Rapid7 InsightIDR vs VMware Carbon Black Endpoint comparison

Rapid7 InsightIDR vs. VMware Carbon Black Endpoint

Download the complete report

Helped 885,376 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of March 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.2%, up from 1.0% compared to the previous year. The mindshare of VMware Carbon Black Endpoint is 1.7%, down from 1.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.4%
Rapid7 InsightIDR	1.2%
VMware Carbon Black Endpoint	1.7%
Other	93.7%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

SohailHyder

Head Of Cyber Security at Super Secure

Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Read full review

reviewer2689206

Senior VP, Technology & Leading Technology Office at a outsourcing company with 1,001-5,000 employees

Behavior analytics has strengthened threat prediction yet still needs to improve overall standing

Regarding the real-time monitoring feature with VMware Carbon Black Endpoint, it is helpful in addressing unseen threats. I find the behavior analysis feature beneficial. I assess VMware Carbon Black Endpoint's machine learning capabilities in detecting unknown threats as fantastic. The behavior and analytics feature employs machine learning, and these are features which make the product and give that distinguishing, differentiating factor. The intelligent threat hunting capabilities have impacted my customers' cybersecurity efforts by giving them the edge to be prepared well in advance. Whenever this feature provides prediction, you know what action to take. You are aware of a possible attack and what kind of attack it may be, so you are much better prepared.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one."

"Stability is a primary factor, and then there's the ease of distribution and policy management; Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them."

"Cortex XDR by Palo Alto Networks should be a stable solution."

"The most valuable feature of Cortex XDR by Palo Alto Networks is the low consumption of system resources. The solution uses a lot of AI and machine learning."

"Cortex is the best tool for endpoint detection, with playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."

"Technical support is the best in class, in my opinion, because they have invested heavily in research and development."

"It'll not slow down your system when compared to others."

"It's a perfect solution. It integrates well into the environment."

More Cortex XDR by Palo Alto Networks pros

"The product works well. Stability-wise, I rate the solution a ten out of ten."

"During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an application belongs to a known ransomware group. The system rates the threat, offering a clear detection ratio, such as 97 out of 100. It not only identifies threats but also illustrates the associated behaviors, helping us understand the potential risk to a particular endpoint."

"The alerting to drive investigations and remediation has been its most valuable feature, plus the ability to quickly search multiple logs makes investigations easier."

"The solution provides satisfying native integration features"

"Enables the use of honey pots, honey users, and honey files to monitor for suspicious patterns."

"If you were on other solutions, you would notice that they use agents from third-party, from open-source, from a native OS, or from other tools. Here, however, it is an agent from Rapid7 itself. This adds to the solution's overall capabilities."

"The technical support is a solid 10 out of 10 as they take the time to answer any questions or problems which may arise in a reasonable time frame."

"Log search allows us to dive deep into aggregated logs and query all event types at once."

More Rapid7 InsightIDR pros

"The feature I found most valuable in Carbon Black CB Defense is the ongoing monitoring feature that works by emailing updates about any detections found."

"The solution has a library where we can have multiple threat intels onboarded. We just have to subscribe to a particular site intel and they'll provide us with all of the truncated details so that we can create IOCs and alerts on the basis of those IOCs."

"From a business perspective, we've been able to virtually eliminate cyber attacks from spyware, malware, and virus perspectives."

"The solution is very useful and easy to handle. You don't need much intervention with this product."

"The best feature of this solution is that we have a live response, which is really tailored to our needs."

"We have another piece of that infrastructure that does what they call threat emulation. It's like sandboxing where it takes files that it doesn't know about, puts them in a VM-type environment, and it kicks them off to see if there's any malware or tendencies that might look like malware, that kind of thing."

"The data analysis is the most valuable because of the whitelist database. It is different than standard IDS solutions."

"Carbon Black Cb Defense has a nice component called Alert Triage; it has helped to detect threats across the data and contains full details of the process execution kill chain and go live for immediate remediation."

More VMware Carbon Black Endpoint pros

Cons

"I would like to see some additional features related to email protection included."

"There are some default policies which sometimes affect our applications and cause them to run around."

"Limited remote connection."

