No more typing reviews! Try our Samantha, our new voice AI agent.

Coro vs SentinelOne Singularity Endpoint comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 9, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Ranking in Endpoint Detection and Response (EDR)
7th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
109
Ranking in other categories
Extended Detection and Response (XDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Coro
Ranking in Endpoint Protection Platform (EPP)
50th
Ranking in Endpoint Detection and Response (EDR)
60th
Average Rating
0.0
Reviews Sentiment
3.1
Number of Reviews
1
Ranking in other categories
Email Security (47th), Data Loss Prevention (DLP) (67th)
SentinelOne Singularity End...
Ranking in Endpoint Protection Platform (EPP)
3rd
Ranking in Endpoint Detection and Response (EDR)
2nd
Average Rating
8.8
Reviews Sentiment
7.2
Number of Reviews
227
Ranking in other categories
Anti-Malware Tools (2nd), Extended Detection and Response (XDR) (2nd), AI Observability (4th)
 

Mindshare comparison

As of April 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 3.9% compared to the previous year. The mindshare of Coro is 0.7%, up from 0.5% compared to the previous year. The mindshare of SentinelOne Singularity Endpoint is 5.0%, down from 5.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
SentinelOne Singularity Complete5.0%
Cortex XDR by Palo Alto Networks3.4%
Coro0.7%
Other90.9%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Vignesh  K - PeerSpot reviewer
Practice Engineer at Cloudunicorn.in
Auto scanning and enhanced security but re-adding protections need improvement
At that time, we observed certain issues with the product. The functionalities could be improved, such as the isolation feature. If we remove our protection, we cannot easily add it back. If, in our organization, we need to remove a specific system for a particular time, we cannot add it back for security after doing so. This is one thing we have experienced. Scalability is also lacking. If we want to do the same thing repeatedly, there's not much the solution offers; it isn't very strong.
Vaibhav Mahendra Kolhe - PeerSpot reviewer
Soc Analyst at Softcell Technologies Limited
Automation has reduced alerts and freed the soc team to focus on faster incident response
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution helps find bugs, and it is safe to use to prevent attacks by hackers."
"If any application performs suspicious activities, such as changing registries or modifying other applications, Cortex XDR detects and blocks the entire application."
"Cortex XDR's most valuable feature is its intelligence-based dashboards."
"Its ability to react to cyber data attacks is awesome. That is pretty much the use of it. What blows your mind is the ability to access your assets remotely and see what is actually going on with them. You can not only see them in a console. You can also react very rapidly to your assets that are compromised."
"Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
"Palo Alto is the core of the security infrastructure in the environment."
"One of the things that I enjoy the most is using policy extensions. It's like having host firewalls to control USB connections. I think it's a wonderful tool to restrict use when connecting to our computers. Another important tool is Home Insights. That is an add-on to the Cortex solution. I like that because we can see all the vulnerabilities in the environment and control what assets are connected to our network."
"The multi-layered approach to the product gives you confidence that it will stop exploits, ransomware, worms, or viruses from compromising endpoints, essentially providing peace of mind."
"The auto-scanning feature is quite beneficial."
"The auto-scanning feature is quite beneficial."
"The remediation and rollback features are pretty impressive."
"I have tried some paid tools, but I have found that Singularity Platform is far better than others, and as a log analyst and SOC analyst, I find it better than others."
"The reporting part is awesome."
"At the moment, we have a lot of trust in SentinelOne."
"SentinelOne Singularity Complete reduces my mean time to respond and protects my environment, thereby reducing the workload of my engineers and security analysts by at least thirty-five percent."
"It's quite scalable."
"However, this solution is very good at detecting abnormal behavior, they act very fast and quarantine machines well, and we find that having an endpoint protection solution allows us to adapt and react faster."
"Our clients have been able to survive a ransomware attack without even knowing that they had had files encrypted and automatically rolled back - even their Point of Sale (POS) system did not miss a beat and the business continued as normal without interruption."
 

Cons

"Cortex XDR is trickier to configure than other Palo Alto products. This is one area where we are not so satisfied."
"The solution could improve by providing better integration with their own products and others."
"The connection to the internet has not performed as expected."
"Cortex XDR by Palo Alto Networks can improve mobile integration to allow access to the console."
"The product's pricing needs improvement. They could provide more discounts. Additionally, the dashboard and control panel could be enhanced."
"The product's pricing could be better."
"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control."
"The solution should enhance the ADR and reporting."
"The functionalities could be improved, such as the isolation feature."
"Scalability is lacking. If we want to do the same thing repeatedly, there's not much the solution offers; it isn't very strong."
"When SentinelOne Singularity Complete is used as the central hub for viewing alerts from all integrated security solutions, it is challenging to identify the specific solution that triggered each alert."
"The delay in updating inventory is ten minutes. If it can be improved, it will help a lot."
"All they need to do to improve it is for it to grow further. The hackers don't sleep. If the hackers don't sleep, the solution continually needs to be updated. They need to keep ahead of the hackers."
"In terms of improvement, the documentation could be better. I would also like to see SingularityOne compatibility with Huntress, and the tighter integration between them would bring more to the table."
"While SentinelOne Singularity Complete effectively visualizes security data across our solutions, requiring extensive manual effort for analysis limits its effectiveness. I would therefore rate it a seven out of ten."
"I don't like switching the way you switch from legacy to XDR."
"SentinelOne could improve by reducing the price."
"I've had some issues with the specific agents, however, we are moving off of that particular OS that we were having issues with. Other than that, it's been a pretty solid tool."
 

Pricing and Cost Advice

"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"It's about $55 per license on a yearly basis."
"The price of the product is not very economical."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"I am using the Community edition."
"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
Information not available
"The license is paid annually and is competitive."
"SentinelOne is more affordable than some competing products, and it's not overly expensive for what you're getting."
"I believe that the current pricing and licensing structure is fair."
"SentinelOne is significantly less expensive than CrowdStrike. I recently did a price comparison between CrowdStrike and SentinelOne to determine where we are going for the next three years. CrowdStrike is 200% to 300% the cost."
"It is very competitive with other solutions that are on the market. At least the last time we renewed, it was very competitive."
"From what I understand, it is pricey, but it works. It is a very good product."
"The one I use is $6 a month per device. Some are $4 and there are some that are more than that."
"The price is costly compared to what we were previously paying with Microsoft Defender and McAfee."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
886,174 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
13%
Manufacturing Company
7%
Comms Service Provider
7%
Construction Company
11%
Computer Software Company
9%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
11%
Manufacturing Company
8%
Financial Services Firm
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise48
No data available
By reviewers
Company SizeCount
Small Business104
Midsize Enterprise51
Large Enterprise79
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Coro?
The cost is reasonable because it is aimed at SMB customers, not enterprise customers. The prices are reasonable. We ...
What needs improvement with Coro?
At that time, we observed certain issues with the product. The functionalities could be improved, such as the isolati...
What is your primary use case for Coro?
We have not sold the product to any customers as of now. We are still in the testing phase, which means we, along wit...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for SentinelOne Singularity?
It is neither too costly, but definitely, it is one of the advantages that SentinelOne is quite adapted towards the p...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
Sentinel Labs, SentinelOne Singularity, Singularity Platform
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Lenovo, Dropbox, T-Systems
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: March 2026.
886,174 professionals have used our research since 2012.