No more typing reviews! Try our Samantha, our new voice AI agent.

Expel vs Palo Alto Networks Cortex XSOAR comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Expel
Ranking in SOC as a Service
4th
Average Rating
9.0
Reviews Sentiment
8.2
Number of Reviews
1
Ranking in other categories
Managed Detection and Response (MDR) (13th)
Palo Alto Networks Cortex X...
Ranking in SOC as a Service
2nd
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
62
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd)
 

Mindshare comparison

As of September 2026, in the SOC as a Service category, the mindshare of Expel is 8.5%, down from 8.7% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 5.8%, down from 14.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
SOC as a Service Mindshare Distribution
ProductMindshare (%)
Palo Alto Networks Cortex XSOAR5.8%
Expel8.5%
Other85.7%
SOC as a Service
 

Featured Reviews

reviewer2578461 - PeerSpot reviewer
MDR Specialist at a tech services company with 201-500 employees
Rapid threat management and diverse technology integration for effective monitoring
Expel has made it easier for companies to monitor and manage various log sources. With its vast integration portfolio, customers can efficiently monitor diverse environments. Time to value is quick, as Expel can turn their service up very rapidly. They have both automated active responses and human processes that quicken threat resolution.
EricRise - PeerSpot reviewer
Noc Network Engineer at a outsourcing company with 51-200 employees
Automation playbooks have reduced soc noise and now streamline daily incident response
To improve Palo Alto Networks Cortex XSOAR, there can be a learning curve to it. It is not a very user-friendly product; it is complex. It handles debugs and automation playbooks. You have to really spend some time dedicated to learning the product, scripting, and acquiring your certifications on it. Cost is another item as well. That can be quite significant; it does depend on other tools for EDR, whether you are using Palo Alto's XDR system or any number of third-party products for that. There are some reporting and logging restrictions and limitations. Some of those are going to be constraints, including window size limits. Database use with it has limited scalability for that type of application.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses."
"Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise."
"I would rate the stability of Cortex XSOAR as nine out of ten."
"In my opinion, the best features offered by Palo Alto Networks Cortex XSOAR are the automation, the graphical incident interface, the assignment functionality, and automatically closing the incident with closure reasons."
"The most valuable feature is its capability to automate responses and collect information for any security event before you even delve into the details. It's a vast product with an active roadmap, so I'm satisfied with it for now. It's very efficient at data collection and correlation."
"Cortex XSOAR's playbook for incident management and automation is highly valuable."
"Palo Alto has gotten the investigators more presence to actually go in the report because being that the platform will email the investigator that it's been assigned to, now the investigators will jump in there and start going through the review process a lot quicker."
"It is a scalable solution."
"The installation is very easy to set up; it’s not overly complex or difficult, and the deployment took less than a week as we had it up and running within a couple of days."
 

Cons

"The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management."
"It doesn't offer automatic internet reports out of the box."
"The biggest area for improvement is simplifying playbook development and debugging."
"I think they should increase their collaboration base."
"The solution is complicated to learn."
"The dashboard performance could be improved."
"An improvement for Palo Alto Networks Cortex XSOAR could be adding management of custom resources through Terraform or infrastructure as code, making it more scalable from an end-user perspective."
"Previously, when Demisto was, there was a community edition; we could use it, reinstall it, and customize it. Since Palo Alto took over, it has become more financially oriented. It's business, but they could offer a pro model and a lighter model for different needs."
"Customization and performance can be improved. For example, some formats were incompatible when integrating, and they said we needed to work with the vendor to fix this issue because some logs that AVA logs were not compatible, and it did not readily recognize the format."
 

Pricing and Cost Advice

Information not available
"Cortex XSOAR's price could be lower."
"The price of Palo Alto Networks Cortex XSOAR is expensive."
"On a scale of one to ten, where one is a low price, and ten is a high price, I rate the pricing a nine."
"It is approx $10,000 or $20,000 per year for two user licenses."
"The pricing is fair. The pricing reflects the value and feature set it offers."
"When I first looked at Demisto, it had a price tag of $250,000 but when we finally purchased it, it was $345,000."
"There is a perception that it is priced very high compared to other solutions."
"There is a yearly license required for this solution and it is expensive."
report
Use our free recommendation engine to learn which SOC as a Service solutions are best for your needs.
914,109 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Construction Company
10%
Computer Software Company
8%
Manufacturing Company
7%
Financial Services Firm
13%
Manufacturing Company
8%
Outsourcing Company
7%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business27
Midsize Enterprise9
Large Enterprise32
 

Questions from the Community

What is your experience regarding pricing and costs for Expel?
Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.
What needs improvement with Expel?
The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for m...
What is your primary use case for Expel?
I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
We can quantify the reduction. It is more than sixty to seventy percent reduction in the MTTR, as per documents from Palo Alto, and with proper implementation, we can improve MTTR by up to sixty-fi...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The negative aspect of Palo Alto Networks Cortex XSOAR is the price; cost-wise, it is a bit higher. Other than enterprise clients, they might need to push their management to get additional approva...
What is your primary use case for Palo Alto Networks Cortex XSOAR?
We are a partner for Palo Alto as a service provider. Palo Alto Networks Cortex XSOAR is used as a SIEM solution or XDR-type solutions.
 

Also Known As

Workbench, Expel SOC-as-a-Service
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Amanda Fennell CSO
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Arctic Wolf Networks, Palo Alto Networks, LevelBlue and others in SOC as a Service. Updated: September 2026.
914,109 professionals have used our research since 2012.