Rapid7 InsightIDR vs Trellix XDR comparison

Rapid7 and Trellix are both solutions in the Extended Detection and Response (XDR) category. Rapid7 is ranked #20 with an average rating of 7.8, while Trellix is ranked #33 with an average rating of 8.0. Rapid7 holds a 2.1% mindshare in XDR, compared to Trellix’s 0.6% mindshare. Additionally, 96% of Rapid7 users are willing to recommend the solution, compared to 100% of Trellix users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Rapid7 InsightIDR and Trellix XDR based on real PeerSpot user reviews.

Find out in this report how the two Extended Detection and Response (XDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Rapid7 InsightIDR vs. Trellix XDR Report (Updated: February 2026).

Buyer's Guide

Rapid7 InsightIDR vs. Trellix XDR

February 2026

Download the complete report

Helped 885,311 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of March 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.9%, down from 5.6% compared to the previous year. The mindshare of Rapid7 InsightIDR is 2.1%, down from 2.3% compared to the previous year. The mindshare of Trellix XDR is 0.6%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Extended Detection and Response (XDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	4.9%
Rapid7 InsightIDR	2.1%
Trellix XDR	0.6%
Other	92.4%

Extended Detection and Response (XDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

SohailHyder

Head Of Cyber Security at Super Secure

Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Read full review

PankajKumar24

IT Manager at Gigabit Technologies Pvt Ltd

Centralized security console has unified threat telemetry and automated investigation playbooks

The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization. This creates big challenges for us. The support experience is also concerning. When we require support from Trellix immediately with high priority, we receive multiple emails requesting logs of various types. After that, we have to escalate to Trellix higher management, and then their agent will come in for a remote session to resolve any issues. I would give them eight out of ten points because of the high CPU utilization and the delayed support we experience.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly. The way they have done everything and integrated all the solutions that they've purchased over the years to make it a very seamless, effective product is very good. One thing about Palo Alto is that they take the products or services that they purchase and make them seamless for the end user as compared to some companies that purchase other companies and then just kind of have their products off to the side or keep different interfaces. Palo Alto doesn't do that."

"We have a complete overview of all our PCs and it's very easy to handle and to use the interface."

"The tool is designed to scale for large enterprises and handle large volumes of data."

"It's very stable. I've never experienced downtime for the ASM console or ASM core."

"Cortex XDR by Palo Alto Networks should be a stable solution."

"Their XDR agent and their behavioral indicators of compromise (BIOC) are pretty nice. Their managed threat hunting is also pretty nice. They also have WildFire, which is a service for actively looking for malware. It's quite useful."

"The most valuable feature of Cortex XDR by Palo Alto Networks is the low consumption of system resources. The solution uses a lot of AI and machine learning."

"We have found in our test Cortex XDR by Palo Alto Networks to be a very good tool."

More Cortex XDR by Palo Alto Networks pros

"Great coverage of all systems within our network from endpoint to firewall."

"InsightIDR has allowed us to find potential security issues that we did not know existed, and get remediation quickly."

"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."

"The most valuable features have to do with ease-of-use, as it is easy to check the events, investigate suspicious activities, and do forensic analysis, and the web interface is great — very useful and user-friendly."

"The platform offers unlimited storage and agent-based solutions."

"I rate Rapid7 nine out of 10 for affordability"

"Log search allows us to dive deep into aggregated logs and query all event types at once."

"Scalability-wise, I rate the solution a ten out of ten. As a cloud tool, the product is highly scalable."

More Rapid7 InsightIDR pros

"The analytics assessment and flexibility of the platform are valuable."

"Trellix XDR is an excellent solution that is continually improving."

"It contributes to our system's robust event detection and analysis, enabling us to respond effectively to incidents."

"Because Trellix gives us multiple types of modules, we are using a single ePO console for multiple solutions including application control, DLP, and XDR."

Cons

"I have run into some detection issues with Cortex XDR. It needs to be better at detection of internal attacks."

"The configuration could be simplified. I would like to see better protection, specifically to protect email applications."

"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files."

"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."

"It tends to do 99.9% of things. The only thing I'd like is single sign-on authentication into their cloud platform so that my users can be properly authenticated against it."

"This product has not improved my organization - in fact, we are in the process of moving back to another product as a result of Cortex's horrible impact on system performance."

"It would be good to have a better way to search for a file within the UI."

"When it comes to malware files, it should be a little quick because, at times, it would give a wrong result in the sense of what it might be on malware, even if it still might be a normal one."

More Cortex XDR by Palo Alto Networks cons

"I would like the ability to adjust the threshold of certain existing alerts. Currently the only option is to change the notifications or create my own alert."

