No more typing reviews! Try our Samantha, our new voice AI agent.

Tanium vs ThreatLocker Zero Trust Platform comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
121
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Tanium
Ranking in Endpoint Protection Platform (EPP)
13th
Average Rating
7.8
Reviews Sentiment
5.8
Number of Reviews
24
Ranking in other categories
Vulnerability Management (26th), Unified Endpoint Management (UEM) (8th), Autonomous Endpoint Management (2nd)
ThreatLocker Zero Trust Pla...
Ranking in Endpoint Protection Platform (EPP)
5th
Average Rating
9.2
Reviews Sentiment
7.1
Number of Reviews
107
Ranking in other categories
Network Access Control (NAC) (3rd), Advanced Threat Protection (ATP) (5th), Application Control (1st), ZTNA as a Service (5th), ZTNA (6th), Ransomware Protection (1st)
 

Mindshare comparison

As of October 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, up from 3.7% compared to the previous year. The mindshare of Tanium is 2.5%, up from 2.4% compared to the previous year. The mindshare of ThreatLocker Zero Trust Platform is 1.3%, up from 0.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
ThreatLocker Zero Trust Platform1.3%
Tanium2.5%
Other92.4%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Sandeepraj Gatla - PeerSpot reviewer
Dfir Analyst at a tech services company with 201-500 employees
Endpoint monitoring has strengthened incident response and provides rapid isolation and forensics
Tanium provides an endpoint which is isolated from the network and environment. We can easily search its logs and history and connect remotely directly to that particular device which has been isolated from the network. We can search for the history and logs, including audit logs and event logs. The complete activity of the user or owner of the device is visible to us. We can see the artifacts of particular USB transfers internally for official use. We can not only connect remotely but also see the device status and how many failures have occurred within the network so far. We can see the IP address, how many times it has changed its IP address, and how many times it was connected to VPN or external VPN or internal VPN and what has been searched while on VPN. We can block the IOCs or IP addresses as well. We can block domains, hashes, SHA values, SHA-256, SHA-1, SHA-5 and MD5. Although I am not completely involved in the automation team, we do have that team and I have worked in some CERT recently. Tanium is more useful while we are in the CERT because most of the times when we are on high alert, Tanium does play a main role for that particular incident or any high case. Tanium is a simple tool and we can easily integrate it to many devices and it is a mandatory tool to secure an endpoint. It is mandatory to give any RDP connection and the tool should be present in the particular device. It is completely mandatory and it is in the policy as well.
Santo Joy - PeerSpot reviewer
Head Of Cyber Security at a outsourcing company with 201-500 employees
Security controls have been strengthened with granular application, ringfencing, and access policies
The features of ThreatLocker Zero Trust Endpoint Protection Platform that I like the most are the Ringfencing, elevation control, storage control, and application whitelisting functionality. For examples of how these features benefit my company, we were looking for a solution across various vendors to actually implement application whitelisting controls. ThreatLocker's agent, which is very lightweight and does not use much CPU or RAM, helped us achieve that solution. Ringfencing was an add-on that ticked off a lot of Australian framework security controls, which is the reason we chose it. My impression of the allowlisting feature in terms of managing which software, scripts, and libraries run on my devices is that ThreatLocker's community page has a lot of information around this, which is very helpful. Not only that, the Cyber Hero support that ThreatLocker provides gives us insights and best practices, helping us achieve that solution and guiding us to the right platform. The impact of Ringfencing on controlling the behavior of approved applications has been a big winner for us because it is something that many other platforms do not provide as a functionality. Having that allowed us to identify what applications talk to each other, which is something that many other platforms do not do. The network control feature impacts my ability to manage network traffic across my endpoints and servers. We have not used this widely across all our partners, but wherever required, we use it. It has been an easy solution for those customers to get that control implemented. The elevation feature's role in facilitating just-in-time administrative access for approved applications shows that elevation control