No more typing reviews! Try our Samantha, our new voice AI agent.

Malwarebytes Teams vs NetWitness NDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 15, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
115
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (4th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Malwarebytes Teams
Ranking in Endpoint Protection Platform (EPP)
25th
Average Rating
8.0
Reviews Sentiment
7.3
Number of Reviews
37
Ranking in other categories
No ranking in other categories
NetWitness NDR
Ranking in Endpoint Protection Platform (EPP)
49th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Threat Intelligence Platforms (TIP) (34th), Endpoint Detection and Response (EDR) (59th), Security Orchestration Automation and Response (SOAR) (23rd), Network Detection and Response (NDR) (20th), Extended Detection and Response (XDR) (41st)
 

Mindshare comparison

As of August 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.9%, up from 3.7% compared to the previous year. The mindshare of Malwarebytes Teams is 1.6%, down from 2.0% compared to the previous year. The mindshare of NetWitness NDR is 0.9%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.9%
Malwarebytes Teams1.6%
NetWitness NDR0.9%
Other93.6%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
reviewer2594097 - PeerSpot reviewer
Chief Executive Officer at a wholesaler/distributor with 11-50 employees
Exceptional malware protection with regular updates and behavior-based detection
There are no built-in backups or integrated backup options, which could be an opportunity. The free version is effective, however, the paid version is pricey compared to it. Other customers have mentioned issues with false positives. It lacks enterprise-level management and more enterprise functionality. CrowdStrike and SentinelOne are much more enterprise-grade solutions. Malwarebytes has limited integration with cybersecurity tools and lacks enterprise integrations because it is not an enterprise product.
reviewer1799727 - PeerSpot reviewer
Manager, IT Security Operations at a non-profit with 11-50 employees
Reliable and good support but can be expensive
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The tool is easy to use."
"Palo Alto is the best security solution in the market."
"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"The anti-exploit is impenetrable."
"Cortex XDR lets us manage several clients from the same console, and its endpoint defense is more advanced than traditional antivirus."
"Cortex XDR can integrate the firewalls and determine the tendencies of the attacks. It's a new generation antivirus, with protection endpoints and detection response. It is very easy to use and everybody can operate the solution."
"It blocks malicious files, prevents attacks, and doesn't require many updates because it is a very light application."
"Cortex is the best solution for avoiding security breaches, malware attacks, and other kinds of security issues."
"The most valuable feature is its ability to customize for different groups."
"The central management of devices from different sites is a very good feature; this has made them much easier to manage."
"The product provides notifications for suspicious events. We have several public access points. The product helps to prevent unauthorized entry. Its most valuable features are pre-installation procedures and a cloud console. The console's interface is simple and can be viewed easily to take action. It covers everything in terms of security threats."
"From our experience, it provides 100% visibility and detects hundreds of infections."
"The solution has a good management interface."
"The most valuable features of Malwarebytes are the EDR and the complete feature set provided."
"So far, the solution has done a good job of protecting us from malicious items, such as ransomware, among other things."
"For a company with about 100 or more PC units, the solution is quite effective, makes monitoring easy, offers a lot of reporting, and provides protection for many applications including Windows and Zoom."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"The detection rate and tracking features including historical tracking, tracking of the fires on the desk, and tracking of the file last monitored are all quite valuable for us."
"It is stable. We have been using it for some time, without any issues."
"They have recently updated the features and the most valuable ones are the instant threat response, ease of use, web interface, integration, and easy access. RSA NetWitness Endpoint is very compatible with other solutions and technologies. However, they do not rely on third-party solutions and have most features built-in."
"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"The solution is stable."
"The interface of this solution is very flexible and easy to use."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
 

