No more typing reviews! Try our Samantha, our new voice AI agent.

Check Point Harmony Endpoint vs Rapid7 InsightIDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 1, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
112
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (4th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Check Point Harmony Endpoint
Ranking in Endpoint Detection and Response (EDR)
7th
Average Rating
8.8
Reviews Sentiment
7.3
Number of Reviews
202
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Anti-Malware Tools (3rd)
Rapid7 InsightIDR
Ranking in Endpoint Detection and Response (EDR)
47th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
32
Ranking in other categories
Security Information and Event Management (SIEM) (25th), User Entity Behavior Analytics (UEBA) (12th), Threat Deception Platforms (6th), Extended Detection and Response (XDR) (28th)
 

Mindshare comparison

As of June 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.5%, down from 4.0% compared to the previous year. The mindshare of Check Point Harmony Endpoint is 2.1%, down from 2.6% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.2%, up from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.5%
Check Point Harmony Endpoint2.1%
Rapid7 InsightIDR1.2%
Other93.2%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
GR
Support at a security firm with 51-200 employees
Remote Access Security Reinforced with Real-Time Device Protection
Dashboard customization is needed for improvements. While the centralized management is strong, the dashboard could offer more flexibility. It would be helpful to tailor views for different roles, such as IT or security support. Regarding needed improvements, custom report building could be enhanced. Current reports are informative, and a drag-and-drop builder would allow teams to create tailored views for compliance, executive summaries, or operational metrics. For further improvements, enhancing threat simulation and testing would be valuable. Building a threat simulation tool and adding native capabilities to simulate phishing, malware, or ransomware scenarios will help teams validate protection and train users without relying on third-party tools.
SohailHyder - PeerSpot reviewer
Head Of Cyber Security at Super Secure
Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration
If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The initial setup isn't too bad."
"It is an easy-to-use tool."
"We think that this product will help us grow, as it meets our needs currently and we can grow with it over time."
"These days it's machine-learning technology and behavior-based analytics features that make us more secure."
"The product is very good, it has caught a lot of exploits that most products would not."
"The most valuable features are incident creation, policy-based protection, IP whitelisting, and device encryption. These are beneficial for endpoint and server security."
"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"The policy configuration is great, the granularity of policies that are available is very helpful, it is straightforward to set up, and it has pretty much everything we need and works well within the Palo Alto ecosystem."
"The biggest value we found was ease of deployment. I haven't really used it much, so I can't really comment beyond that. I haven't used it much, but it's working."
"Its stability during any heavy performance activity is excellent."
"Check Point Harmony Endpoint's best feature is SandBlast Zero-Day Protection because it uses advanced sandboxing and threat emulation to stop unknown threats before they execute, which is especially effective against ransomware and targeted attacks."
"It is minimally invasive. From a single installer, the equipment is protected and secured."
"In terms of network usage, it actually reduced the amount of malicious attacks that we had. Before, we really didn't have a secure network. Each endpoint had to protect itself and probably most of them were not actually protected. Now, it's an entire process in which we've been able to cut down significantly the amount of malicious attacks by 60 percent that we get in the organization. It helps us to adequately monitor what has been going on with our network traffic and stopping individual attacks from accessing certain sites where we want to have restrictions or limitations."
"Harmony is better than Crowd Strike or any other similar solution in that class."
"With Check Point, we can implement security measures to control access to the network and systems, which helps prevent unauthorized access."
"The best features Check Point Harmony Endpoint offers are its comprehensive and proactive approach; these features stand out because it's very lightweight and has very good anti-ransomware protection."
"The alerting to drive investigations and remediation has been its most valuable feature, plus the ability to quickly search multiple logs makes investigations easier."
"I definitely recommend Rapid7 InsightIDR."
"Dashboards, including the main screen, provide much-needed information at a glance, without hours of coding and sifting through logs to find it. In case of an actual security incident, I have faith that insightIDR has retained all logs in a secure manner that prevents log tampering as well."
"I have seen that Rapid7 InsightIDR provides security to the networks and endpoints in the company."
"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."
"Log search allows us to dive deep into aggregated logs and query all event types at once.​"
"The solution is very cost-effective because they are not charging based on the EPS but on the number of assets."
"InsightIDR’s ability to process millions of transactions per day, and to notify me of the most critical ones, is priceless. InsightIDR has the alerts tuned, and has the ability to quickly drill down to determine the threat level."
 

