No more typing reviews! Try our Samantha, our new voice AI agent.

Trellix Endpoint Security Platform vs Trellix XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
4.6
Cortex XDR offers high ROI with reduced costs, improved efficiency, affordable pricing, and enhanced security features compared to competitors.
Sentiment score
6.7
Trellix Endpoint Security saves money, reduces recovery costs, and efficiently combats threats, offering strong malware protection and compliance.
Sentiment score
6.6
Trellix XDR boosts ROI by 20%, optimizes response times, reduces incidents, streamlines operations, and cuts workforce nearly in half.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cyber Security Manager at Welab bank
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
Detection and Response Consultant at Inovasys
In Cortex XDR by Palo Alto Networks, most of the remediation is automated and the accuracy is quite good.
Network Security Engineer at Cyberwell Solution
I believe the cost was approximately eight million per year, and in this situation, we avoided fees of approximately fifty million per year because of the situations that were prevented by blockages.
Sr Investigation Specialist at Ifood
We have observed tremendous return on investment after implementing Trellix Endpoint Security as it is a more cost-effective solution compared to other products.
Joint Director at PAA
Clients appreciate the solution’s customization capabilities and ongoing product improvements.
Information Security Engineer at Nhq Distribution Ltd
The workload has been reduced and the ROI has improved by around 20 percent.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
I have seen a return on investment because, in terms of employees, 15 were cut down to eight, and it was also saving us time from the whole dashboard automation.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Trellix helped us save our information, which is the most critical, and also save money.
System Administrator at a consultancy with 11-50 employees
 

Customer Service

Sentiment score
7.0
Cortex XDR is praised for technical support and responsiveness, despite occasional delays and varying regional support quality.
Sentiment score
6.7
Trellix Endpoint Security receives praise for knowledgeable support but struggles with inconsistent response times and regional service variations.
Sentiment score
6.1
Trellix XDR support receives mixed reviews; effectiveness and responsiveness vary by representative, with documentation often proving helpful.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
Head of data centers at a non-profit with 10,001+ employees
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
Senior Process Expert at A.P. Moller - Maersk
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
Chief of IT Architecture at a financial services firm with 10,001+ employees
When the ISO examiner saw it, they were impressed by the compliance demonstration. That was one of the reasons that led to our certification.
IT Infrastructure Engineer
The response time is a notable issue.
Technical Associate at Valuepoint Systems
I would rate their customer service nine out of ten.
Joint Director at PAA
If I require remote support, they will send a link to join a session and help me resolve any issues I have faced.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
Technical support is crucial, especially when facing critical issues.
Information Security Engineer at Nhq Distribution Ltd
The most basic thing that you need from the vendor is support, and by the time they resolve it, you probably would have figured it out by yourself because the resolution came after weeks or months.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
 

Scalability Issues

Sentiment score
7.5
Cortex XDR scales well for different organizations, but may be costly for small enterprises despite its cloud-based efficiency.
Sentiment score
7.5
Trellix Endpoint Security Platform is scalable, integrates easily, and supports various platforms, receiving high user ratings for adaptability.
Sentiment score
7.5
Trellix XDR offers scalable, adaptable security management with centralized visibility and efficient threat detection for diverse organizational needs.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Assistant Security Architect at Cloudnomics
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Junior Security Analyst at ITSEC Asia
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
Head of data centers at a non-profit with 10,001+ employees
Trellix Endpoint Security Platform is very scalable.
Account Manager at a tech vendor with 201-500 employees
It is not readily expandable.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
The scalability of Trellix Endpoint Security Platform is excellent.
Product Specialist at Frontier Business systems
Trellix XDR has good scalability because it can handle multiple security sources and multiple logs.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
in our environment, we have fed a lot of data logs into the tool, and it has been reliable and scalable with no issues.
Security Consultant at Deloitte
You can scale from ten licenses to several thousand.
System Administrator at a consultancy with 11-50 employees
 

Stability Issues

Sentiment score
8.0
Cortex XDR by Palo Alto Networks is highly stable, resolving early issues and delivering consistent, reliable performance with minimal downtime.
Sentiment score
7.9
Trellix Endpoint Security is praised for stability, reliability, and effective deployment, with minor issues resolved through updates.
Sentiment score
7.8
Trellix XDR is reliable with a strong support team, occasional downtime issues, and solid security expertise despite update concerns.
Cortex remains fast and responsive, even with increasing data and alerts.
Final Year Student at Gitam University
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR by Palo Alto Networks can be trusted completely.
Soc Analyst at Softcell Technologies Limited
I would rate its stability as nine out of ten.
Joint Director at PAA
I would rate the stability of Trellix Endpoint Security as near perfect, close to ten out of ten.
Information Security Engineer at Nhq Distribution Ltd
Sometimes it was a mess, and I have never seen that with other SIEM providers.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Support and stability are good. They are continuously improving.
Solutions Architect at Mideast Communication Systems-MCS
The system would go down for half an hour, an hour, or two hours in the off-hours which would then impact the business, impact the alerts, and the flow of alert.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
There is no downtime, or if there is, prior notification is sent to us so we can prepare accordingly.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
 

