No more typing reviews! Try our Samantha, our new voice AI agent.

Forescout Platform vs ReliaQuest GreyMatter comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Forescout Platform
Ranking in Extended Detection and Response (XDR)
30th
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
78
Ranking in other categories
Network Access Control (NAC) (6th), IoT Security (5th), Endpoint Compliance (3rd)
ReliaQuest GreyMatter
Ranking in Extended Detection and Response (XDR)
32nd
Average Rating
9.0
Reviews Sentiment
7.1
Number of Reviews
3
Ranking in other categories
Digital Risk Protection (11th), Managed Detection and Response (MDR) (19th)
 

Mindshare comparison

As of November 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.8% compared to the previous year. The mindshare of Forescout Platform is 1.4%, up from 0.9% compared to the previous year. The mindshare of ReliaQuest GreyMatter is 0.9%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.7%
Forescout Platform1.4%
ReliaQuest GreyMatter0.9%
Other93.0%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
AshishKumar Rai - PeerSpot reviewer
Security Consultant at a tech vendor with 10,001+ employees
Comprehensive visibility has strengthened endpoint control and automated threat response across networks
When it comes to improving Forescout Platform, I have faced some issues recently, particularly with the switch integration part. When integrating a switch, it asks for the vendor type, and often it does not match. For example, one series of HP switches may not be found in that vendor list. This leads to frustration because you have to check again with different HP models, and once you integrate a switch, you cannot edit the vendor list without removing it. Other issues are being worked on, particularly related to switch integration. I believe they will be fixed in the next upgrade or patch fix. There are no major issues, but the configuration changes needed for the switch model are necessary, and I think it would help if during integration, an admin user could check the password or credential used, as they currently cannot see the password after it is entered and saved.
Omkar Korulkar - PeerSpot reviewer
Technology Analyst at a tech vendor with 10,001+ employees
Centralized visibility has improved SOC investigations and supports faster, more accurate incident response
I think ReliaQuest GreyMatter could be improved further in a few areas. First, I want to see more flexibility in dashboard customization so analysts can configure views based on their roles and investigation requirements. Second, improving alert correlation accuracy and reducing overall false positive rates would help analysts focus on genuine possible threats rather than spending time validating repetitive low-priority alerts or false positives. Third, more detailed investigation timelines, better reporting capabilities, and simpler investigation integration configuration would make the platform more effective. I suggest continuously improving automation workflows to reduce repetitive manual tasks while allowing analysts to maintain control over critical response actions. Overall, I think these enhancements can make the platform more user-friendly and improve the efficiency of SOC operations. One additional improvement would be enhancing the investigation experience by providing more detailed context directly within the alert. For example, having a clear incident timeline, related alerts, historical activity, and threat intelligence information available in one place would make investigations easier. I believe these improvements would make day-to-day SOC operations smoother and allow analysts to focus more on proactive threat hunting and other complex investigations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution's most valuable feature is its ability to rapidly detect certain hardware files."
"They have a new GUI which is just fantastic."
"They did what they said, and this solution could apply to any scenario."
"The stability is pretty good except for one or two cases, and based on the performance, it's been okay with pretty high performance, no bugs or glitches, and it doesn't crash or freeze."
"Cortex XDR by Palo Alto Networks's ability to block sophisticated threats in real time is quite good and is on par with SentinelOne's."
"We use it for malicious connections from malicious websites, to identify payloads that might be inside the traffic, to identify malicious processes or bugs that are running on the network, and any activities that tend to lead to data infiltration."
"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."
"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."
"I have noticed that in the last year the license model has changed from licensing the whole appliance to licensing the number of devices. It's more simple for a large installation, or a user to have CounterACT as their peripheral site in the company. It's a good choice to have changed the license policy."
"One reason why my customers choose Forescout Platform is because it is a cloud-based product, so you don't have dependency on on-premises infrastructure."
"ForeScout CounterACT is like a Pandora's box, which contains a lot of functionalities that can be used to improve the customer's daily operation tasks and reduces manual workforce."
"Forescout is easy to integrate with a lot of end systems."
"When users don't have the required updates, security patches, and antivirus, the tool blocks them from our network."
"The 802.1X configuration, which is difficult for all switches, is not required, making it easier to work with switches and IoT devices."
"Emergency response, risk assessment information to get a view of the of the vulnerability."
"Forescout Platform is a very good NAC solution."
"One of the best features that ReliaQuest GreyMatter offers is the ability to bring together security tools and data that support threat investigation, detection, and response."
"ReliaQuest GreyMatter saves around 60% of time or resources."
"ReliaQuest GreyMatter has helped us to reduce security incidents by 89%, which is a significant amount of incidents we have seen."
 