"They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone."

"The dashboard could use some significant improvement, just making it more useful with more information. It has a limited amount of information right now. It is customizable, but I'd love to see a better out-of-box dashboard."

"It'll help if customization was easier."

"However, if you do not have Palo Alto in your environment, you are paying these additional services just for Cortex XDR by Palo Alto Networks, so it is not a cost-effective solution."

"There is also no recovery feature; if some endpoint is under attack there must be the possibility of recovering it or restoring it to a normal state."

More Cortex XDR by Palo Alto Networks cons

"Tenable Nessus is easier to deal with. It's more efficient and accurate. InsightIDR is heavier than Tenable in terms of performance and scanning. Rapid7 would be much easier to use if it had a network connector like Tenable. Tenable's connector allows continuous monitoring over the B caps."

"The product allows us to make only 30 custom rules."

"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."

"One of the things that could be better is digital forensics. It is there, but it can be better."

"They should add more configuration and security features to it."

"There is a future in AI with Rapid7, however, it is not fully operated. There are certain limitations with Rapid7 that I am working on."

"One thing that springs to mind is easier API integration with ITSMs."

"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."

More Rapid7 InsightIDR cons

"The support is poor."

"The UI interface needs improvement. The management needs further work in future versions."

"In the next release, it would help if we can get better control over containers."

"The application control can be improved. It should also have an automatic update of the agents."

"The solution needs expanded endpoint query tools."

"They will most likely need to create or include a feature that checks the network."

"With the on-prem one, the bug has been reported by the community in early January or February, something like that, at the beginning of the year, and it's still not addressed."

"Sometimes the solution blocks items that were previously approved and we don't know why."

More VMware Carbon Black Endpoint cons

Pricing and Cost Advice

"Very costly product."

"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."

"This is an expensive solution."

"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."

"It has reasonable pricing for the use cases it provides to the company."

"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."

"Compared to CrowdStrike, Cortex XDR is an expensive solution."

"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."

"It is a reasonably priced solution."

"The pricing of the solution depends on the user. But there is a yearly licensing cost."

"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."

"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."

"Rapid7 InsightIDR charges us based on the endpoints we connect to."

"Rapid7 InsightIDR is priced very well and is cost-effective."

"The pricing is good, and it is not very expensive."

More Rapid7 InsightIDR pricing and cost advice

"The cost/benefit factor has great relevance in Cb Defense implementations."

"Price-wise, VMware Carbon Black Endpoint is a highly-priced solution. Regarding the licensing cost of the solution, one needs to opt for an annual subscription."

"The license is annual. It's a standard license."

"The product’s price is less expensive than other vendors."

"The cost is a considerable factor, but the benefit factor is the most important. When you compare it with other products, the price is high. Carbon Black will negotiate the price."

"The pricing [is] more or less the same as other similar solutions."

"The licensing cost is on the more expensive side, but I thought it was worth it because they did a good job. It was one of the vendors I truly didn't have to worry about too much until this latest upgrade."

"CB Defense is available on a yearly subscription and is priced by the number of endpoints."

More VMware Carbon Black Endpoint pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

885,376 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

13%

Manufacturing Company

Computer Software Company

Financial Services Firm

Computer Software Company

10%

Financial Services Firm

Manufacturing Company

Government

Financial Services Firm

10%

Manufacturing Company

Government

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	44
Midsize Enterprise	20
Large Enterprise	47

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	5
Large Enterprise	6

By reviewers
Company Size	Count
Small Business	31
Midsize Enterprise	9
Large Enterprise	31

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

The product pricing is very cheap.

What needs improvement with Rapid7 InsightIDR?

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as ...

What to choose: an endpoint antivirus, an EDR solution or both?

I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) s...

What's the difference between Carbon Black CB Response and Carbon Black CB Defense?

Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoin...

What is your experience regarding pricing and costs for Carbon Black CB Defense?

The product is quite reasonable.

