Cortex XDR by Palo Alto Networks vs Mandiant Advantage comparison

Palo Alto Networks and Google are both solutions in the Extended Detection and Response (XDR) category. Palo Alto Networks is ranked #6 with an average rating of 8.6, while Google is ranked #24 with an average rating of 8.0. Palo Alto Networks holds a 4.9% mindshare in XDR, compared to Google’s 1.3% mindshare. Additionally, 96% of Palo Alto Networks users are willing to recommend the solution, compared to 100% of Google users who would recommend it.

Cortex XDR by Palo Alto Net...

Read 110 Cortex XDR by Palo Alto Networks reviews

16,270 Views
6,508 Comparison Views

96% willing to recommend

Mandiant Advantage

Read 7 Mandiant Advantage reviews

3,015 Views
1,417 Comparison Views

100% willing to recommend

Cortex XDR by Palo Alto Net...

Mandiant Advantage

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 29, 2026

Cortex XDR by Palo Alto Networks and Mandiant Advantage are leading cybersecurity solutions in threat detection and response. Cortex XDR has the upper hand in analytics and integration capabilities, while Mandiant Advantage stands out with its robust intelligence-driven features.

Features: Cortex XDR provides comprehensive threat detection and response automation, integrating advanced analytics for security operations. Its multi-layered detection includes behavior and AI-driven analytics, offering deep integration with other network security tools. Mandiant Advantage shines with extensive threat intelligence, offering powerful investigative tools and rich data analysis to understand complex threats and attacks, making it suitable for comprehensive incident response.

Room for Improvement: Cortex XDR can enhance its pricing transparency and cost-effectiveness to address customer hesitations about the investment. Its policy configuration, though comprehensive, may benefit from simplification for smoother implementation. Increasing user education on feature usage could improve overall effectiveness. Mandiant Advantage could improve by simplifying setup processes and reducing integration complexity. Enhancing the user interface for easier navigation and interaction would be beneficial, and expanding support for smaller organizations might widen its appeal.

Ease of Deployment and Customer Service: Cortex XDR offers straightforward deployment, praised for its responsive and effective service support, making it user-friendly for quick setups. Mandiant Advantage, while providing extensive service support, faces challenges with intricate deployment requiring careful integration, which may lead to variable results.

Pricing and ROI: Cortex XDR involves high initial costs leading to concerns about pricing efficiency, yet it provides long-term ROI through improved security features. Meanwhile, Mandiant Advantage is considered a valuable investment despite higher upfront costs, aligning the expenditure with its extensive threat intelligence capabilities and enhanced return promises.

To learn more, read our detailed Cortex XDR by Palo Alto Networks vs. Mandiant Advantage Report (Updated: February 2026).

Buyer's Guide

Cortex XDR by Palo Alto Networks vs. Mandiant Advantage

February 2026

Download the complete report

Helped 889,855 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Ranking in Extended Detection and Response (XDR)

6th

Average Rating

8.4

Reviews Sentiment

6.8

Number of Reviews

110

Ranking in other categories

Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (7th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)

Mandiant Advantage

Ranking in Extended Detection and Response (XDR)

24th

Average Rating

8.4

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

Attack Surface Management (ASM) (9th)

Mindshare comparison

As of April 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.9%, down from 5.5% compared to the previous year. The mindshare of Mandiant Advantage is 1.3%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Extended Detection and Response (XDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	4.9%
Mandiant Advantage	1.3%
Other	93.8%

Extended Detection and Response (XDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Lior Fisherman

Head Of Cyber Threat Intelligence at Discount Bank

Brand threats have been monitored proactively and intelligence now drives daily security decisions

I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic. I would rate Mandiant Advantage an 8 out of 10. I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive. The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Traps is quite a stable product. Once it was properly deployed and configured, you have nothing to be worried about."

"WildFire AI is the best option for this product."

"If the user leaves our premises or network, Palo Alto Traps will still be on that endpoint and will still apply our policies."

"The most valuable features of this product are the management capabilities, which allow an IT organization to get quite a good picture of attempted cyber attacks, and its out-of-the-box investigation capabilities."

"We have a complete overview of all our PCs and it's very easy to handle and to use the interface. It has a lot of benefits for us."

"Stability is a primary factor, and then there's the ease of distribution and policy management."

"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."

"Cortex XDR's most valuable feature is its intelligence-based dashboards."

More Cortex XDR by Palo Alto Networks pros

"Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk, and the YARA rules I wrote within the platform help me understand better what my threat landscape is."

"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."

"The live IOC feed identifies the type, technique, and tactics used."

"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."

"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."

"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."

"I have never faced stability issues."

"The scalability of Mandiant Advantage deserves a ten out of ten."

Cons

"They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone."

"It is not easy to sell Cortex XDR, not because it isn't a good tool."

"The solution needs better reports. I think they should let the customer go in and customize the reports."

"It is not easy to sell Cortex XDR, not because it isn't a good tool. Its marketing needs to be improved."

"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis."

"In reporting they should have a customizable dashboard due to the fact that C-level people don't like reporting to the IT department. They prefer to have a real-time dashboard. That kind of dashboard needs to have various customizations."

