No more typing reviews! Try our Samantha, our new voice AI agent.

Cybereason XDR vs Vectra AI comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
5th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cybereason XDR
Ranking in Extended Detection and Response (XDR)
25th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
3
Ranking in other categories
No ranking in other categories
Vectra AI
Ranking in Extended Detection and Response (XDR)
16th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
48
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (4th), Network Detection and Response (NDR) (2nd), Identity Threat Detection and Response (ITDR) (11th), AI-Powered Cybersecurity Platforms (8th)
 

Mindshare comparison

As of May 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.1% compared to the previous year. The mindshare of Cybereason XDR is 1.1%, up from 0.6% compared to the previous year. The mindshare of Vectra AI is 2.4%, down from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.7%
Vectra AI2.4%
Cybereason XDR1.1%
Other91.8%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Peter Nowak - PeerSpot reviewer
Business Development Manager for Cybereason at Bechtle
Integration of multiple firewalls enables advanced threat detection
The integration of data from firewalls and Active Directory is most valuable. Cybereason XDR facilitates two-way communication, where the firewall sends data to the Cybereason system, and it can communicate with the firewall to stop unwanted communication. Customers can deal with multiple types of firewalls with ease. The behavioral analytics help detect advanced threats when attackers use existing software. The multilayered protection approach, including NGAV, integrates XDR detection with antivirus to assess and counter threats effectively.
RR
Consultant at a retailer with 5,001-10,000 employees
Threat detection has improved and malicious emails are now identified quickly
Vectra AI offers artificial intelligence capabilities with visibility that can be integrated into our day-to-day operations and other tools, including malware detection tools and cyber threat tools. Vectra AI has positively impacted my organization. Last year while using it, we received many malicious email threats and virus incidents, including a trojan virus that had reportedly been deployed by someone. Our company used Vectra AI to detect the malicious threats and viruses before they could cause more damage, and we successfully stopped the threats. Using Vectra AI, I notice that server downtime has decreased significantly. We now experience only two to three hours of downtime, whereas without Vectra AI and other tools, our downtime would exceed 48 to 72 hours.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."
"There are a lot of lead solutions in this space, however, Palo Alto is number one."
"They did what they said, and this solution could apply to any scenario."
"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"The most valuable feature is that you can select remote access of any machine for sandboxing."
"Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
"It's very stable. I've never experienced downtime for the ASM console or ASM core."
"The integration of data from firewalls and Active Directory is most valuable."
"The solution has an investigation feature, which is useful for building storylines."
"Cybereason XDR's most useful feature is the investigation."
"The integration of data from firewalls and Active Directory is most valuable."
"The solution provide visibility into behaviors across the full lifecycle of an attack in our network, beyond just the Internet gateway, and makes our security operations much more effective because we are now looking not just at traffic on the border, but at east-west internal traffic to see not only if an exploit kit is being downloaded, but also if it is then laterally distributed into our environment."
"We discovered a lot of things in our network and are correcting several misconfigurations. We are learning how some apps work together and how some things shouldn't happen. It's also easier for us to identify the source of a brute force, whereas before, we didn't even know we had a brute force."
"Cognito Streams gives you a detailed view of what happens in the network in the form of rich metadata. It is just a super easy way to capture network traffic for important protocols, giving us an advantage. This is very helpful on a day-to-day basis."
"After deploying Vectra AI in our network, it began to add value to our security operations within a week."
"It has helped us to organize our security. We get a better overview on what is happening on the network, which has helped us get quicker responses to users. If we see malicious activity, then we can quickly take action on it. Previously, we weren't getting an overview as fast as we are now, so we can now provide a quicker response."
"It's important for us that the user interface is easy to understand and that is the biggest benefit we see from Vectra AI."
"The solution is currently used as a central threat detection and response system."
"The key feature for me for Detect for Office 365 is that it can also concentrate all the information and detection at one point, the same as the network solution does. This is the key feature for me because, while accessing data from Office 365 is possible using Microsoft interfaces, they are not really user-friendly and are quite confusing to use. But Detect for Office 365 is aggregating all the info, and it's only the interesting stuff."
 