Cons

"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."
"The setup is quite easy. We had appropriate support from the manager. One thing that was missing was the integration part."
"If he is using a smaller company, he can depend on some other tools because Cortex XDR by Palo Alto Networks is a bit expensive."
"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis."
"There are some default policies which sometimes affect our applications and cause them to run around."
"The product's pricing could be better."
"Product might have some bugs."
"I would like to see some additional features related to email protection included."
"That said, it is important to integrate other solutions to continue innovating in the market."
"Check Point Harmony Endpoint poses a steep learning curve and has high resource consumption, requiring high-performance PCs on our endpoint site."
"We'd like to see a friendlier user interface."
"The network monitoring features must be improved."
"SandBlast Agent had moments in which it had a high load, we escalated it to the CheckPoint support that helped us to stabilize it. We had a problem with the parameterization of the solution. Once corrected by following the CheckPoint instructions, everything worked normally again."
"I'd also love to see them add full MDM support, but I appreciate that that's not the product market. If it did come in, I'd be more than happy to look at additional modules. It was probably one of the easiest products I've ever had to deploy it, but if it's not capable of doing MD, then that's going to impact its usefulness to us."
"I would like to see is this same solution being able to link with the services of different corporate networks as if they were a remote access VPN extension and thus not require additional licenses."
"Check Point services and antivirus solutions can improve their customer offerings by offering various discounts in their subscription model and they can also reconsider their pricing model as well."
"Inability to get access to compliance reports within the solution."
"Tenable Nessus is easier to deal with. It's more efficient and accurate. InsightIDR is heavier than Tenable in terms of performance and scanning. Rapid7 would be much easier to use if it had a network connector like Tenable. Tenable's connector allows continuous monitoring over the B caps."
"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."
"If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is."
"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."
"There is a future in AI with Rapid7, however, it is not fully operated. There are certain limitations with Rapid7 that I am working on."
"The dashboard is an area that could be simplified. For management, it should be clear and the files should be there."
"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."
 

Pricing and Cost Advice

"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"Its pricing is kind of in line with its competitors and everybody else out there."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"Cortex XDR's pricing is ok."
"Our customers have expressed that the price is high."
"Very costly product."
"The pricing is very expensive. You need to buy the appliance and subscription as well."
"I rate the solution's pricing a five out of ten. It costs around ₱2,200 per endpoint."
"We pay on an annual basis. There are no additional fees, they mostly tell us what we have to pay. We have budgeted for it."
"Check Point Antivirus is a good solution, but it's a little costly."
"We pay roughly 80,000 Swedish krona per year. When it comes to the firewall, it's roughly 150,000 Swedish krona yearly. There's also maintenance, of course, which is roughly 10,000 krona per month."
"The price of Check Point Harmony Endpoint is comparable to SonicWall. The price could be a bit lower."
"The price is good."
"In comparison to other software solutions available on the market, it comes at a higher price point."
"It is a reasonably priced solution."
"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."
"The pricing and licensing are competitive."
"It is more reasonably priced than other vendors."
"The team is very willing to work with companies. My suggestion is to call the Rapid7 sales department and see how they can help.​"
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
"​I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability.​"
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
900,838 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
9%
Construction Company
11%
Outsourcing Company
9%
Financial Services Firm
9%
Computer Software Company
8%
Manufacturing Company
9%
Financial Services Firm
9%
Computer Software Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise52
By reviewers
Company SizeCount
Small Business136
Midsize Enterprise66
Large Enterprise76
By reviewers
Company SizeCount
Small Business21
Midsize Enterprise5
Large Enterprise6
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Check Point Harmony Endpoint?
My experience with pricing indicates that the costs have increased compared to last year. Previously, Check Point Har...
What needs improvement with Check Point Harmony Endpoint?
Check Point Harmony Endpoint works well overall, but one area I would like to see improved is the reporting and dashb...
What is your primary use case for Check Point Harmony Endpoint?
Check Point Harmony Endpoint helps to secure our devices as my main use case for this product. When users need to acc...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...
What needs improvement with Rapid7 InsightIDR?
If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as ...
What is your primary use case for Rapid7 InsightIDR?
I am working with Rapid7 InsightOps and Rapid7 InsightIDR because the requirement is as such from the customer side, ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Check Point Endpoint Security, Endpoint Security, Check Point SandBlast Agent, Check Point Antivirus
InsightIDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Boston Properties, Independence Care System, Melbourne Convention and Exhibition Centre (MCEC), Courtagen Life Sciences, Carmel Partners
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Check Point Harmony Endpoint vs. Rapid7 InsightIDR and other solutions. Updated: June 2026.
900,838 professionals have used our research since 2012.