No more typing reviews! Try our Samantha, our new voice AI agent.

Blink Ops vs Palo Alto Networks Cortex XSOAR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Torq
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
4th
Average Rating
8.6
Reviews Sentiment
6.4
Number of Reviews
8
Ranking in other categories
AI-SOC (2nd), AI-Powered Security Automation (2nd)
Blink Ops
Ranking in Security Orchestration Automation and Response (SOAR)
20th
Average Rating
7.6
Reviews Sentiment
4.4
Number of Reviews
2
Ranking in other categories
AI-SOC (9th), AI-Powered Security Automation (4th)
Palo Alto Networks Cortex X...
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
51
Ranking in other categories
SOC as a Service (2nd)
 

Mindshare comparison

As of May 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 3.7%, down from 5.4% compared to the previous year. The mindshare of Blink Ops is 1.4%, up from 1.0% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 8.8%, down from 10.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Mindshare Distribution
ProductMindshare (%)
Palo Alto Networks Cortex XSOAR8.8%
Torq3.7%
Blink Ops1.4%
Other86.1%
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Nimrod Vardi - PeerSpot reviewer
Global IT Director at OpenWeb
Automation workflows have transformed our IT, enabling secure just-in-time access control
We work with them quite often, so we have a direct line regarding areas in Torq that have room for improvement. If we have a feature request, we can request it. I do not have anything in mind at the moment. We were a design partner for a short while, so we feel that they listen and that users of the system have an impact on the way the system is designed for the better. They have a new community, which is something that I personally suggested years ago. There are many people like me in different places and they might have already built the workflow that I need. Having the option to share workflows or to jump on a thread and say I have this need, did anyone ever build a workflow for it, is amazing. Someone would jump in and say yes, sure, here, take this workflow. I think this is an amazing thing and I really hope that the community will come alive because I think this is really powerful. This is something that I already suggested and it did happen eventually, and I am quite happy with it. I do not have any specific feature in mind that I have a need for at the moment.
AH
CEO at cybovate
Workflow automation has transformed SOC decisions and now manages security workload effectively
At the moment, I have no idea what an improvement can be because my feeling is Blink Ops can be deployed on-site in a hybrid mode or in the cloud. Hybrid mode means more or less the cloud environment running within the cloud. In Switzerland, I have seen quite a few clients where discussions happened and they said they do not want to go to cloud and want to run it on-premises. But the solution is just too big to run on-premises. Having a smaller version on-premises would be helpful, but my feeling is that is hard to achieve because the solution is just too big and too diverse to run on-premises. The other thing is also the support model. Support models normally work if platforms are accessible from outside, but if I need to go within the company and do some modifications on the platform within the company, it is normally just time-consuming. This limits some of the use cases in some clients if they say, okay, we are a nuclear power plant and we do not want anyone coming from outside. At the moment, nothing else comes to my mind because I would say Blink Ops is a comprehensive platform and sometimes I feel people are overwhelmed. Maybe one thing I have had twice now, and I am not sure if this would be a Blink Ops topic or also one of the competitors. On CRM platforms, if someone changes from one CRM platform to the other CRM platform, there are always converters. From one music platform to the other music platform, there are converters. I think that is quite often missing. People struggle and said they had an automation platform or quite often they have seven or several automation platforms and say they want to reduce to, for example, two different platforms and want to get rid of the other ones. But then sometimes it is quite often a redevelopment, especially if it was a no-coding platform and everything is in code. Then normally it requires a huge transformation project. I think really helping the clients understand what the other platform does and then maybe on this level, just having the wizard would be fine. But my feeling is that migrating from one platform to the other is quite difficult.
CC
Enterprise Security Architect V at FirstEnergy
Customization supports seamless workflow while data influx challenges response time
What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali. I can create various custom automations and custom fields. There is significant customization ability in this platform. If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier. All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools. This serves as our central location where our SOC analysts can work and determine if incident response is needed. The platform provides data enrichment capabilities, offering information upfront so analysts do not have to search for it. They can access details such as username, phone number, email address, and workplace information. For malware files, they can retrieve details from VirusTotal, including file names and environment presence. We have built substantial automation around these features, which also helps us track case metrics, investigation time, and threat mitigation duration.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."
"What I appreciate most about Torq is that it is an essential part of our system."
"Once I started to use the system and I saw the potential, it changed all of our work in IT."
"Since we started working with Torq, I am handling much fewer alerts, it is becoming really easy for me to handle an alert, I have all the information that I need, I do not need to connect to different vendors to receive this information, and the main thing I got from Torq is time, which now helps me to build another automated system and learn."
"Torq's unified platform approach to AI, SOAR, automation, and case management is superior compared to my experience managing multiple point solutions."
"Any request that comes in, regardless of how complex it is, I can accomplish it with Torq."
"Torq has helped a lot regarding SOC analyst efficiency."
"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."
"I would say Blink Ops has probably the best technical support of all my vendors."
"I really appreciate the accuracy of prompt engineering and the GUI that Blink offers, as it allows us to evaluate before testing exactly how the workflow will look."
"I chose Cortex XSOAR because the client also has Palo Alto firewalls. I can incorporate the data from the Palo Alto firewalls into Cortex and send it into the same data lake to manipulate that data. It lets me manage and monitor the data in one place."
"What I like most about Palo Alto Networks Cortex XSOAR is how user-friendly it is for development. It is much simpler to work with compared to similar tools I've used."
"The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily."
"For organizations that are stable with their security operations, like those with around 50 members in their security team running full-phased operations 24/7, Cortex is necessary."
"It was useful as a ticketing tool."
"Palo Alto is easy to use."
"The set of playbooks that XSOAR already has inside it is really huge, and it is also great for a lot of informational security managers and engineers that can just choose what they need and not have to create anything from scratch."
"What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali."
 

