Try our new research platform with insights from 80,000+ expert users

Cortex XDR by Palo Alto Networks vs Mandiant Advantage comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 15, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Ranking in Extended Detection and Response (XDR)
7th
Average Rating
8.4
Reviews Sentiment
7.4
Number of Reviews
91
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (4th)
Mandiant Advantage
Ranking in Extended Detection and Response (XDR)
25th
Average Rating
8.4
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Attack Surface Management (ASM) (6th)
 

Mindshare comparison

As of September 2025, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 5.5%, down from 5.7% compared to the previous year. The mindshare of Mandiant Advantage is 1.0%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
Cortex XDR by Palo Alto Networks5.5%
Mandiant Advantage1.0%
Other93.5%
Extended Detection and Response (XDR)
 

Featured Reviews

NiteshSharma - PeerSpot reviewer
Automated threat response and behavioral control improve security measures
I recommend adding a data loss prevention (DLP) solution to Cortex XDR by Palo Alto Networks. The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products. Additionally, multi-tenancy and multi-cloud features are not available and should be considered for inclusion.
SameepAgarwal - PeerSpot reviewer
In-depth traffic analysis and proactive support reduce investigation time
The live IOC feed identifies the type, technique, and tactics used. This becomes handy since then I know what to refer to from the playbook. For instance, if I take a use case of someone with Mimikatz installed on their system, knowing the nature beforehand reduces investigation time. I can quickly apply the playbook to resolve incidents in less time.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features are incident creation, policy-based protection, IP whitelisting, and device encryption. These are beneficial for endpoint and server security."
"Based on my experience, I would recommend Cortex XDR by Palo Alto Networks to other people."
"It is an easy-to-use tool."
"The solution allows us to make investigations. Other XDR solutions also provide similar capabilities but for investigation, Cortex XDR is better."
"The stability of the solution is very good. We have about 100 users on it right now, and we use it twice a week."
"The product's initial setup phase is very easy."
"The tool is easy to use."
"From a single pane of glass, you can easily manage all of your endpoints."
"The live IOC feed identifies the type, technique, and tactics used."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"I have never faced stability issues."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
 

Cons

"We would also like to have advanced tech protection and email scanning."
"The playbooks could be improved to include more functionalities or actions."
"Cortex XDR by Palo Alto Networks could improve by adding a sandbox feature to better compete with their competitors which have it."
"The installation should be easier and the Palo Alto pre-sales and sales teams should have more information on the product because they don't know what they are selling."
"They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone. They don't know what they are talking about when you get them on the phone. They don't like to respond to messages when you send them to them. They like to "research problems" for weeks on end, then pass you off to somebody else."
"There is a severe gap in functionality between Windows, Linux, and Mac versions. For example all folder restriction settings are Windows only. Traps 5.0+ does not have SAML / LDAP integration."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
 

Pricing and Cost Advice

"I don't like that they have different types of licenses."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"It has a yearly renewal."
"The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."
"I feel it is fairly priced."
"The price is on the higher side, but it's okay."
"Our license will require renewal in August, after which the maintenance will continue as usual."
"The pricing is a little high. It is per user per year."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
868,229 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Financial Services Firm
10%
Manufacturing Company
8%
Government
7%
Financial Services Firm
19%
Computer Software Company
10%
Government
7%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business41
Midsize Enterprise18
Large Enterprise35
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. The ability to reverse damage caused by ransomware with minimal interruptions to...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
What needs improvement with Mandiant Advantage?
Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives. More fine-tuning is required to handle famous company names. It also handles alerts ...
What is your primary use case for Mandiant Advantage?
I use it for cyber threat intelligence. I gather information about newly created domains around the Internet that can be related to my managed company. I monitor these domains for any phishing acti...
What advice do you have for others considering Mandiant Advantage?
I would advise exploring multiple functions because there are many different capabilities of Mandiant Advantage. For small organizations, try every feature included in the package. Use known source...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Mandiant Threat Intelligence
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. Mandiant Advantage and other solutions. Updated: July 2025.
868,229 professionals have used our research since 2012.