No more typing reviews! Try our Samantha, our new voice AI agent.

Cybereason XDR vs Forescout Platform comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cybereason XDR
Ranking in Extended Detection and Response (XDR)
23rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
3
Ranking in other categories
No ranking in other categories
Forescout Platform
Ranking in Extended Detection and Response (XDR)
30th
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
78
Ranking in other categories
Network Access Control (NAC) (6th), IoT Security (5th), Endpoint Compliance (3rd)
 

Mindshare comparison

As of November 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.8% compared to the previous year. The mindshare of Cybereason XDR is 1.3%, up from 0.9% compared to the previous year. The mindshare of Forescout Platform is 1.4%, up from 0.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.7%
Cybereason XDR1.3%
Forescout Platform1.4%
Other92.6%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Peter Nowak - PeerSpot reviewer
Business Development Manager for Cybereason at Bechtle
Integration of multiple firewalls enables advanced threat detection
The integration of data from firewalls and Active Directory is most valuable. Cybereason XDR facilitates two-way communication, where the firewall sends data to the Cybereason system, and it can communicate with the firewall to stop unwanted communication. Customers can deal with multiple types of firewalls with ease. The behavioral analytics help detect advanced threats when attackers use existing software. The multilayered protection approach, including NGAV, integrates XDR detection with antivirus to assess and counter threats effectively.
AshishKumar Rai - PeerSpot reviewer
Security Consultant at a tech vendor with 10,001+ employees
Comprehensive visibility has strengthened endpoint control and automated threat response across networks
When it comes to improving Forescout Platform, I have faced some issues recently, particularly with the switch integration part. When integrating a switch, it asks for the vendor type, and often it does not match. For example, one series of HP switches may not be found in that vendor list. This leads to frustration because you have to check again with different HP models, and once you integrate a switch, you cannot edit the vendor list without removing it. Other issues are being worked on, particularly related to switch integration. I believe they will be fixed in the next upgrade or patch fix. There are no major issues, but the configuration changes needed for the switch model are necessary, and I think it would help if during integration, an admin user could check the password or credential used, as they currently cannot see the password after it is entered and saved.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"If you are looking to deploy a security solution as a whole, this is a good option."
"It is easy to use."
"The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past."
"The most valuable features are incident creation, policy-based protection, IP whitelisting, and device encryption. These are beneficial for endpoint and server security."
"The product's initial setup phase is very easy."
"On a scale from one to ten, I would rate Cortex XDR by Palo Alto Networks a nine."
"Cortex XDR is a very capable solution for protecting large networks and a lot of endpoints. It's very useful because the automation is very high, and if you combine it with the features on Palo Alto firewalls, it provides very strong protection."
"The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices."
"Cybereason XDR's most useful feature is the investigation."
"The solution has an investigation feature, which is useful for building storylines."
"The integration of data from firewalls and Active Directory is most valuable."
"When users don't have the required updates, security patches, and antivirus, the tool blocks them from our network."
"Its feature that I have found most valuable is that it is very granular. You can configure granular controls just as you want those policies to be implemented. It gives you that flexibility to go granular in how you want your controls to be implemented. That's something I like about it."
"Forescout Platform isn't cheap, but it's the best solution for the environment I'm dealing with."
"Within three or four days, we have complete visibility of your infrastructure on the network. Compared to other solutions, the deployment of the solution is easier and we can close the project quickly."
"Automated policy enforcement is particularly valuable as it significantly reduces the need for manual intervention, thus enhancing efficiency and security."
"Customer service is above average and technical support is above average."
"The valuable feature of the product stems from the fact that it is easy to implement."
"The product has proven to be worth the cost and time savings alone in finding rogue devices."
 