Cons

"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."
"The downsides of Cortex XDR by Palo Alto Networks are that in many incidents, when I enter the causality chain, there are numerous logs."
"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."
"A little bit more automation would be nice."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."
"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."
"It is a complex solution to implement."
"Customer service is rated as a five out of ten. When they work and reach the right level, they are helpful, but getting to the right person can be time-consuming."
"Cybereason's customer support could be better."
"The one thing we sometimes have issues with is its integration with other security applications like antiviruses."
"There could be more integrations with other data sources like NDR systems."
"I would like to see a bit more strategic metrics instead of technical data. Information that I could show to my executive management team or board would be valuable."
"The rules for threats are not always precise and Vectra AI should improve this."
"A blind spot that I have is around the ease with which you can automate threat intervention."
"In comparison with a lot of systems I used in the past, the false positives are really a burden because they are taking a lot of time at this moment."
"It does a little bit of packet capture on alert so you can look at the packet capture activity going on, but it doesn't collect a whole lot of data."
"The reporting from Cognito Detect is very limited and doesn't give you too many options. If I want to prepare a customized report on a particular host, even though I see the data, I have to manually prepare the report. The reporting features that are built into the tool are not very helpful."
"ExtraHop has better features that seem more advantageous when compared to Vectra."
"Neither Vectra nor Darktrace have a function like a status health check on my log sources and traffic sources."
 

Pricing and Cost Advice

"The price was fine."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"The tool's price is moderate."
"The solution is expensive. It's pricing is on a yearly-basis."
"Cortex XDR is a costly solution."
"This is an expensive solution."
"Its pricing is kind of in line with its competitors and everybody else out there."
"I don't recall what the cost was, but it wasn't really that expensive."
"The solution is cheaper than Microsoft Defender. It has a subscription and no standard license."
"The pricing is high."
"The pricing is very good. It's less expensive than many of the tools out there."
"From a licensing perspective, the Vectra detect platform is pretty doable. Also, the hardware prices are nothing that we're not used to. The stream part is a little overpriced compared to the detect part. The reason is that you need to stream data to detect events anyway, so the data is in there. The only thing that's not available is the UI to be able to look at the stream data, which is also on the appliances but is just not activated. That's mainly the thing that we want to improve on."
"The license is based on the concurrent IP addresses that it's investigating. We have 9,800 to 10,000 IP addresses."
"There are additional features that can be purchased in addition to the standard licensing fee, such as Cognito Recall and Stream."
"Vectra's licensing model could scale to our research network, which has multiple, 100-gigabit links."
"My company pays for the Vectra AI licensing fee yearly. I know the figure because my company recently renewed the license, and it's okay, at least for the financial sector."
"Cost is a big factor, as always. However, I think we have a very good price–performance ratio."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
893,244 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Manufacturing Company
13%
Computer Software Company
11%
Comms Service Provider
11%
University
8%
Financial Services Firm
10%
Manufacturing Company
8%
Computer Software Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise21
Large Enterprise48
No data available
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise10
Large Enterprise29
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Cybereason XDR?
There could be more integrations with other data sources like NDR systems. Additionally, technical support has been s...
What is your primary use case for Cybereason XDR?
I use Cybereason XDR for customers who don't have a SOC or managed SOC yet and want to be protected on more than thei...
What advice do you have for others considering Cybereason XDR?
I rate Cybereason XDR a nine out of ten. I recommend having hands-on experience and doing some threat hunting to fami...
What do you like most about Vectra AI?
The solution is currently used as a central threat detection and response system.
What is your experience regarding pricing and costs for Vectra AI?
It is very acceptable when you compare it with Darktrace, for example.
What needs improvement with Vectra AI?
Vectra AI could be improved by focusing on all threat types, not only malicious threats or virus threats. All threats...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
Vectra Networks, Vectra AI NDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
MOTOROLA MOBILITY
Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association
Find out what your peers are saying about Cybereason XDR vs. Vectra AI and other solutions. Updated: April 2026.
893,244 professionals have used our research since 2012.