Try our new research platform with insights from 80,000+ expert users

Cisco XDR vs ExtraHop Reveal(x) 360 comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
108
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Endpoint Detection and Response (EDR) (7th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Cisco XDR
Ranking in Extended Detection and Response (XDR)
14th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
13
Ranking in other categories
No ranking in other categories
ExtraHop Reveal(x) 360
Ranking in Extended Detection and Response (XDR)
39th
Average Rating
8.6
Reviews Sentiment
6.9
Number of Reviews
3
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (24th), Container Security (49th), Network Traffic Analysis (NTA) (13th)
 

Mindshare comparison

As of March 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.9%, down from 5.6% compared to the previous year. The mindshare of Cisco XDR is 1.8%, up from 1.2% compared to the previous year. The mindshare of ExtraHop Reveal(x) 360 is 0.9%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.9%
Cisco XDR1.8%
ExtraHop Reveal(x) 3600.9%
Other92.4%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Pranav Salian - PeerSpot reviewer
Head of Business Operations at SISA
Unified threat detection has strengthened visibility and reduced response time across all environments
Cisco XDR offers a wide range of integrations and connectors where we can integrate a whole range of devices available in our on-premises environment as well as cloud sources which we have primarily on AWS and Azure. Those environment log sources are integrated with Cisco XDR and it helps provide a single pane of glass view in terms of our security posture, giving us visibility within a single platform rather than focusing on individual security devices such as firewalls or EDRs which would typically be working in silos. These integrations are straightforward. Cloud workloads are easier to integrate compared to on-premises devices, primarily because the cloud workloads have readymade connectors and integration standard operating procedures for us to integrate with Cisco XDR. We have typically not faced challenges with integrations with Cisco XDR. There may be certain OEMs which are not well known and cannot be directly integrated without the help of vendor support or OEM support, which we were able to connect with and ensure they are integrated with Cisco XDR. From the reporting perspective, the dashboards offer quite a lot of predefined and useful options which help with live threat monitoring and provide a high-level view of the current threats, incident reporting metrics, mean time to detect, and mean time to respond. These sorts of dashboards are available on the platform and help provide a good view even for someone at the leadership level. Cisco XDR has definitely improved our security posture and our visualization, ensuring that we are protected and providing greater visibility for our SOC team. Cisco XDR has definitely reduced our mean time to respond. Previously it used to be more than 24 hours, but we have been able to reduce it to less than 16 hours due to all the various integrations and automation capabilities. Cisco XDR has been useful for us to gain visibility into gaps in our security posture and how those can be improved by conducting analysis on the platform itself. We have utilized the platform to improve our security posture and reduce blind spots.
Maksym Toporkov - PeerSpot reviewer
Head of Research And Development at Quipu GmbH
A competitive choice for network detection and response with exceptional user interface, ease of implementation and minimal false positives
The NDR feature analyzes network traffic, creating records with connection details. While these records offer insights, there's a limitation in investigating payloads directly. ExtraHop provides an option for an additional server to save payloads, but its temporary storage has constraints. Unlike some competitors, it lacks an automatic payload-saving feature for each detection, presenting an improvement opportunity. Suggested enhancement involves the main sensor prompting payload storage for specific detections, streamlining the investigation process, and contributing to a more efficient workflow. A drawback includes packet storage limitations for payload data, necessitating timely extraction for thorough investigations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"The dashboard is customizable."
"It is an easy-to-use tool."
"Threat identification and detection are the most valuable features of this solution."
"Cortex XDR's most valuable feature is its intelligence-based dashboards."
"It can automatically correlate events and logs, which is very helpful for an IT administrator. It can correlate different kinds of malware activities over a network, agent, or host system. You do not need to do it manually. It is a good feature. It is also a user-friendly solution. We have deployed it on the cloud because our space does not provide any flexibility for on-premises deployment, but Palo Alto has added some flexibility to install it on-premises. It must be like the same Cortex XDR agent for all the VPN services, web filtering services, and everything else."
"The integrations are out-of-the-box, as are the playbooks."
"But overall, when we speak about security and protection, they are one of the top providers."
"Before using Cisco XDR, I sometimes did not detect malicious activities in my client's environment, but since implementing this solution, my mean time to detect has reduced and my mean time to respond has fallen within the acceptable threshold, positively impacting my organization as I can detect and respond to threats in time."
"Cisco XDR offers threat intelligence and links with the Firewall."
"I appreciate the granularity of what I get from Cisco XDR the most."
"Cisco XDR is one of the most matured systems available."
"The feature I appreciate the most about Cisco XDR is the reliability."
"Cisco XDR offers threat intelligence and links with the Firewall."
"Technical support from Cisco is good and very helpful."
"Cisco XDR is built primarily for enterprise endpoint security, integrated onto endpoints with logs integrated into SIEM, and it is used for security investigations, malware impact investigation, and tracking particular security incidents through integration of different logs, where endpoint logs are very important, providing detail about processes run by potential malware and any call-outs made to command and control."
"It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic. It is also easy to handle and easy to understand."
"It is scalable."
"Their technical support is more effective and of better quality than other competitors."
"It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management."
 

