systems."

"Rapid7 doesn't integrate well with all our security tools from various vendors, so we plan to switch. Many of our solutions work with Rapid7, but some do not. We are already searching for a replacement already."

More Rapid7 InsightIDR cons

"The initial setup isn't so easy. You need to know what you are doing."

"It would be nice to have the ability to change Safeboot passwords from within the OS as there is a delay in the boot process and password changes can take time."

"We would like to see all the features available on cloud."

"The interface is complex."

"We don't like the solution since it requires much memory consumption and consumes much CPU resources."

"The main area for improvement is the integration with Microsoft Windows Hello, which includes Face ID or fingerprint-based authentication. Currently, they don't support either, so users have to type in the username and password."

"The Linux support is very poor. I use base detection. Currently, they are providing malware protection and logon track features in Windows and Mac. These features aren't available in Linux. It will be helpful to extend these capabilities to Linux. We would also like assets grouping and device lock protection features, which are included in their roadmap."

"The endpoint has room for improvement because it's restrictive, it's very sensitive. Sometimes it can delete something that you need and so sometimes you have to disable the antivirus."

More Trellix Endpoint Security Platform cons

Pricing and Cost Advice

"The pricing is a little high. It is per user per year."

"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."

"The pricing is okay, although direct support can be expensive."

"It's the most expensive solution, but features-wise, it's quite strong. It's very good for protection, so the results are very good in the case of protection. I would rate it a two out of ten in terms of pricing."

"This is an expensive solution."

"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."

"Cortex XDR's pricing is ok."

"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"The solution has a mid-range price point in the market"

"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."

"Accurately predict your licensing counts as this is a subscription based product."

"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."

"The team is very willing to work with companies. My suggestion is to call the Rapid7 sales department and see how they can help."

"Rapid7 InsightIDR is priced very well and is cost-effective."

"I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability."

"The pricing and licensing are competitive."

More Rapid7 InsightIDR pricing and cost advice

"The pricing is great and licensing fees are billed on a yearly basis."

"Trellix Endpoint Security (ENS) has a reasonable price."

"Trellix Endpoint Security is neither a cheap nor an expensive solution."

"It's fairly priced compared to other products on the market."

"The product is expensive."

"The pricing is mid-ranged and quite reasonable compared to other similar products."

"Its price is very high. It is higher than its competitors, and it should be less."

"The price of the solution is in the middle range compare to others and could be reduced. There are not any additional costs."

More Trellix Endpoint Security Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

908,877 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

13%

Financial Services Firm

10%

Comms Service Provider

10%

Manufacturing Company

10%

Manufacturing Company

Financial Services Firm

Comms Service Provider

Computer Software Company

Manufacturing Company

10%

Financial Services Firm

Construction Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	46
Midsize Enterprise	21
Large Enterprise	54

By reviewers
Company Size	Count
Small Business	22
Midsize Enterprise	5
Large Enterprise	6

By reviewers
Company Size	Count
Small Business	68
Midsize Enterprise	39
Large Enterprise	67

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

See all answers

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

My experience with pricing, setup costs, and licensing has been very positive; it is cost-effective and offers great ...

See all answers

What needs improvement with Rapid7 InsightIDR?

I would say there are two areas for improvement: the reporting dashboard that provides insights or reports weekly or ...

See all answers

How does McAfee Endpoint Security compare with MVISION?

The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deplo...

See all answers

How does Crowdstrike Falcon compare with FireEye Endpoint Security?

The Crowdstrike Falcon program has a simple to use user interface, making it both an easy to use as well as an effec...

See all answers

What is your experience regarding pricing and costs for McAfee Endpoint Security?

I don't have visibility on pricing because it is negotiated by a different team, as I look after the technical side.

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 13% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 4% of the time

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 4% of the time

Adlumin Security Operations vs Rapid7 InsightIDR

Compared 4% of the time

Vectra AI vs Rapid7 InsightIDR

Compared 4% of the time

Darktrace vs Rapid7 InsightIDR

Compared 3% of the time

More Rapid7 InsightIDR Competitors

CrowdStrike Falcon vs Trellix Endpoint Security Platform

Compared 6% of the time

SentinelOne Singularity Endpoint vs Trellix Endpoint Security Platform

Compared 5% of the time

Symantec Endpoint Security vs Trellix Endpoint Security Platform

Compared 4% of the time

Microsoft Defender for Endpoint vs Trellix Endpoint Security Platform

Compared 3% of the time

NetWitness NDR vs Trellix Endpoint Security Platform

Compared 3% of the time

More Trellix Endpoint Security Platform Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

August 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Rapid7 InsightIDR

July 2026

Download Rapid7 InsightIDR product report

Buyer's Guide

Trellix Endpoint Security Platform

July 2026

Trellix Endpoint Security Platform report

Download Trellix Endpoint Security Platform product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

InsightIDR

McAfee Endpoint Security, McAfee Endpoint Protection, Intel Security Total Protection for Endpoint, McAfee Complete Endpoint Protection, Trellix Endpoint Security (ENS)

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Rapid7 InsightIDR is a cloud-based security information and event management solution known for its user behavior analytics, offering rapid detection and response capabilities while facilitating seamless integration across systems.