helps in many use cases involving remote control platforms, door usage, and security system platforms that require local admins. There are many solutions that provide this functionality, but the licensing cost seems to be expensive, and it also adds another solution into the mix. Rather than doing that, we try to use ThreatLocker Zero Trust Endpoint Protection Platform to achieve that control. Regarding the storage control feature, I have used it. The primary function is USB blocking, which is very widely adopted, and also just locking down and allowing certain users to access certain file locations helps us there. When it comes to enforcing policy-driven access over various storage devices, it depends on the business risk adapted by the companies that we support, but generally the use case is USB and external storage devices where companies know that is a risk, but they do not have appropriate solutions. There are EDR platforms that claim to do this, but ThreatLocker Zero Trust Endpoint Protection Platform does it at an advanced level. My assessment of the efficiency of the real-time threat intelligence and category controls employed by Web Control in blocking malicious and non-compliant sites leads me to think that Web Control is another functionality within ThreatLocker Zero Trust Endpoint Protection Platform that is an add-on on top of the current set. That is another solution that we use based on what is required for the company, but again, that is not widely adapted yet for our partners.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The information the dashboard provides is very clear."
"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."
"There has been a significant reduction of approximately 70% to 80% in our internal MTTR and MTTD metrics, now around five to eight minutes whereas previously it was hours, which has helped tremendously."
"If the user leaves our premises or network, Palo Alto Traps will still be on that endpoint and will still apply our policies."
"The user interface of the solution is sophisticated and straightforward."
"One of the main benefits of the solution is its intelligence to correlate the events into an incident."
"My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one."
"The solution helps find bugs, and it is safe to use to prevent attacks by hackers."
"Tanium is a very good product and I would rate it eight or nine out of ten."
"I'm not so familiar with the tool but I like the interaction of the console to the picture. Patching is the primary model I have been focusing on for the last couple of weeks. So I have created a proof of concept environment and have been checking the available features."
"Tanium's most valuable feature is its instant discovery aspect."
"The security features are very valuable."
"When I push a quick update, it's done right away, and I can rescan immediately to confirm completion within minutes."
"It's definitely not complex, it is pretty user-friendly and it's a solid tool enterprise to use."
"For incident response tasks, all these tasks can get done in minutes with minimal disruption to the end-user."
"I like the fact that you can create patching campaigns depending on the area of your network that you want to address first. I like the ability it has to make several campaigns that work in parallel."
"The best features ThreatLocker Zero Trust Endpoint Protection Platform offers is that the entire platform is perfect, it is very user-friendly and helps us manage our endpoints easily, and the parts that stand out for my team are elevation, password rotation, and application control."
"The interface is clean and well-organized, making it simple to navigate and find what we need."
"ThreatLocker’s support has been second to none."
"Network Control, Application Control, and Storage Control impact my daily workflow significantly, as they give me operational freedom with cyber hero support, reduce the anxiety I have day-to-day, and have improved my overall general mental health because of all of the never feeling alone being reduced to near zero, with a whole team of cyber heroes that are just jumping to help me, and the turnaround is literally a minute in most cases."
"Unified Audit is excellent for identifying our denies and using those to dynamically create rules, as opposed to manually observing the logs and creating them. It saves so much time."
"ThreatLocker Zero Trust Platform has positively impacted my organization by saving a ton of cleanup during a malicious attack, as it has stopped it in its tracks, and I was able to basically pinpoint the vector of attack if something were to happen."
"ThreatLocker has significantly improved numerous techniques that mitigate vulnerabilities and viruses initiated on the back end of a network."
"A few years back, we had an attack on one of our biggest clients."
 

