No more typing reviews! Try our Samantha, our new voice AI agent.

Fortinet FortiEDR vs Microsoft Defender XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
4.7
Cortex XDR by Palo Alto Networks provides cost savings, enhanced security, and compliance with reduced administrative effort and robust threat detection.
Sentiment score
2.8
Fortinet FortiEDR boosts ROI by reducing risk management, saving time, improving security, and increasing customer satisfaction and staffing efficiency.
Sentiment score
7.4
Microsoft Defender XDR delivers significant ROI by reducing costs, response times, and increasing efficiency, justifying its investment.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cyber Security Manager at Welab bank
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
Detection and Response Consultant at Inovasys
In Cortex XDR by Palo Alto Networks, most of the remediation is automated and the accuracy is quite good.
Network Security Engineer at Cyberwell Solution
We can quarantine and isolate a device within minutes.
Information Security Analyst at a educational organization with 10,001+ employees
Microsoft Defender XDR has saved me at least 50% of my time.
House security operator at Cypress Creek Renewables
It helped stop multiple intrusion points where we would have had millions in lost revenue if the attackers got in.
Network Technician at T. Baker Smith, LLC
 

Customer Service

Sentiment score
7.0
Cortex XDR support varies by plan and location; premium plans provide better experiences but others report delays.
Sentiment score
7.3
Fortinet FortiEDR's customer service is mixed, with varied responsiveness; engaging local distributors and resellers can aid support experience.
Sentiment score
6.3
Microsoft Defender XDR support is praised for responsiveness, though response times and first-level support knowledge can vary significantly.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
Head of data centers at a non-profit with 10,001+ employees
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
Senior Process Expert at A.P. Moller - Maersk
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
Chief of IT Architecture at a financial services firm with 10,001+ employees
The technical support from Fortinet is excellent.
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
For setting up some proper solutions for issues at the customer site, it can take about one week.
Security Team Lead at a outsourcing company with 1,001-5,000 employees
I believe the support from Fortinet is very good based on my experiences asking for help.
Pre Sales/ Cybersecurity Engineer at Contacta
You get stuck in low-level support for way longer than you should, instead of them escalating the issue up the chain.
Enterprise Application Engineer at a legal firm with 1,001-5,000 employees
It's critical to escalate SEV B issues immediately to a domestic engineer.
Infrastructure engineer at Cetera Financial Group
Once issues are escalated to the second or third layer, the support is much better.
Cyber Security Engineer at a financial services firm with 1-10 employees
 

Scalability Issues

Sentiment score
7.5
Cortex XDR offers scalable, flexible management for enterprises, supporting thousands of users with easy deployment and cloud-based maintenance.
Sentiment score
5.6
Fortinet FortiEDR is scalable and adaptable but may face integration issues and high costs for additional services.
Sentiment score
7.0
Microsoft Defender XDR offers scalable, efficient performance across systems, though large datasets can impact query speeds, especially on-premises.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Assistant Security Architect at Cloudnomics
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Junior Security Analyst at ITSEC Asia
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
Head of data centers at a non-profit with 10,001+ employees
When implemented in a Fortinet environment with an existing firewall, FortiAnalyzer, and FortiManager, it is straightforward to install and scale by adding more EDR for endpoints.
Security Team Lead at a outsourcing company with 1,001-5,000 employees
I can give it nine points in terms of scalability.
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
My concern is about the scale of events and alerts being generated, and the product is doing a very good job of only surfacing the important items for us.
Vice President, Information Technology at a construction company with 201-500 employees
It has a very good integration system that integrates with all Azure services, all threat intelligence data models, and integrates very well with other systems such as Palo Alto.
Infosec at a government with 10,001+ employees
The biggest measurable gain is not just faster response but handling more incidents in parallel with the same team size, which is critical for enterprise scalability.
Manager at Softcell Technologies Limited
 