Room For Improvement

Cortex XDR needs better integration, user interface, automation, and competitive pricing, along with reduced performance issues and clearer features.
Trellix Endpoint Security needs better speed, usability, resource efficiency, support, automation, cross-platform compatibility, and threat detection features.
Trellix XDR challenges include high costs, complex setup, compatibility issues, and slow support, limiting accessibility and effectiveness.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
Final Year Student at Gitam University
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
Pre Sales Architect at network techlab
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cyber Security Information Security Specialist at MHM Holding GmbH
What needs improvement in Trellix Endpoint Security is the reduction of resource consumption by the scanning feature.
Technical Associate at Valuepoint Systems
Improvements are needed in forensic analytics to detect specific vulnerabilities.
Information Security Engineer at Nhq Distribution Ltd
The product does not seem to be cloud-native.
Architect at a government with 10,001+ employees
Trellix support team is not highly regarded because they follow a whole hierarchical process to escalate the complaints and the feedback requests, and the resolution can take very long, from two to three weeks to a month, which is not really viable in a cybersecurity landscape which is moving this fast.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Continuous enhancement to automation and AI-driven threat prioritization would further reduce analysts' workflow and improve response effectiveness.
Business development executive at Digitaltrack solution Pvt Ltd
The trend these days is moving toward AI security, and Trellix XDR should align with this direction.
Solutions Architect at Mideast Communication Systems-MCS
 

Setup Cost

Cortex XDR's pricing is seen as reasonable for its advanced capabilities, though setup costs can be perceived as high.
Trellix Endpoint Security provides competitive enterprise pricing with flexible licensing, offering value through standard and perpetual options with promotional discounts.
Trellix XDR offers competitive pricing for large enterprises, but recent price increases challenge affordability for small businesses.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
Consultant at a tech services company with 1,001-5,000 employees
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Senior Process Expert at A.P. Moller - Maersk
Compared to CrowdStrike, which is very costly, and SentinelOne, which is also very costly, Cortex XDR by Palo Alto Networks is a medium cost-efficient solution.
Soc Analyst at Softcell Technologies Limited
The licensing is straightforward, pricing is very competitive, and margins are good.
Account Manager at a tech vendor with 201-500 employees
The license costs are very reasonable, around 1,000 to 1,200 rupees per year.
Technical Associate at Valuepoint Systems
Trellix Endpoint Security is cost-effective and provides excellent value for money.
Joint Director at PAA
But currently, they have bumped up the prices and that is why we have now moved to a different solution totally. We have left Trellix XDR.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
My experience with pricing, setup cost, and licensing shows that the pricing is very competitive and not overly expensive.
Security Engineer at i360
 