Cons

"They are charging for Network Traffic Analyzer (NTA) services, so if the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better."
"Cortex XDR by Palo Alto Networks could improve by offering remote management. It would be useful to look at the client's issue to fix it."
"The solution eats memory of the computer, unlike anything I've ever seen."
"The solution can never really be an on-premises solution based simply on the way it is set up. It needs metadata to run and improve. Having an on-premises solution would cut it off from making improvements."
"When it comes to core analysis, and security analysis, Cortex needs to provide more information."
"The onboarding process could be better."
"Dashboards do not allow everyone to see what's happening."
"The product's pricing could be better."
"There could be more integrations with other data sources like NDR systems."
"Cybereason's customer support could be better."
"Customer service is rated as a five out of ten. When they work and reach the right level, they are helpful, but getting to the right person can be time-consuming."
"The one thing we sometimes have issues with is its integration with other security applications like antiviruses."
"It was not so easy to deploy in our environment, the learning curve for this solution is quite hard."
"First and foremost, that information is not accessible."
"We only looked at it in terms of discovery modes and I think it's too expensive to use for that purpose alone."
"The security features can be improved because we use it for sensitive information, such as compliance."
"Detection and control of Dual-Homed devices needs to be improved, as the product sometimes gives false positives."
"When we automate an email to send to a user, sometimes it gets blocked, but that has nothing to do with Forescout. It depends on the mail gateway that we use or integrate with."
"The biggest negative regarding Forescout is their support."
"When it comes to improving Forescout Platform, I have faced some issues recently, particularly with the switch integration part."
 

Pricing and Cost Advice

"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"The pricing is okay, although direct support can be expensive."
"The price was fine."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"Cortex XDR's pricing is ok."
"I feel it is fairly priced."
"The pricing is a little bit on the expensive side."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"The solution is cheaper than Microsoft Defender. It has a subscription and no standard license."
"5,000 user licenses will cost you between seven and eight million dollars, compared to 20 million for Aruba."
"We have a very clear licensing model for business. I don't have to have a Ph.D. to be able to understand the licensing model as you might need for other solutions. If I know exactly what we want, it can tell you which license you need. The solution is easy for purchasing, ordering, and ease of deployment as well."
"Devices with multiple IP's count multiple times against your license count."
"The Forescout Platform's pricing is in the middle range, not too cheap or expensive."
"It's about $160,000, but I'm not sure how long that is for or what it includes. Because we were a test base, we were provided with servers, but now, Forescout wants us to buy servers because those servers are now end-of-life or end-of-service. For our lifecycle management program, in order to get a refresh on those servers, we would have to buy servers or use our own network resources to house Forescout. Forescout takes up about 13 or 14 virtual CPUs."
"The solution is not priced low. There are no hidden costs."
"Forescout Platform is on the expensive side."
"The solution’s pricing is fine."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
920,769 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
12%
Outsourcing Company
10%
Computer Software Company
9%
University
8%
Manufacturing Company
12%
Financial Services Firm
11%
Outsourcing Company
8%
Construction Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
No data available
By reviewers
Company SizeCount
Small Business29
Midsize Enterprise10
Large Enterprise45
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Cybereason XDR?
There could be more integrations with other data sources like NDR systems. Additionally, technical support has been s...
What is your primary use case for Cybereason XDR?
I use Cybereason XDR for customers who don't have a SOC or managed SOC yet and want to be protected on more than thei...
What advice do you have for others considering Cybereason XDR?
I rate Cybereason XDR a nine out of ten. I recommend having hands-on experience and doing some threat hunting to fami...
What advice do you have for others considering Forescout Platform?
Forescout is a very powerful NAC product that does not rely on port level configuration. It can detect and block unau...
What advice do you have for others considering Forescout Platform?
I would rate the Forescout Device and Visibility Control Platform at a six out of ten.
What advice do you have for others considering Forescout Platform?
I recommend doing a compression demo. If people use it, they will buy it. So they have to see the product in place. T...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
Forescout Platform, CounterACT for Endpoint Compliance, ForeScout CounterACT
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
MOTOROLA MOBILITY
RWJ Barnabas HealthEnbridge EnergyToyota MotorsSt. Luke's University Health NetworkGlobal Credit Union
Find out what your peers are saying about Cybereason XDR vs. Forescout Platform and other solutions. Updated: October 2026.
920,769 professionals have used our research since 2012.