Cons

"This product has not improved my organization - in fact, we are in the process of moving back to another product as a result of Cortex's horrible impact on system performance."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"The encryption is not up to the mark."
"Cortex XDR is trickier to configure than other Palo Alto products. This is one area where we are not so satisfied."
"The solution should add unwanted malicious hash values to a block list so that whenever the action is triggered, it will automatically prevent the malicious content."
"The solution should offer more dashboards and they should be better customized."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"Managing the product should be easier."
"The solution needs to improve the reporting and tracking capabilities."
"There are downsides and drawbacks in Tanium, and there is room for improvement from my perspective."
"Any movement into a SaaS solution has challenges since the processes and data flows are not well defined. Hence, you need to build it at the same time."
"Tanium’s scalability could be improved."
"Most of the time, agent-relative issues have to be more equipped with self-healing features. At times, the agent is there, but for some reason, it doesn't report a status. It gives certain problems that are obviously agent-based."
"When working with Tanium, there are some older devices that haven't been patched for a long time, and certain patches are not included in Tanium. I have to search outside to download patches, create bundles, and then perform the task."
"There are some bugs in the product. The tool needs to improve in the area of reporting."
"The solution lacks mobility."
"A valuable addition to ThreatLocker would be a column in the audit page displaying a VirusTotal score for each file."
"I actually have a gripe with the allowlisting feature of ThreatLocker Zero Trust Endpoint Protection Platform."
"ThreatLocker Zero Trust Endpoint Protection Platform has reduced some of the operational costs in my company in terms of time spent on tickets, but nothing major."
"We identified several areas that we would like to see improved."
"ThreatLocker Zero Trust Endpoint Protection Platform can be improved by exploring ways of ensuring it is deployed deeper in the device rather than through an extension on the browser and finding ways to integrate all browsers."
"A slightly more modernized interface for ThreatLocker Zero Trust Platform would be nice, but the interface does its job for what it needs to at the moment."
"ThreatLocker Zero Trust Endpoint Protection Platform should focus more on the application allow listing feature, which shows whether a program has been recognized but not necessarily whether it has been trusted."
"I chose a rating of 9 out of 10 because it is a 10 out of 10 application, but I deducted one point because if there were an AI that could help us create policies, it could be even more useful."
 

Pricing and Cost Advice

"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"The price was fine."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."
"The pricing is okay, although direct support can be expensive."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"I don't recall what the cost was, but it wasn't really that expensive."
"The pricing is a little bit on the expensive side."
"It's an expensive solution. It would be nice if the cost were lower."
"The solution is expensive but it's a good investment."
"The solution offers value for money."
"There is an annual license required to use this solution."
"The product's pricing differs from region to region depending on negotiations and the number of endpoints."
"Tanium is a more expensive solution in Latin America than some of the competitors, such as BigFix."
"It is higher than some competitors in the market."
"The price of ThreatLocker Allowlisting is reasonable in the market, but it is not fantastic."
"I believe ThreatLocker's pricing model is fair and flexible, allowing account managers to offer customized deals based on our specific needs."
"I do not deal with pricing, but I assume it is cost-effective for us. We choose a solution based on functionality and affordability."
"We have not had any real issues with the pricing. As they have added more features, due to the way our contracts are structured with our customers, we have had to hold off on adopting the new features because they do add costs."
"Others say ThreatLocker is too expensive, and I tell them they're dreaming. It's well-priced for what it does."
"The pricing is reasonable and normal. I do not have any problems with the cost."
"I find ThreatLocker's pricing to be reasonable for the services it provides."
"I can't complain. Cheaper would always be nice, but I think it's reasonable compared to other software in the cybersecurity market."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
919,586 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Financial Services Firm
14%
Manufacturing Company
9%
Government
8%
Healthcare Company
7%
Manufacturing Company
13%
Financial Services Firm
12%
Computer Software Company
9%
Outsourcing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business49
Midsize Enterprise21
Large Enterprise56
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise12
By reviewers
Company SizeCount
Small Business73
Midsize Enterprise21
Large Enterprise23
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Tanium?
While there is always room for improvement, I am pleased with Tanium.
What is your primary use case for Tanium?
The primary use case for Tanium ( /products/tanium-reviews ) is compliance, patching, and inventory as part of the co...
What advice do you have for others considering Tanium?
For smaller companies, Tanium is quite a big investment, and one needs to have a considerable setup to make it econom...
What is your experience regarding pricing and costs for ThreatLocker Allowlisting?
My experience with pricing, setup cost, and licensing with ThreatLocker Zero Trust Platform is that it is owned by my...
What needs improvement with ThreatLocker Allowlisting?
I believe ThreatLocker Zero Trust Platform's marketing strategy has to be changed because only fewer organizations, s...
What is your primary use case for ThreatLocker Allowlisting?
My main use case for ThreatLocker Zero Trust Platform is that it helps to prevent somebody from accessing scripts. It...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Tanium Inc Cloud, Tanium XEM
Protect, Allowlisting, Network Control, Ringfencing
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
JPMorgan Chase, eBay, Amazon, US Bank, MetLife, pwc, Cerner, Delphi, MGM Grand, New York Life
Information Not Available
Find out what your peers are saying about Tanium vs. ThreatLocker Zero Trust Platform and other solutions. Updated: September 2026.
919,586 professionals have used our research since 2012.