Stability Issues

Sentiment score
8.0
Cortex XDR is praised for its stability and performance, with manageable upgrades and frequent updates enhancing its features.
Sentiment score
8.4
Fortinet FortiEDR is reliable with some memory and integration issues; praised for seamless updates but needs ecosystem improvements.
Sentiment score
8.2
Microsoft Defender XDR is stable and reliable, maintaining high availability with prompt issue resolution and frequent updates.
Cortex remains fast and responsive, even with increasing data and alerts.
Final Year Student at Gitam University
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR is stable, offering high quality and reliable performance.
Cyber Security Manager at Welab bank
After that, I stopped scanning the Cisco AnyConnect and switched to Fortinet VPN. Everything worked fine afterward.
Security Team Lead at a outsourcing company with 1,001-5,000 employees
For stability, I would give it a score of ten, as we are not having any issues with that currently.
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
The stability is strong enough that we confidently rely on it for continuous threat detection, automated investigation, and enterprise-wide incident response.
Manager at Softcell Technologies Limited
The service has remained consistently online, with any issues isolated to specific components, suggesting a well-designed and modular architecture.
Senior System Engineer at a sports company with 5,001-10,000 employees
The services within our ecosystem have been reliable, meeting their SLAs.
Infrastructure engineer at Cetera Financial Group
 

Room For Improvement

Cortex XDR users desire better OS integration, interface, threat detection, and pricing, while facing complexity and compatibility challenges.
Fortinet FortiEDR needs improvements in cloud security, usability, integration, machine learning capabilities, and enhanced scalability to better meet user expectations.
Microsoft Defender XDR needs improvements in alert noise reduction, tool integration, AI automation, and user interface to enhance usability.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
Final Year Student at Gitam University
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
Pre Sales Architect at network techlab
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cyber Security Information Security Specialist at MHM Holding GmbH
Fortinet could consider reducing the minimum order quantity for EDR, currently set at 500 pieces.
Security Team Lead at a outsourcing company with 1,001-5,000 employees
The licensing process needs improvement and clarification.
Owner at a consultancy with 11-50 employees
Improvements are needed in automated response capabilities.
Security manager at a consultancy with 10,001+ employees
If you have a central location where you perform one isolation method, all other potentially affected systems that have been touched may also be isolated simultaneously.
CISO at Loeb & Loeb LLP
 

Setup Cost

Cortex XDR is seen as costly by some, but offers scalable licensing and satisfaction varies with advanced features.
Fortinet FortiEDR's pricing is mixed, seen as competitive by some, expensive by others, offering long-term value and scalability.
Microsoft Defender XDR offers cost-effective protection for enterprises using Microsoft 365, but smaller organizations might find it pricey.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
Consultant at a tech services company with 1,001-5,000 employees
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR is perceived as expensive by some customers, yet offers dynamic pricing.
Cyber Security Manager at Welab bank
It's reasonably priced compared to other vendors' similar products.
Security Team Lead at a outsourcing company with 1,001-5,000 employees
The pricing is moderate; I cannot label it as cheap, but it is moderate compared to other main solutions.
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
There are certainly savings when using Microsoft Defender XDR, which can range from 30%, 40%, and even up to 50%.
Director, Sales at a tech vendor with 201-500 employees
I would rate the pricing as eight out of ten, indicating it is a reasonable cost for the product.
Security manager at a consultancy with 10,001+ employees
Microsoft purposefully obfuscates this through marketing ploys to hide costs.
Senior System Engineer at a sports company with 5,001-10,000 employees
 

Valuable Features

Cortex XDR offers advanced security with robust detection, integration, and AI capabilities, praised for flexibility and user-friendly interface.
Fortinet FortiEDR excels in deployment, integration, threat response automation, and scalability, with strong security measures and user-friendly management.
Microsoft Defender XDR offers comprehensive threat detection and response with advanced features, centralized management, and seamless integration with Microsoft products.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
Cyber Security Manager at Welab bank
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
Pre Sales Architect at network techlab
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
Final Year Student at Gitam University
The four pillars of the solution are security access via VPN, ZTNA, attack surface protection, and automatic incident response, integrating with Fortinet Security Fabric.
Pre Sales/ Cybersecurity Engineer at Contacta
This is especially relevant for government projects where the SD-WAN solution is within their private network, not touching the Internet or any other access.
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
With Microsoft threat intelligence information, it detects various types of threats, including insider attacks, malicious content, and data exfiltration.
Security manager at a consultancy with 10,001+ employees
This allows us to secure our systems in advance and proactively improve security, rather than waiting for incidents to occur.
Works at Hometrack
Once we have it on the security dashboard, we can see a real-time storyline.
Information Security Analyst at a educational organization with 10,001+ employees
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Fortinet FortiEDR
Ranking in Endpoint Detection and Response (EDR)
14th
Average Rating
8.0
Reviews Sentiment
6.2
Number of Reviews
40
Ranking in other categories
No ranking in other categories
Microsoft Defender XDR
Ranking in Endpoint Detection and Response (EDR)
8th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
109
Ranking in other categories
Extended Detection and Response (XDR) (4th), Microsoft Security Suite (4th)
 