Valuable Features

Cortex XDR enhances security with AI-driven analytics, user-friendly management, cloud deployment, and comprehensive threat response features.
Trellix Endpoint Security Platform offers centralized management, AI-driven threat detection, encryption, data loss prevention, and adaptive security features.
Trellix XDR enhances threat detection and response through automation, integration, AI assistance, and contextual data, improving security operations.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
Cyber Security Manager at Welab bank
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
Pre Sales Architect at network techlab
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
Final Year Student at Gitam University
Trellix Endpoint Security is a proven, robust, and cost-effective solution that protects the organization from different types of ransomware and attacks.
Joint Director at PAA
Including options like Application Control (formerly Solidcore), integrated monitoring, change control, DLP, and advanced threat protection, the solution offers comprehensive security.
Information Security Engineer at Nhq Distribution Ltd
The detection capability of Trellix Endpoint Security is higher than traditional antivirus solutions.
Senior Vice President IT at AS IT Consulting Pvt. Ltd.
The core functionality includes EDR and NDR, and Trellix XDR gets threat detection on both the network and endpoint levels.
Solutions Architect at Mideast Communication Systems-MCS
The second feature is its ability for cross-platform threat correlation, meaning the platform helps to correlate all events across endpoints, network activity, security controls, and threat intelligence sources, providing us with a more in-depth view in terms of threat detection and threat research.
Security Consultant at Deloitte
You can start as a small company and when you own Trellix XDR, as your company grows, you can grow your Trellix XDR subscription from on-premise, for example, to the cloud.
System Administrator at a consultancy with 11-50 employees
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
115
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Trellix Endpoint Security P...
Ranking in Extended Detection and Response (XDR)
8th
Average Rating
8.0
Reviews Sentiment
6.7
Number of Reviews
167
Ranking in other categories
Endpoint Protection Platform (EPP) (7th), Endpoint Detection and Response (EDR) (8th)
Trellix XDR
Ranking in Extended Detection and Response (XDR)
18th
Average Rating
7.6
Reviews Sentiment
6.6
Number of Reviews
10
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.5%, down from 5.0% compared to the previous year. The mindshare of Trellix Endpoint Security Platform is 3.4%, down from 3.6% compared to the previous year. The mindshare of Trellix XDR is 0.8%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.5%
Trellix Endpoint Security Platform3.4%
Trellix XDR0.8%
Other91.3%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
AmitKumar22 - PeerSpot reviewer
Product Manager at Frontier Business systems
Strong endpoint protection has simplified compliance and reduced effort for large user environments
One of the best features of Trellix Endpoint Security Platform is its endpoint security, and I have been using it for the last four and a half to five years, so I can say this is one of the best EDR endpoint security solutions I have ever seen. The features that make Trellix Endpoint Security Platform stand out for me are ease of use and analytics, which I really appreciate the most. Trellix Endpoint Security Platform positively impacts my organization, ensuring we are compliant with SOC 2, HIPAA, and all other compliance requirements, so there are no issues with that.
Twinkle Solanki - PeerSpot reviewer
Business development executive at Digitaltrack solution Pvt Ltd
Unified threat detection has improved investigations and now speeds up incident response
While Trellix XDR is a strong platform overall, there are a few areas where it could be improved. The initial setup and configuration can be complex, especially for organizations with diverse environments. Some additional advanced features also have a learning curve and may require extra training for security teams to fully utilize them. Moreover, reporting and dashboard customization could be more flexible, allowing users to create highly customized views and reports more easily. There are also areas that could optimize detection surveys. Addressing these areas would further enhance the overall experience and operational effectiveness. One additional improvement would be deeper integration with a wider range of third-party security tools and cloud platforms. While Trellix XDR integrates with many solutions, simplifying the integration management would help organizations with complex security ecosystems. I would like to see more out-of-the-box reports and executive-level dashboards that make it easier to communicate security metrics to leadership. Finally, continuous enhancement to automation and AI-driven threat prioritization would further reduce analysts' workflow and improve response effectiveness. Overall, these are areas that need refinement rather than being major concerns, as the platform still delivers strong security and operational value.
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
908,858 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
10%
Comms Service Provider
10%
Manufacturing Company
10%
Manufacturing Company
10%
Financial Services Firm
9%
Construction Company
9%
Government
8%
Financial Services Firm
14%
Computer Software Company
13%
Outsourcing Company
11%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise21
Large Enterprise54
By reviewers
Company SizeCount
Small Business68
Midsize Enterprise39
Large Enterprise67
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise3
Large Enterprise7
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
How does McAfee Endpoint Security compare with MVISION?
The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deplo...
How does Crowdstrike Falcon compare with FireEye Endpoint Security?
The Crowdstrike Falcon program has a simple to use user interface, making it both an easy to use as well as an effec...
What is your experience regarding pricing and costs for McAfee Endpoint Security?
I don't have visibility on pricing because it is negotiated by a different team, as I look after the technical side.
What is your experience regarding pricing and costs for Trellix XDR?
My experience with pricing, setup cost, and licensing shows that the pricing is very competitive and not overly expen...
What needs improvement with Trellix XDR?
I believe Trellix XDR can be improved with more automation. I would like more improvements in terms of response.
What is your primary use case for Trellix XDR?
My main use case for Trellix XDR is supporting our clients and their EDR requirements. A specific example of how I us...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
McAfee Endpoint Security, McAfee Endpoint Protection, Intel Security Total Protection for Endpoint, McAfee Complete Endpoint Protection, Trellix Endpoint Security (ENS)
MVision XDR, MVision eXtended Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
inHouseIT, Seagate Technology
Information Not Available
Find out what your peers are saying about Trellix Endpoint Security Platform vs. Trellix XDR and other solutions. Updated: June 2026.
908,858 professionals have used our research since 2012.