No more typing reviews! Try our Samantha, our new voice AI agent.

Mandiant Advantage vs Recorded Future comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Mandiant Advantage
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
7
Ranking in other categories
Extended Detection and Response (XDR) (28th), Attack Surface Management (ASM) (8th)
Recorded Future
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Threat Intelligence Platforms (TIP) (2nd), Digital Risk Protection (2nd)
 

Mindshare comparison

Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Mandiant Advantage1.3%
CrowdStrike Falcon9.4%
SentinelOne Singularity Endpoint5.9%
Other83.4%
Extended Detection and Response (XDR)
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
Recorded Future7.1%
CrowdStrike Falcon4.8%
ThreatConnect Threat Intelligence Platform (TIP)3.9%
Other84.2%
Threat Intelligence Platforms (TIP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
LF
Head Of Cyber Threat Intelligence at Discount Bank
Brand threats have been monitored proactively and intelligence now drives daily security decisions
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic. I would rate Mandiant Advantage an 8 out of 10. I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive. The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.
Derek  Lewis - PeerSpot reviewer
Account Manager at Chevron
Continuous threat intelligence has improved brand monitoring and protects against leaked credentials
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Sometimes alerts pop up for articles that have been published years ago but were just recently discovered by Recorded Future. For the browser extension, since the main purpose is to present information regarding IPs, I think it would be best to provide us with an idea of where the IP originates or some additional information about the organization it belongs to. API capabilities in Recorded Future are improving, but there are still some features that are missing and some errors that are hard to handle and understand. The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very effective and relatively competitive for large organizations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, it's a great platform; it integrates very well with other solutions from Palo Alto and also with our vendors, the ease of use is excellent, I love the root cause analysis from Cortex, which is amazing, and in a few clicks you can have the full root cause."
"We have a complete overview of all our PCs and it's very easy to handle and to use the interface. It has a lot of benefits for us."
"It blocks malicious files, prevents attacks, and doesn't require many updates because it is a very light application."
"After deploying Traps, we saw the performance of the network improve by 65 to 70 percent."
"The product has an intuitive dashboard."
"The most valuable feature is that you can select remote access of any machine for sandboxing."
"Monitoring is most valuable."
"The solution doesn't need a high level of technical training."
"I have never faced stability issues."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk, and the YARA rules I wrote within the platform help me understand better what my threat landscape is."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"The live IOC feed identifies the type, technique, and tactics used."
"Recorded Future has positively impacted our organization as we are able to cover a lot of sources with only this intelligence provider, not having to have specific tools for clear web or social media monitoring."
"Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry."
"The tool is helpful in vulnerability assessment of zero-day vulnerabilities and phishing domains. The solution provides information on any domains of the organization that has undergone phishing or any other cyberattacks."
"The intel that they were providing us over the emails was very good. If it found any hashtag in our organization's name on the dark web, a rogue IP, or a marketplace, it would send us an email and notify us that this is being mentioned, and if we want, they can take some action."
"From the feedback I've received from my clients, the most valuable feature is the ability to personalize the solution. The ability to have a customized dashboard makes it easy for leadership and management to obtain details. Intelligence analysts or security engineers care about the actions and results, whereas the leadership care about graphs and reports. Recorded Future helps my clients create reports and also determine how the intelligence that is generated is consumed. They can easily show the benefits to the leadership without them having to invest 10 hours a week into transferring numbers into a graph or into creating reports."
"The most valuable features of Recorded Future are the useful alerts it provides. If we are monitoring a domain, the solution will provide us with an alert in a prompt manner. It is simple for clients to receive alerts. The advanced search is useful for more accurate filter results."
"As a threat intelligence tool, it's very helpful."
"It can collect data from various sources, including social media and the dark web."
 