Cons

"Regarding the pricing of Torq, I would say it is expensive."
"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."
"Additionally, the documentation for Torq is not very clear. Most of the information is presented in videos, which are not ideal for reading; there are mostly paragraphs and other text-based content."
"The initial deployment of Torq was not easy."
"We have MCP that we are working with our cloud security platform, and we wanted to connect this MCP to the case management."
"The initial deployment of Torq was not easy."
"Even now, we have workflows that are in production that use AI steps and I get different results, making it unusable to some degree."
"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."
"At the moment, nothing else comes to my mind because I would say Blink Ops is a comprehensive platform and sometimes I feel people are overwhelmed."
"The current LLM in Blink is quite accurate, but it still requires a lot of optimization because after a few prompts, it starts creating random responses, which sometimes is problematic."
"The user interface (UI) is quite heavy and takes time to load, which is a major drawback."
"The solution requires DV but does not support open-source DV elastic searches."
"In terms of improvement, it needs to be more modular. It's not. When you're working in layouts and you create specific apps within layouts, there's no portability right now in order to reuse that code across multiple layouts. I can't take a tab and say I want to use this tab on these other layouts. I have to physically go in there and recreate it from scratch, which is maddening."
"It's only one cloud right now. It might be helpful for some companies to have an on-premies option."
"The integration could be better. Cortex, for example, does not work with iPhone."
"It is not a very scalable solution."
"The platform’s setup procedures could be streamlined compared to one of its competitors."
"Palo Alto Networks Cortex XSOAR could improve the Panorama feature. We had to turn it off because it was not working properly."
 

Pricing and Cost Advice

Information not available
Information not available
"The solution's cost is reasonable."
"When I first looked at Demisto, it had a price tag of $250,000 but when we finally purchased it, it was $345,000."
"Palo Alto offers significant discounts to customers who purchase the products repeatedly."
"The solution's cost is high."
"The pricing is fair. The pricing reflects the value and feature set it offers."
"The price of Palo Alto Networks Cortex XSOAR could be reduced. We are always looking for a discount. There is an annual license needed to use this solution."
"There is a yearly license required for this solution and it is expensive."
"It's cheaper compared to its competitors."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
893,438 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Comms Service Provider
10%
Construction Company
10%
Manufacturing Company
9%
Manufacturing Company
18%
Financial Services Firm
10%
Insurance Company
8%
Comms Service Provider
8%
Financial Services Firm
13%
Computer Software Company
10%
Manufacturing Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business1
Midsize Enterprise3
Large Enterprise4
No data available
By reviewers
Company SizeCount
Small Business21
Midsize Enterprise9
Large Enterprise26
 

Questions from the Community

What needs improvement with Torq?
This is exactly what we discussed two days ago with the Torq team. We told them where we want to see improvements. Fo...
What is your primary use case for Torq?
I use Torq as my case management and alert system. Working as a SOC analyst, the first thing I do every morning is ge...
What advice do you have for others considering Torq?
I would definitely recommend Torq. I have no doubt, really. When we looked for another vendor, Torq really answered a...
What needs improvement with Blink Ops?
At the moment, I have no idea what an improvement can be because my feeling is Blink Ops can be deployed on-site in a...
What is your primary use case for Blink Ops?
I have several use cases rather than a single one. When we start engagements, it is often for the SOC team on the SOA...
What advice do you have for others considering Blink Ops?
I would say also on automation, there is a need to have the least privilege or a zero trust approach because the agen...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is ze...
What needs improvement with Palo Alto Networks Cortex XSOAR?
Regarding areas for improvement in Palo Alto Networks Cortex XSOAR, I want to highlight one concern about playbook cr...
What is your primary use case for Palo Alto Networks Cortex XSOAR?
My primary use cases for Palo Alto Networks Cortex XSOAR are malware incidents, specifically phishing-related inciden...
 

Also Known As

No data available
No data available
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Blink Ops vs. Palo Alto Networks Cortex XSOAR and other solutions. Updated: April 2026.
893,438 professionals have used our research since 2012.