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Comparisons

Compared 9% of the time

SentinelOne Singularity Complete vs Cortex XDR by Palo Alto Networks

Compared 6% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Darktrace vs Cortex XDR by Palo Alto Networks

Compared 2% of the time

More Cortex XDR by Palo Alto Networks Competitors

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 5% of the time

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 5% of the time

Rapid7 InsightVM vs Rapid7 InsightIDR

Compared 4% of the time

CrowdStrike Falcon vs Rapid7 InsightIDR

Compared 4% of the time

Darktrace vs Rapid7 InsightIDR

Compared 3% of the time

More Rapid7 InsightIDR Competitors

CrowdStrike Falcon vs VMware Carbon Black Endpoint

Compared 12% of the time

SentinelOne Singularity Complete vs VMware Carbon Black Endpoint

Compared 8% of the time

Microsoft Defender for Endpoint vs VMware Carbon Black Endpoint

Compared 7% of the time

Fortinet FortiEDR vs VMware Carbon Black Endpoint

Compared 5% of the time

Trellix Endpoint Security Platform vs VMware Carbon Black Endpoint

Compared 3% of the time

More VMware Carbon Black Endpoint Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Rapid7 InsightIDR

Download Rapid7 InsightIDR product report

VMware Carbon Black Endpoint

Download VMware Carbon Black Endpoint product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

InsightIDR

Carbon Black CB Defense, Bit9, Confer

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Parsing hundreds of trivial alerts. Managing a mountain of data. Manually forwarding info from your endpoints. Forget that. InsightIDR instantly arms you with the insight you need to make better decisions across the incident detection and response lifecycle, faster.

Rapid7

VMware Carbon Black Endpoint enhances endpoint security with its robust EDR, threat detection, and live response features. The cloud-based architecture supports remote management and easy setup while behavioral monitoring and dynamic grouping minimize security risks.

VMware Carbon Black Endpoint is designed for those seeking comprehensive endpoint protection. With its cloud-based deployment, organizations experience streamlined remote control and simplified rollout processes. Its behavioral monitoring, incident response capabilities, and firewall integration deliver advanced security measures. Although it addresses many security challenges, areas like manual alert management, on-demand scanning, and integration with systems like AlienVault USM require refinement. Improved UI, EDR components, and flexible pricing models would enhance user satisfaction. On-premise deployment infrastructure and compatibility issues with some operating systems need attention. Enhanced reporting, container security, and multi-tenancy support are also essential for fulfilling industry needs. AI-driven analysis and threat isolation empower companies by fostering proactive management.

What are the key features of VMware Carbon Black Endpoint?

EDR Capabilities: Offers comprehensive endpoint detection and response to identify and mitigate threats.
Live Response: Enables real-time threat response actions for rapid containment and remediation.
Threat Detection: Uses advanced AI to identify and isolate potential security risks effectively.
Cloud-Based Architecture: Facilitates remote management and easy deployment of security measures.
Behavioral Monitoring: Continuously analyzes application behavior to detect anomalies and threats.
Dynamic Grouping: Organizes devices for improved management and targeted security policies.
Firewall Integration: Enhances security by integrating existing firewall solutions for a layered defense approach.
Whitelisting and Policy Management: Streamlines security configurations by managing allowed applications and user access policies.

What benefits should users look for when evaluating VMware Carbon Black Endpoint?

Ease of Setup: Simplifies initial deployment and management processes.
Scalability: Supports organizational growth by easily adapting to expanding security needs.
Detailed Process Monitoring: Provides deep visibility into application processes to identify threats efficiently.
Threat Isolation: Promotes proactive threat management, helping minimize the impact of security breaches.

VMware Carbon Black Endpoint finds extensive application in industries focused on stringent security requirements. Managed security service providers leverage its capabilities to deliver comprehensive protection to multiple clients worldwide. Organizations use it primarily for antivirus protection and incident management, integrating it with their existing security frameworks to strengthen endpoint visibility and real-time threat prevention. Its advanced detection and application control features make it a preferred choice in industries that prioritize robust security measures. However, it requires improvements in terms of system compatibility and customization flexibility to better serve diverse industry environments.

Broadcom

Sample Customers

CBI Health Group, University Honda, VakifBank

Liberty Wines, Pioneer Telephone, Visier

Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America

Rapid7 InsightIDR vs. VMware Carbon Black Endpoint