Rapid7 InsightIDR is designed to enhance threat detection and investigation through its efficient user behavior analytics and advanced threat intelligence framework. The platform's cloud-based deployment ensures rapid setup and comprehensive event monitoring across diverse IT environments, including endpoints and Office 365. Its intuitive interface supports seamless data collection, honing in on threat detection through honeypot utilization and intelligent alerting. However, it is noted for lacking some customization features and better integration, especially with Microsoft and ITSMs.

What are the key features of Rapid7 InsightIDR?

User Behavior Analytics: Detects threats by analyzing patterns and anomalies.
Cloud Deployment: Enables quick setup and scalability.
Comprehensive Monitoring: Monitors events across systems and platforms like Office 365.
Honeypots and Alerting: Utilizes honeypots to reduce false positives and alert fatigue.
Threat Intelligence Framework: Supports effective threat hunting and remediation.

What benefits should users consider in reviews when evaluating Rapid7 InsightIDR?

Enhanced Detection: Improves threat detection with user behavior analysis.
Easy Integration: Integrates across systems for a streamlined security approach.
Rapid Response: Facilitates quick action against identified threats.
Operational Efficiency: Offers a cohesive view of security operations.

Rapid7 InsightIDR is prominently used in security operation centers to manage events, detect threats, and respond effectively. Industries apply it for network behavior monitoring, compliance, and vulnerability management. Companies integrate it with security tools to boost threat investigation, ensuring full SIEM functionalities and robust log management capacities. Its application spans behavioral and intrusion analytics, aiding in monitoring and addressing malicious activities.

Rapid7

Trellix Endpoint Security Platform offers essential features like centralized management, threat prevention, and encryption, facilitating seamless scaling and integration with other systems while prioritizing user security.

This comprehensive platform focuses on endpoint protection, antivirus capabilities, and malware defense. It enhances cybersecurity with data loss prevention, advanced threat detection, and AI-driven features for reliable protection without impacting performance. Central management and advanced reporting streamline integration and ease of use. Flexible policy deployment through the management console and its robust security measures, such as DLP and device control, further increase protection. Challenges include high CPU and memory usage affecting performance, a complex interface, and lengthy deployment. Third-party integration and Windows Hello support need improvement. Additional concerns involve improved threat detection and faster technical support responses.

What are the key features of Trellix Endpoint Security Platform?

Centralized Management: Allows seamless integration and scaling with consistent control across environments.
Threat Prevention: Provides comprehensive antivirus and malware protection to secure systems.
Encryption: Ensures data security with robust encryption techniques.
Advanced Reporting: Facilitates detailed insights and analysis for better decision-making.
AI-Driven Detection: Offers reliable threat detection without impacting system performance.

What benefits should users look for in reviews?

Comprehensive Protection: Offers extensive security measures for protecting digital environments.
Ease of Integration: Simplifies the process of incorporating into current systems and processes.
Flexible Policy Deployment: Supports adaptable policy management to meet diverse requirements.
Scalability: Enables growth while maintaining efficiency and security.
Robust Security Features: Provides advanced security measures like DLP and device control.

Trellix Endpoint Security Platform is widely implemented in industries such as banking and government for securing mobile and desktop devices. Its capabilities cover network security, device control, and remote access protection, catering to diverse environments by offering robust cybersecurity management against advanced threats.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Liberty Wines, Pioneer Telephone, Visier

inHouseIT, Seagate Technology

Buyer's Guide

Rapid7 InsightIDR vs. Trellix Endpoint Security Platform

June 2026

Free Report: Rapid7 InsightIDR vs. Trellix Endpoint Security Platform

Find out what your peers are saying about Rapid7 InsightIDR vs. Trellix Endpoint Security Platform and other solutions. Updated: June 2026.

DOWNLOAD NOW

908,877 professionals have used our research since 2012.

See our Rapid7 InsightIDR vs. Trellix Endpoint Security Platform report.

See our list of best Endpoint Detection and Response (EDR) vendors and best Extended Detection and Response (XDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.