"The APIs can be further improved in Rapid7."

"Cloud risk assessment is one area where I think they need a lot of improvement."

"It would be useful to import threat intelligence in YARA format along with known incorrect email addresses."

"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."

"Rapid7 doesn't integrate well with all our security tools from various vendors, so we plan to switch. Many of our solutions work with Rapid7, but some do not. We are already searching for a replacement already."

"The product allows us to make only 30 custom rules."

"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."

More Rapid7 InsightIDR cons

"The platform should enhance compatibility with all other SIEM solutions."

"Technical support is crucial, especially when facing critical issues. It's rated six out of ten. Improvements are needed in the support sector, with a focus on providing expert assistance during production periods."

"The EdgeGear solution is an area that requires attention, specifically regarding AI solutions and intelligence features."

"The CPU utilization is very high with Trellix XDR; we are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization, which creates big challenges for us."

Pricing and Cost Advice

"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."

"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."

"Cortex XDR by Palo Alto Networks is an expensive solution."

"Very costly product."

"It's about $55 per license on a yearly basis."

"Cortex XDR’s pricing is very reasonable."

"The cost depends on your chosen license type, like Pro or other licenses."

"It has a yearly renewal."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"The pricing is good, and it is not very expensive."

"The solution has a mid-range price point in the market"

"The pricing and licensing are competitive."

"I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability."

"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."

"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."

"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."

"I rate Rapid7 InsightIDR's price a four on a scale of one to ten, where one is cheap, and ten is expensive."

More Rapid7 InsightIDR pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.

See recommendations

885,311 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

13%

Manufacturing Company

Computer Software Company

Financial Services Firm

Computer Software Company

10%

Financial Services Firm

Manufacturing Company

Government

Computer Software Company

20%

Healthcare Company

Government

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	44
Midsize Enterprise	20
Large Enterprise	47

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	5
Large Enterprise	6

No data available

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

See all answers

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

The product pricing is very cheap.

See all answers

What needs improvement with Rapid7 InsightIDR?

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as ...

See all answers

What is your experience regarding pricing and costs for Trellix XDR?

Since I'm a technical engineer, I don't deal with pricing or licensing. Our sales team handles those aspects.

See all answers

What needs improvement with Trellix XDR?

The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solu...

See all answers

What is your primary use case for Trellix XDR?

We are selling Trellix XDR products including DLP and EPP solutions. We sell Trellix XDR for endpoint protection. We ...

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 9% of the time

SentinelOne Singularity Complete vs Cortex XDR by Palo Alto Networks

Compared 6% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 5% of the time

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 5% of the time

Rapid7 InsightVM vs Rapid7 InsightIDR

Compared 4% of the time

CrowdStrike Falcon vs Rapid7 InsightIDR

Compared 4% of the time

Darktrace vs Rapid7 InsightIDR

Compared 3% of the time

More Rapid7 InsightIDR Competitors

CrowdStrike Falcon vs Trellix XDR

Compared 41% of the time

SentinelOne Singularity Complete vs Trellix XDR

Compared 34% of the time

Trellix Endpoint Security Platform vs Trellix XDR

Compared 13% of the time

Mandiant Advantage vs Trellix XDR

Compared 13% of the time

More Trellix XDR Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

March 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Rapid7 InsightIDR

March 2026

Download Rapid7 InsightIDR product report

Buyer's Guide

Extended Detection and Response (XDR)

February 2026

Download Trellix XDR product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

InsightIDR

MVision XDR, MVision eXtended Detection and Response

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Parsing hundreds of trivial alerts. Managing a mountain of data. Manually forwarding info from your endpoints. Forget that. InsightIDR instantly arms you with the insight you need to make better decisions across the incident detection and response lifecycle, faster.

Rapid7

Gain greater visibility and superior detection with Trellix XDR. This constantly evolving cybersecurity platform defends against today’s and tomorrow’s most sophisticated threats with advanced capabilities such as machine learning and embedded cyber intelligence.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Liberty Wines, Pioneer Telephone, Visier

Information Not Available

Buyer's Guide

Rapid7 InsightIDR vs. Trellix XDR

February 2026

Free Report: Rapid7 InsightIDR vs. Trellix XDR

Find out what your peers are saying about Rapid7 InsightIDR vs. Trellix XDR and other solutions. Updated: February 2026.

DOWNLOAD NOW

885,311 professionals have used our research since 2012.

See our Rapid7 InsightIDR vs. Trellix XDR report.

See our list of best Extended Detection and Response (XDR) vendors.

We monitor all Extended Detection and Response (XDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.