Cons

"The encryption is not up to the mark."
"A potential area of improvement for Cortex XDR by Palo Alto Networks is the cost."
"Product might have some bugs."
"Cortex XDR by Palo Alto Networks is a strong tool, but it is true that digesting information sometimes makes the tool go a little bit slower."
"They are charging for Network Traffic Analyzer (NTA) services, so if the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better."
"Enhancing UI simplicity and playbook flexibility are areas that could benefit from more low-code automation options for smoother integrations."
"On the pricing aspect, Cortex XDR by Palo Alto Networks needs to have a more reasonable rate, particularly for customers in Sri Lanka and Asian countries."
"The connection to the internet has not performed as expected."
"It is quite expensive, but there are specs for small companies as well."
"When we automate an email to send to a user, sometimes it gets blocked, but that has nothing to do with Forescout. It depends on the mail gateway that we use or integrate with."
"Sometimes the switch management interface doesn't display accurate information which relates to false positives on individual switch access errors."
"Search - needs boolean functionality (or pseudo operand now working)."
"The logging of Forescout is horrible compared to other things that we've used."
"If you want to deploy a new solution to block, you can't do it by yourself."
"The system controls could be better."
"The reporting could be improved."
"Areas that have room for improvement include user interface and integration."
"ReliaQuest GreyMatter is stable to a certain extent, but there is still some room for improvement."
 

Pricing and Cost Advice

"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"I don't like that they have different types of licenses."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"The price of the solution is high for the license and in general."
"I feel it is fairly priced."
"It has a yearly renewal."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"Its pricing is kind of in line with its competitors and everybody else out there."
"The price of Forescout is reasonable when compared to Cisco ISE."
"The ROI is priceless."
"Forescout's pricing is noted for its attractiveness, with potential discounts depending on partnership levels."
"It is expensive because you have to pay for their CSM, the customer's access manager, and their professional services on top of that, and they charge you roughly $400 per hour, which is overhead."
"They base the license on the number of devices, which is quite misleading."
"The tool's pricing is expensive but reasonable."
"The price of the solution is reasonable. We have paid for the license for five years. We have integration with Symantec AV for orchestration, and we have an additional license."
"Time savings in finding rogue devices as well as identifying potentially unwanted devices on the network has saved the organization time and money."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
920,769 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
12%
Financial Services Firm
11%
Outsourcing Company
8%
Construction Company
6%
Financial Services Firm
10%
Manufacturing Company
9%
Construction Company
8%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business29
Midsize Enterprise10
Large Enterprise45
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What advice do you have for others considering Forescout Platform?
Forescout is a very powerful NAC product that does not rely on port level configuration. It can detect and block unau...
What advice do you have for others considering Forescout Platform?
I would rate the Forescout Device and Visibility Control Platform at a six out of ten.
What advice do you have for others considering Forescout Platform?
I recommend doing a compression demo. If people use it, they will buy it. So they have to see the product in place. T...
What needs improvement with ReliaQuest GreyMatter?
Areas that have room for improvement include user interface and integration.
What is your primary use case for ReliaQuest GreyMatter?
I use ReliaQuest GreyMatter for detection and response, XDR, and SIEM. The best features I like about GreyMatter the ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Forescout Platform, CounterACT for Endpoint Compliance, ForeScout CounterACT
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
RWJ Barnabas HealthEnbridge EnergyToyota MotorsSt. Luke's University Health NetworkGlobal Credit Union
Information Not Available
Find out what your peers are saying about Forescout Platform vs. ReliaQuest GreyMatter and other solutions. Updated: October 2026.
920,769 professionals have used our research since 2012.