Try our new research platform with insights from 80,000+ expert users

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Traps drastically reduces endpoint attack surface through advanced detection capabilities, sandboxing, and limiting executable launches.
Cortex XDR provides a multi-layered approach that efficiently stops exploits, ransomware, worms, and viruses, offering peace of mind.
The anti-exploit feature of Traps is excellent, providing superior blocking with a low rate of false positives.
Total stability and quick performance improvement are notable, with a seamless interface and integration capabilities.
Cortex XDR combines machine learning and integration with firewalls for advanced protection and intelligence across environments.

CONS

Cortex XDR by Palo Alto Networks exhibits a significant disparity in functionality across Windows, Linux, and Mac versions, limiting some features to Windows only.
There are integration challenges, notably needing to remove McAfee for installation and weaknesses in third-party solution integration.
Support is frequently criticized for being inadequate, with difficulties in communication and resolution.
False positives and complex management are issues that users face, making operations and configurations cumbersome.
Cortex XDR by Palo Alto Networks is expensive, with some features requiring additional licenses, raising concerns about cost-effectiveness.
 

Cortex XDR by Palo Alto Networks Pros review quotes

LT
Lead IT Security Analyst at a mining and metals company with 1,001-5,000 employees
Jan 17, 2019
The multi-layered approach to the product gives you confidence that it will stop exploits, ransomware, worms, or viruses from compromising endpoints, essentially providing peace of mind.
reviewer1412415 - PeerSpot reviewer
Chief of IT Architecture at a financial services firm with 10,001+ employees
Nov 27, 2025
Palo Alto is the core of the security infrastructure in the environment.
AK
Information Technology Manager at a hospitality company with 10,001+ employees
Feb 7, 2019
After deploying Traps, we saw the performance of the network improve by 65 to 70 percent.
Learn what your peers think about Cortex XDR by Palo Alto Networks. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
876,487 professionals have used our research since 2012.
Netw9886 - PeerSpot reviewer
Network Manager of Cyber Defence at a government with 1,001-5,000 employees
Feb 11, 2019
The most valuable features are the fact that it was running in the background and it would intercept any weird stuff, and the fact that it would send things directly to the cloud for sandboxing. It's quite practical.
Ahmed Sief - PeerSpot reviewer
System Engineer at a logistics company with 5,001-10,000 employees
Jun 19, 2022
The initial setup is easy.
WA
System Administrator at NATIONAL ASSOCIATION OF REALTORS
Jun 30, 2021
I like the centralized console and the predictive analysis it does of malware. It is very stable and also scalable.
Mohammad Qaw - PeerSpot reviewer
Senior Security Consultant at helpag
Dec 15, 2022
From a single pane of glass, you can easily manage all of your endpoints.
it_user1237689 - PeerSpot reviewer
Network Designer at a computer software company with 1,001-5,000 employees
Oct 22, 2020
The initial setup is pretty easy.
ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Nov 14, 2025
The most valuable aspect of Cortex XDR by Palo Alto Networks for me is its integration with AI detection, where we get to know the behavioral detection based on users, traffic patterns, and different services that we consume.
OS
Information Security Advisor, CISO & CIO, Docutek Services at Docutek Services
Feb 7, 2019
If the user leaves our premises or network, Palo Alto Traps will still be on that endpoint and will still apply our policies.
 

Cortex XDR by Palo Alto Networks Cons review quotes

LT
Lead IT Security Analyst at a mining and metals company with 1,001-5,000 employees
Jan 17, 2019
Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis.
reviewer1412415 - PeerSpot reviewer
Chief of IT Architecture at a financial services firm with 10,001+ employees
Nov 27, 2025
However, if you do not have Palo Alto in your environment, you are paying these additional services just for Cortex XDR by Palo Alto Networks, so it is not a cost-effective solution.
AK
Information Technology Manager at a hospitality company with 10,001+ employees
Feb 7, 2019
There are some default policies which sometimes affect our applications and cause them to run around. In the hotel industry, we use a different type of data versus Oracle and SQL. By default, there are some policies which stop us from running properly. Because of this, the support level is also not that strong. We have to wait to get a results.
Learn what your peers think about Cortex XDR by Palo Alto Networks. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
876,487 professionals have used our research since 2012.
Netw9886 - PeerSpot reviewer
Network Manager of Cyber Defence at a government with 1,001-5,000 employees
Feb 11, 2019
There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly.
Ahmed Sief - PeerSpot reviewer
System Engineer at a logistics company with 5,001-10,000 employees
Jun 19, 2022
Every 30 or 40 days, there's a new version and we need to go and make sure our customer's laptops are upgraded.
WA
System Administrator at NATIONAL ASSOCIATION OF REALTORS
Jun 30, 2021
It would be good if they could make an exception for applications. Sometimes, it can be a bit of a challenge to make exceptions for certain applications that have been used as rogue.
Mohammad Qaw - PeerSpot reviewer
Senior Security Consultant at helpag
Dec 15, 2022
The solution should force customers to integrate with network traffic to see the full benefits of XDR.
it_user1237689 - PeerSpot reviewer
Network Designer at a computer software company with 1,001-5,000 employees
Oct 22, 2020
In reporting they should have a customizable dashboard due to the fact that C-level people don't like reporting to the IT department. They prefer to have a real-time dashboard. That kind of dashboard needs to have various customizations.
ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Nov 14, 2025
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth.
OS
Information Security Advisor, CISO & CIO, Docutek Services at Docutek Services
Feb 7, 2019
Traps doesn't work with McAfee. You need to remove McAfee to install Traps. This is very common, and its nothing that should be an issue. Some antivirus engines recognize Traps as an threat component, so maybe they need to shake hands somewhere.