Cortex XDR
Palo Alto Networks' endpoint protection and extended detection and response platform for security teams.
Updated · AppBreakup editorial · Web, Windows, macOS, Linux
Is Cortex XDR free?
No, it's a paid product
Switch from Cortex XDR to
All 7
CrowdStrike FalconStarting price: $59.99 per device/year (Falcon Go, billed annually)
- SoSophos Endpoint
Paid
SentinelOne SingularityStarting price: $179.99 per endpoint/year (Singularity Complete)
- Verified facts
- 5 of 5
- Alternatives ranked
- 7
- Approved reviews
- 0
- Visits sent from here
- 0
About Cortex XDR
Cortex XDR is the endpoint security and detection product from Palo Alto Networks. An agent on each device blocks malware, exploits and ransomware, while the cloud console pulls in data from endpoints, the network, cloud accounts, identity systems and email so analysts can follow an attack across all of them in one incident view. It groups related alerts, shows the chain of processes behind a threat, and lets the team isolate machines, kill processes or run scripts remotely. Custom detection rules, a REST API and integrations with other security tools are part of the package, and Palo Alto's Unit 42 team can run monitoring and threat hunting as a managed service inside the same tenant. It is aimed at mid-size and large organisations with a security team or an outsourced SOC, not at home users. Pricing is quote-based through Palo Alto and its partners, usually per endpoint, and the management console runs in the browser as a cloud service.
Best for: Security teams that want endpoint protection plus cross-source detection, especially if they already use Palo Alto.
Pros and cons
What works
- Correlates endpoint, network, cloud, identity and email data in one incident view
- Custom detection rules and a REST API for alerts and incidents
- Optional Unit 42 managed detection and response inside the same tenant
- Fits neatly with other Palo Alto firewalls and Cortex products
Why people leave
- No public pricing; you have to go through sales or a partner
- Built for trained security analysts, so small IT teams may find it heavy
- Gets most of its value when paired with other Palo Alto products
Cortex XDR vs CrowdStrike Falcon, Sophos Endpoint and SentinelOne Singularity
From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.
| Attribute | Cortex XDR | CrowdStrike Falcon | Sophos Endpoint | SentinelOne Singularity |
|---|---|---|---|---|
| Pricing | Paid | Paid | Paid | Paid |
| Verified price | — | $59.99 per device/year (Falcon Go, billed annually) | — | $179.99 per endpoint/year (Singularity Complete) |
| Free plan | No | No | No | No |
| Open source | No | No | No | No |
| Self-hostable | No | No | No | No |
| Platforms | Web, Windows, macOS, Linux | Web, Windows, macOS, Linux | Web, Windows, macOS, Linux | Web, Windows, macOS, Linux, iOS, Android |
Top Cortex XDR alternatives
See all 7- 1CrowdStrike Falcon83.8
A lightweight single-agent EDR/XDR platform with strong threat intelligence and managed hunting options.
- 2SoSophos Endpoint68.9
Endpoint protection with anti-ransomware and an optional managed detection and response service.
- 3SentinelOne Singularity62.6
Autonomous endpoint protection with automated rollback, covering endpoints, cloud and identity.
- 4
Microsoft Defender for Endpoint61.8Often already licensed in Microsoft 365 E5, with tight ties to Defender XDR and Sentinel.
- 5
Bitdefender GravityZone55.9Strong-scoring prevention with EDR at a lower price, well suited to small and mid-sized businesses.
Why people left Cortex XDR
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from Cortex XDR, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of Cortex XDR
Cortex XDR: common questions
What is Cortex XDR?
Cortex XDR: Palo Alto Networks' endpoint protection and extended detection and response platform for security teams. Best for security teams that want endpoint protection plus cross-source detection, especially if they already use Palo Alto. Available for Web, Windows, macOS and Linux.
Is Cortex XDR free?
No, Cortex XDR is a paid product.
Is Cortex XDR open source?
No, Cortex XDR is not open source.
What platforms does Cortex XDR run on?
Cortex XDR is available for Web, Windows, macOS and Linux.
What are the best alternatives to Cortex XDR?
The highest-ranked Cortex XDR alternatives right now are CrowdStrike Falcon, Sophos Endpoint and SentinelOne Singularity. See the full ranked list for pricing, platforms and verified facts.
Cortex XDR vs CrowdStrike Falcon: what's the difference?
Both Cortex XDR and CrowdStrike Falcon are paid products. Both run on Web, Windows, macOS and Linux.