Cons

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."
"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."
"I feel that it should not be a licensed activity because a feature should allow us to see applications running on end devices."
"To jump from the partner to Palo Alto directly was challenging."
"The GUI could be improved. It's a little bit cumbersome. It could be more user-friendly."
"Basically, they don't provide customer support tools just to investigate the logs."
"I have seen lagging with Cortex XDR by Palo Alto Networks. There was one time when we faced a threat actor trying to gain access to our system. When our team utilized the tool, we were all on the same dashboard and we faced a lag issue at that time of around five minutes, which was quite significant."
"The product's pricing needs improvement. They could provide more discounts. Additionally, the dashboard and control panel could be enhanced."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"It sometimes detects false positives and reduces the overall accuracy of the system."
"When you add one website to Recorded Future, it should automatically call all other websites and social media platforms."
"The product gives many false positives. If someone talks about the brand or organization name in the public domain over chats or blocks, it gets highlighted. It may not necessarily be a threat but still gets highlighted which increases the false positive count."
"While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate."
"The solution could improve in reducing the false positives. However, most of the other tools on the market have false positives. If they enhance their data algorithm, it could improve the accuracy of results and minimize false positives. Identifying patterns of false possibilities can aid in developing better reporting features that could potentially eliminate them in the future. This recording feature tool could benefit from adopting similar techniques utilized by other tools to enhance its functionality. By doing so, it could minimize the need for manual efforts in distinguishing true positives from false positives, ultimately reducing the workload."
"Recorded Future is a very expensive solution, and its pricing could be improved."
"Lacks sufficient visibility of malware and international APT attacks."
"At present, my clients need to be trained by me or another organization on how to use Recorded Future and how to get the best out of it as an analyst, engineer, and administrator. It would be better if clients could directly learn these things without having to go through me or other organizations."
 

Pricing and Cost Advice

"The price of the product is not very economical."
"It is cost-effective compared to similar solutions. It fits for the small businesses through to the big businesses."
"The pricing is a little high. It is per user per year."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"It's about $55 per license on a yearly basis."
"I don't like that they have different types of licenses."
"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"I don't have any issues with the pricing. We are satisfied with the price."
Information not available
"There appear to be up to five different levels, with the most expensive version costing around $95,000 to $105,000 a year for subscription services."
"I would rate the solution’s pricing a seven out of ten."
"The biggest disadvantage of Recorded Future is the cost here in Eastern Europe. The solution is correctly priced for big companies who have the money to invest in such solutions. Also, the solution is useless on its own, which means that you have to invest in other solutions with which Recorded Future can be integrated. At present, Recorded Future can cost 60,000 euros per year. I am able to offer my clients a 5% to 10% discount, but in this region, the cost is still prohibitive even with the discount. If Recorded Future were more flexible in terms of price, there would be better sales opportunities in Europe and Eastern Europe, in particular, because we have more small- and medium-sized companies here."
"The price of the solution is worth it. The overall performance of the solution outweighs the cost."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
894,830 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Financial Services Firm
16%
Computer Software Company
9%
Manufacturing Company
6%
Construction Company
6%
Financial Services Firm
16%
Computer Software Company
11%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise49
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise2
Large Enterprise3
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise12
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Mandiant Advantage?
I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, thei...
What is your primary use case for Mandiant Advantage?
I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to ...
What advice do you have for others considering Mandiant Advantage?
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the...
What is your experience regarding pricing and costs for Recorded Future?
The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very ef...
What needs improvement with Recorded Future?
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Som...
What is your primary use case for Recorded Future?
Our main use case for Recorded Future is brand monitoring, reputation, and risk assessment, as it is one of the best ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Mandiant Threat Intelligence
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Fujitsu, Regions, SITA, St. Jude Medical, Accenture, T-Mobile, TIAA, Intel Security, Armor, Alert Logic, NTT, Splunk
Find out what your peers are saying about CrowdStrike, SentinelOne, TrendAI and others in Extended Detection and Response (XDR). Updated: May 2026.
894,830 professionals have used our research since 2012.