Cons

"The downsides of Cortex XDR by Palo Alto Networks are that in many incidents, when I enter the causality chain, there are numerous logs."
"It is a complex solution to implement."
"The tool needs to be improved in terms of integration and interface."
"For Cortex XDR by Palo Alto Networks, if I had to point out improvements, I would say the UI is still somewhat difficult for beginners."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"The technical support is not very good. I find the process difficult."
"Product might have some bugs."
"It's more focused on network communication. If a customer wants to increase the level of protection and start working with documents, it's impossible to integrate these features into the system. It's more of a communication-oriented system than a content security-oriented system."
"I would like to see a little more detail in the log. So, when an event occurs, I'd like to know not just when it happened and on what device, but what activity was taking place on the machine at the time so that we can drill down. If we get a false positive, we have to do a lot of research and go back and forth with our end-users to know why it was a false positive. So, having a little more detail around detections and events would probably be my most asked feature."
"There hasn't been an ROI because we haven't had an event that would cause this software to do something. Therefore, at this point, it has just been a cost to us because we haven't gotten anything out of it."
"Malwarebytes should improve its mobile compatibility."
"The free version is effective, however, the paid version is pricey compared to it."
"There is room for improvement in the way it is deployed, in terms of being able to distribute it. Right now we have to get our hands on a machine to deploy it. It would be nice if there was an easier system."
"The product's stability needs improvement."
"Every once in a while, the product gets clobbered. It's not just one thing. So, it could be a Microsoft update or a Kaspersky update."
"A solution must be installed in the main gateway to give an overview of the incoming and outgoing traffic. The technical support team's response time should be faster."
"The problem with this product is that it's a bit slow."
"The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."
"One of the drawbacks of using this product is that when you deploy, you have to create MSI files."
"I don't see this solution being very scalable."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"RSA NetWitness Endpoint is a scalable solution. However, the problem which we normally face is in terms of the migration of the solution."
"The solution lacks a reporting engine."
 

Pricing and Cost Advice

"It has reasonable pricing for the use cases it provides to the company."
"This is an expensive solution."
"It has a yearly renewal."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."
"The solution is expensive. It's pricing is on a yearly-basis."
"The pricing is okay, although direct support can be expensive."
"The price was fine."
"The platform pricing is competitive with other antivirus products."
"The licensing is per seat, with clients being a little less expensive than servers. If we need more licenses, we can accomplish that within a day. As Malwarebytes adds new features to their product, such as DNS filtering and a patching module, they want to charge us more even though we're a premium user, which isn't ideal."
"Malwarebytes is a cost-effective product."
"It is expensive."
"On a scale of one to ten, where one is a low price and ten is a high price, I rate the product's pricing a seven."
"I rate the tool's pricing a five out of ten."
"Its cost is around $60 a machine. The cost of the total solution for 250 people is about $8,500 a year. If we add EDR to it, it will bring that cost up to about $15,000. The cost for Carbon Black is about $25,000, which is $10,000 more, but you get all AI functions with it."
"The price of Malwarebytes is in the middle range compared to other vendors."
"It is highly scalable. It can be bought based on your requirements."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"It is an expensive product."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
908,800 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
10%
Comms Service Provider
10%
Manufacturing Company
10%
Comms Service Provider
12%
Financial Services Firm
10%
Construction Company
8%
Manufacturing Company
7%
Financial Services Firm
12%
Construction Company
9%
Manufacturing Company
8%
Outsourcing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise21
Large Enterprise54
By reviewers
Company SizeCount
Small Business22
Midsize Enterprise8
Large Enterprise6
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise6
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Malwarebytes?
I really hate the automatic rebilling without officially confirming it with me. It's an annoyance and they should at ...
What needs improvement with Malwarebytes?
It takes up too much space when it's trying to run in the background.
What is your primary use case for Malwarebytes?
My primary use case is that it's protecting me against malware.
Ask a question
Earn 20 points
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
RSA ECAT, NetWitness Network
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Knutson Construction
ADP, Ameritas, Partners Healthcare
Find out what your peers are saying about Malwarebytes Teams vs. NetWitness NDR and other solutions. Updated: June 2026.
908,800 professionals have used our research since 2012.