Cons

"Cortex XDR by Palo Alto Networks could improve by offering remote management. It would be useful to look at the client's issue to fix it."
"It is a complex solution to implement."
"Dashboards do not allow everyone to see what's happening."
"Cortex XDR could improve its sales support team, including better commission structures and referral programs."
"It would be good to have a better way to search for a file within the UI."
"One thing that was missing was the integration part. Currently, they don't have out-of-box integration with IBM QRadar, or if they have the integration, the integration doesn't work well."
"If they had pulse rate detection, it would be better."
"There are some default policies which sometimes affect our applications and cause them to run around."
"Regarding the pricing aspect of Cisco XDR, I think the price is a bit expensive."
"When we first started with Cisco XDR in August, everybody was having issues. There were three people in our organization, including me, who couldn't even log in to Cisco XDR."
"My only complaint about Cisco XDR is related to licensing, which is complicated."
"Cisco XDR can be improved in terms of out-of-the-box integrations and standard operating procedures available on the platform where we would not have to refer to documents outside of the platform to integrate."
"I would say I got to stop beta testing myself."
"Cisco XDR can be improved by addressing the upfront cost. Everything matters for us since we're small, mom and pop, so every dollar counts."
"If we have a list of domains we need to block, such as 4,000 domains, I can only block 100 domains at a time because if I put in more than 100 domains, I hit that 2,000 character max and can't continue with an investigation. Being able to put in all 4,000 domains, without a character limit or observable limit, would make doing those case books a whole lot easier and blocking those domains a whole lot easier too."
"Cisco XDR can be improved by addressing the upfront cost."
"They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers."
"A drawback includes bucket storage limitations for payload data, necessitating timely extraction for thorough investigations."
"Their professional service can be improved."
"There needs to be more support."
 

Pricing and Cost Advice

"The price of the product is not very economical."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"The solution is expensive. It's pricing is on a yearly-basis."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"I feel it is fairly priced."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"The price is on the higher side, but it's okay."
"It has reasonable pricing for the use cases it provides to the company."
"The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated."
"When compared to other solutions, it aligns with the market average, indicating a competitive pricing level."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
884,976 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
9%
Manufacturing Company
9%
Financial Services Firm
9%
Comms Service Provider
7%
Computer Software Company
12%
Government
11%
Manufacturing Company
9%
Comms Service Provider
6%
Financial Services Firm
10%
Comms Service Provider
9%
Government
9%
Computer Software Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise47
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise6
Large Enterprise3
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Cisco XDR?
In terms of licensing and support cost, it is quite seamless. Based on the number of users we require, we have purcha...
What needs improvement with Cisco XDR?
Cisco XDR can be improved in terms of out-of-the-box integrations and standard operating procedures available on the ...
What is your primary use case for Cisco XDR?
Cisco XDR serves as the main platform for threat detection and threat response in my organization. We have integrated...
Ask a question
Earn 20 points
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
ExtraHop Reveal(X) Cloud, Reveal(X) Cloud
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Wizards of the Coast
Find out what your peers are saying about Cisco XDR vs. ExtraHop Reveal(x) 360 and other solutions. Updated: February 2026.
884,976 professionals have used our research since 2012.