No more typing reviews! Try our Samantha, our new voice AI agent.

Cisco XDR vs ReliaQuest GreyMatter comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
115
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cisco XDR
Ranking in Extended Detection and Response (XDR)
9th
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
21
Ranking in other categories
No ranking in other categories
ReliaQuest GreyMatter
Ranking in Extended Detection and Response (XDR)
25th
Average Rating
9.6
Reviews Sentiment
8.1
Number of Reviews
2
Ranking in other categories
Digital Risk Protection (11th), Managed Detection and Response (MDR) (17th)
 

Mindshare comparison

As of August 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.5%, down from 5.0% compared to the previous year. The mindshare of Cisco XDR is 1.5%, down from 1.7% compared to the previous year. The mindshare of ReliaQuest GreyMatter is 0.9%, up from 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.5%
Cisco XDR1.5%
ReliaQuest GreyMatter0.9%
Other93.1%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Fred Parks - PeerSpot reviewer
Senior Systems Consultant at W.C. Bradley Co.
Centralized visibility has transformed incident investigations and now cuts response time dramatically
Workflows could definitely be easier to work with. Workflows are automated tasks that can be kicked off inside of a playbook. When someone is responding to something, they can click a button and it will perform automated tasks for them inside of these other products. The product can actually control the behavior of a firewall and you can write a rule in a firewall from Cisco XDR without having to go into the firewall software. However, if it is not a native workflow automation, it is very difficult to create your own. It is not intuitive and you almost have to be a developer and get really good with the API. This could definitely be improved on, particularly the custom workflow automation. Another thing that could be improved is Cisco documenting how it makes decisions, because there are certain factors or criteria that it uses from the source products. Cisco XDR gets all of its data from the integrations, so if you do not integrate anything, it is not going to do anything. Sometimes in these integration products, such as Secure Network Analytics or Cisco Security Exposure, they could be generating some type of alert and you do not necessarily see that in Cisco XDR. This is because it knows, maybe because of these other products, it is not really a big deal and is not big enough to raise an incident. However, I do not think Cisco does a great job in explaining what those rules are, such as why this happens and how this happens. This can cause some questions and some concern. I think it is doing the right thing, but I think it would be better if they had a rule set to say, based on this data, this is how the product actually works.
MK
Senior Security Analyst at Tata Consultancy
Unified security monitoring has reduced alert fatigue and improves proactive threat hunting
I use real-time monitoring in ReliaQuest GreyMatter, which significantly improves my security posture. The unified interface helps reduce alert fatigue. I would estimate it saves around 20% in alert fatigue reduction. The automated threat hunting capabilities in ReliaQuest GreyMatter help me stay ahead of threats. The machine learning algorithm benefits my threat intelligence by providing deeper insights and predictions. I use various metrics to rate the success of the predictive threat intelligence in ReliaQuest GreyMatter.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."
"The product's initial setup phase is very easy."
"I've found the solution to be highly scalable for enterprises."
"Cortex XDR can integrate the firewalls and determine the tendencies of the attacks. It's a new generation antivirus, with protection endpoints and detection response. It is very easy to use and everybody can operate the solution."
"I generally believe that Cortex XDR by Palo Alto Networks is probably the best in the market right now."
"We use it for malicious connections from malicious websites, to identify payloads that might be inside the traffic, to identify malicious processes or bugs that are running on the network, and any activities that tend to lead to data infiltration."
"The protection offered by this product is good, as is the endpoint reporting."
"Cisco XDR helps to detect the threats in my organization, prioritizes the most critical incidents, and responds to them faster as well."
"The merging of all of that data into one display is probably the best benefit of Cisco XDR."
"Technical support from Cisco is good and very helpful."
"I appreciate the granularity of what I get from Cisco XDR the most."
"The feature I appreciate the most about Cisco XDR is the reliability."
"Cisco XDR has positively impacted our organization by providing faster detection of complex threats, reducing alert fatigue, and giving us better visibility."
"Cisco XDR offers threat intelligence and links with the Firewall."
"Cisco XDR is one of the most matured systems available."
"ReliaQuest GreyMatter saves around 60% of time or resources."
"ReliaQuest GreyMatter has helped us to reduce security incidents by 89%, which is a significant amount of incidents we have seen."
 

Cons

"It'll help if customization was easier."
"Enhancing UI simplicity and playbook flexibility are areas that could benefit from more low-code automation options for smoother integrations."
"I recommend adding a data loss prevention (DLP) solution to Cortex XDR by Palo Alto Networks. The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products."
"Dashboards do not allow everyone to see what's happening."
"We would also like to have advanced tech protection and email scanning."
"They've been having some issues with updating their endpoint agents, and it has been quite frustrating."
"Impact on system performance is horrible, adding a lot of delays for users."
"When it comes to malware files, it should be a little quick because, at times, it would give a wrong result in the sense of what it might be on malware, even if it still might be a normal one."
"Regarding the pricing aspect of Cisco XDR, I think the price is a bit expensive."
"One area where Cisco XDR could improve is the learning curve for new users, especially during initial setup and workflow customization."
"While Cisco XDR is robust, it could benefit from improvements on the AI side."
"If we have a list of domains we need to block, such as 4,000 domains, I can only block 100 domains at a time because if I put in more than 100 domains, I hit that 2,000 character max and can't continue with an investigation. Being able to put in all 4,000 domains, without a character limit or observable limit, would make doing those case books a whole lot easier and blocking those domains a whole lot easier too."
"The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated."
"They need to provide better pricing and bundle XDR licenses with products like Meraki solutions or Firepower Threat Defense."
"Workflows could definitely be easier to work with."
"Improvements in Cisco XDR revolve around performance."
"Areas that have room for improvement include user interface and integration."
 

Pricing and Cost Advice

"The pricing is a little bit on the expensive side."
"This is an expensive solution."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"I am using the Community edition."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"Our customers have expressed that the price is high."
"Its pricing is kind of in line with its competitors and everybody else out there."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
908,877 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
10%
Comms Service Provider
10%
Manufacturing Company
10%
Outsourcing Company
21%
Computer Software Company
9%
Government
8%
Manufacturing Company
7%
Financial Services Firm
10%
Manufacturing Company
9%
Construction Company
8%
Retailer
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise21
Large Enterprise54
By reviewers
Company SizeCount
Small Business17
Midsize Enterprise9
Large Enterprise4
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Cisco XDR?
The centralized visibility, automation, and reduction in investigation time have provided good operational value for ...
What needs improvement with Cisco XDR?
Cisco XDR could improve the UI customization experience. Some workflows still feel more complex than they need to be,...
What is your primary use case for Cisco XDR?
We mainly use Cisco XDR for centralized threat detection and incident investigation, especially for correlating endpo...
What needs improvement with ReliaQuest GreyMatter?
Areas that have room for improvement include user interface and integration.
What is your primary use case for ReliaQuest GreyMatter?
I use ReliaQuest GreyMatter for detection and response, XDR, and SIEM. The best features I like about GreyMatter the ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
No data available
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Information Not Available
Find out what your peers are saying about Cisco XDR vs. ReliaQuest GreyMatter and other solutions. Updated: June 2026.
908,877 professionals have used our research since 2012.