Mindshare comparison

As of May 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Fortinet FortiEDR is 2.8%, down from 3.9% compared to the previous year. The mindshare of Microsoft Defender XDR is 2.6%, down from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.4%
Microsoft Defender XDR2.6%
Fortinet FortiEDR2.8%
Other91.2%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Anoop K Jayan - PeerSpot reviewer
Web Relationship Manager (WRM) at Bharat Sanchar Nigam Limited
Has strengthened endpoint protection for on-premise networks and supported migration to Linux environments
What really stands out in Fortinet FortiEDR is that we are integrating it with some private clouds at the customer's premises with secure SD-WAN networks. I don't know how much it contributes to this SD-WAN network in the own premises cloud solution, but that is what we are doing. This is especially relevant for government projects where the SD-WAN solution is within their private network, not touching the Internet or any other access. Their first requirement is centralized management. Additionally, they need antivirus updates and other things to be done through a centralized platform within that private cloud. That is their requirement, and currently, we temporarily allow internet access, but it is not preferred. We are moving towards a complete air gap, providing full isolation from the internet for that. We have started to work with machine learning capabilities in Fortinet FortiEDR. We are not that well-versed yet, but we have begun using machine learning for intrusion detection and other purposes. Regarding forensic analysis in Fortinet FortiEDR, it is useful in understanding attack vectors because our projects are based on the voice side, such as cloud PBX solutions and call center management. There are media activities and many attacks coming from the outside, as well as vulnerabilities from endpoints. In those cases, we need detailed analysis through an AI platform to inspect how these attacks are coming. We also require a proactive protection mechanism, including an alarm system for threat detection before attacks occur.
AS
Manager at Softcell Technologies Limited
Centralized threat detection has improved response times but still needs better integrations
Microsoft Defender XDR simplifies cross-domain investigations for the SOC team. Instead of switching between separate endpoint, email, identity, and cloud security tools, the analysts can investigate correlated incidents from a single console with unified telemetry and timelines. The best features Microsoft Defender XDR offers are cross-domain incident correlation, automated investigation and response, and unified visibility across endpoint, identity, email, and cloud workloads. The attack timeline and correlated incident view are especially valuable because they help analysts understand the full attack chain quickly without manually stitching data from multiple security tools. The automated investigation and response capabilities in Microsoft Defender XDR save a significant amount of manual effort for the SOC team. Routine tasks like alert correlation, endpoint isolation, malware analysis, and remediation recommendations are automated, which reduces analyst workload and improves response time for common incidents. One underrated feature in Microsoft Defender XDR is the unified attack timeline and identity correlation capabilities. It gives analysts a clear end-to-end view of user, email, data, device, and identity activity during an incident, which makes root cause analysis and lateral movement tracking much easier. Microsoft Defender XDR has improved our overall security visibility and helped reduce the time required to detect and respond to threats across endpoints, identities, email, and cloud workloads. It also improved our SOC efficiency by centralizing investigations and automating repetitive response actions, which reduced operational overhead significantly.
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
893,244 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Computer Software Company
12%
Manufacturing Company
8%
Financial Services Firm
7%
Government
7%
Computer Software Company
11%
Financial Services Firm
9%
Manufacturing Company
7%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise49
By reviewers
Company SizeCount
Small Business20
Midsize Enterprise9
Large Enterprise14
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise29
Large Enterprise41
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What's the difference between Fortinet's FortiEDR and FortiClient?
I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protectio...
What is your experience regarding pricing and costs for Fortinet FortiEDR?
The pricing is moderate; I cannot label it as cheap, but it is moderate compared to other main solutions.
What needs improvement with Fortinet FortiEDR?
I will have my team provide more details about disadvantages via email later.
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with the pricing, setup costs, and licensing of Microsoft Defender XDR is that we are on an E5 license,...
What needs improvement with Microsoft 365 Defender?
From my perspective, Microsoft Defender XDR can be improved with better visibility in certain areas where I can trigg...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
enSilo, FortiEDR
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Find out what your peers are saying about Fortinet FortiEDR vs. Microsoft Defender XDR and other solutions. Updated: April 2026.
893,244 professionals have used our research since 2012.