"When it comes to core analysis and security analysis, Cortex needs to provide more information."

"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."

More Cortex XDR by Palo Alto Networks cons

"Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all."

"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."

"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."

"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."

"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."

"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."

"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."

Pricing and Cost Advice

"It has reasonable pricing for the use cases it provides to the company."

"The price is on the higher side, but it's okay."

"The pricing is a little bit on the expensive side."

"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."

"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."

"The price was fine."

"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."

"Cortex XDR by Palo Alto Networks is quite an expensive solution."

More Cortex XDR by Palo Alto Networks pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.

See recommendations

889,855 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

13%

Financial Services Firm

12%

Comms Service Provider

Manufacturing Company

Financial Services Firm

16%

Computer Software Company

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	45
Midsize Enterprise	20
Large Enterprise	48

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	2
Large Enterprise	2

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. The ability to reverse damage caused by ransomware with minimal interruptions to...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...

See all answers

What needs improvement with Mandiant Advantage?

I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, their platform should be better. Mandiant Advantage's platform itself is not good ye...

See all answers

What is your primary use case for Mandiant Advantage?

I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to tracking APT groups, cybercrime groups, and some other threat actors. I use it f...

See all answers

What advice do you have for others considering Mandiant Advantage?

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 8% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

CrowdStrike Falcon vs Mandiant Advantage

Compared 11% of the time

Recorded Future vs Mandiant Advantage

Compared 8% of the time

Microsoft Defender XDR vs Mandiant Advantage

Compared 6% of the time

Group-IB Threat Intelligence vs Mandiant Advantage

Compared 5% of the time

FortiXDR vs Mandiant Advantage

Compared 4% of the time

More Mandiant Advantage Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

April 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Mandiant Advantage

April 2026

Download Mandiant Advantage product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

Mandiant Threat Intelligence

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Mandiant Advantage is a multi-vendor XDR platform that provides security teams of all sizes with frontline intelligence. Mandiant Advantage aims to speed up operational as well as strategic security and risk decision making. Mandiant Advantage provides security teams with an early knowledge advantage through the Mandiant Intel Grid, which provides platform modules with current and relevant threat data and analysis capabilities. Organizations are better protected from cyber attacks and more confident in their readiness when they have access to continuous security validation, detection, and response.

Mandiant Advantage Features

Mandiant Advantage has many valuable key features. Some of the most useful ones include:

Threat intelligence: Front-line intelligence that enables a defender to be aware of the strategies and tactics that opponents are employing at this moment. Organizations will be able to contextualize, prioritize, and implement the most pertinent new intelligence by fusing ASM and threat intelligence.

Security validation: This allows security teams to optimize, rationalize, and prioritize their security activities from a budget and manpower viewpoint. It measures the effectiveness of security controls applied within an organization. Controls can be evaluated against the most recent TTPs actively used by threat actors by incorporating information into the security validation procedure. Organizations can determine whether their security policies are successfully thwarting or detecting attacks against their external attack surface by integrating ASM and security validation.

Automated Defense: In order to fuel SOC event/alert correlation and triage, Automated Defense combines knowledge and intelligence with machine learning. This is similar to integrating a machine-based Mandiant analyst into your security program. By merging ASM and Automated Defense, more context is given to Automated Defense, enhancing the relevance and usefulness of alarms.

Attack surface management: ASM offers a continuous, scalable method for locating hundreds of different asset and exposure types within on-premises, cloud, and SaaS application environments. In addition to assets being found, technologies in use are also identified, and vulnerabilities are confirmed rather than just speculated. Cyber defenders are able to effectively and efficiently limit their external exposures by integrating the full Mandiant Advantage suite into ASM, which prioritizes and validates the information regarding the attack surface.

Mandiant Advantage Benefits

There are many benefits to implementing Mandiant Advantage. Some of the biggest advantages the solution offers include:

Boost your current security investments: No matter what security policies you have implemented, you may improve your security capabilities by automating Mandiant's expertise as a virtual extension of your team.

Improve your visibility and priority: View the threats Mandiant is continuously monitoring across your attack surface and internal controls in order to prioritize and drive focus.

Flexible deployment: Depending on your needs, Mandiant Advantage can be supplied as technology, along with support, or as a fully managed contract.

Scale efficiently: Without the need for time-consuming and expensive human labor, a SaaS-based strategy deploys in hours, scales with your environment, and provides constant expert analysis.

Google

Sample Customers

CBI Health Group, University Honda, VakifBank

Stater Bros. Markets, Rush Copley, Blackboat, CapWealth

Buyer's Guide

Cortex XDR by Palo Alto Networks vs. Mandiant Advantage

February 2026

Free Report: Cortex XDR by Palo Alto Networks vs. Mandiant Advantage

Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. Mandiant Advantage and other solutions. Updated: February 2026.

DOWNLOAD NOW

889,855 professionals have used our research since 2012.

See our Cortex XDR by Palo Alto Networks vs. Mandiant Advantage report.

See our list of best Extended Detection and Response (XDR) vendors.

We monitor all Extended Detection and Response (XDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.