No more typing reviews! Try our Samantha, our new voice AI agent.

Microsoft Defender XDR vs Trellix XDR comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
4.4
Cortex XDR delivers cost savings, reduces security incidents, and attracts customers by replacing multiple solutions, offering high ROI.
Sentiment score
7.4
Microsoft Defender XDR enhances efficiency, reduces costs, and improves security through streamlined operations and faster threat detection.
Sentiment score
6.6
Trellix XDR boosts ROI by 20%, optimizes response times, reduces incidents, streamlines operations, and cuts workforce nearly in half.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cyber Security Manager at Welab bank
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
Detection and Response Consultant at Inovasys
In Cortex XDR by Palo Alto Networks, most of the remediation is automated and the accuracy is quite good.
Network Security Engineer at Cyberwell Solution
We can quarantine and isolate a device within minutes.
Information Security Analyst at a educational organization with 10,001+ employees
Microsoft Defender XDR has saved me at least 50% of my time.
House security operator at Cypress Creek Renewables
It helped stop multiple intrusion points where we would have had millions in lost revenue if the attackers got in.
Network Technician at T. Baker Smith, LLC
The workload has been reduced and the ROI has improved by around 20 percent.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
I have seen a return on investment because, in terms of employees, 15 were cut down to eight, and it was also saving us time from the whole dashboard automation.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Trellix helped us save our information, which is the most critical, and also save money.
System Administrator at a consultancy with 11-50 employees
 

Customer Service

Sentiment score
7.0
Cortex XDR's support is fast and knowledgeable, highly rated despite some regional and process-related challenges.
Sentiment score
6.3
Microsoft Defender XDR's support receives mixed feedback; premium users report efficiency, while others face delays and first-line inadequacies.
Sentiment score
6.1
Trellix XDR support receives mixed reviews; effectiveness and responsiveness vary by representative, with documentation often proving helpful.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
Head of data centers at a non-profit with 10,001+ employees
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
Senior Process Expert at A.P. Moller - Maersk
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
Chief of IT Architecture at a financial services firm with 10,001+ employees
You get stuck in low-level support for way longer than you should, instead of them escalating the issue up the chain.
Enterprise Application Engineer at a legal firm with 1,001-5,000 employees
It's critical to escalate SEV B issues immediately to a domestic engineer.
Infrastructure engineer at Cetera Financial Group
Once issues are escalated to the second or third layer, the support is much better.
Cyber Security Engineer at a financial services firm with 1-10 employees
If I require remote support, they will send a link to join a session and help me resolve any issues I have faced.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
Technical support is crucial, especially when facing critical issues.
Information Security Engineer at Nhq Distribution Ltd
The most basic thing that you need from the vendor is support, and by the time they resolve it, you probably would have figured it out by yourself because the resolution came after weeks or months.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
 

Scalability Issues

Sentiment score
7.4
Cortex XDR offers strong scalability and flexibility, managing thousands of endpoints efficiently while simplifying cloud-based expansion and integration.
Sentiment score
7.0
Microsoft Defender XDR offers excellent scalability and stability, seamlessly integrating with Azure and third-party systems for large deployments.
Sentiment score
7.5
Trellix XDR offers scalable, adaptable security management with centralized visibility and efficient threat detection for diverse organizational needs.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Assistant Security Architect at Cloudnomics
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Junior Security Analyst at ITSEC Asia
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
Head of data centers at a non-profit with 10,001+ employees
My concern is about the scale of events and alerts being generated, and the product is doing a very good job of only surfacing the important items for us.
Vice President, Information Technology at a construction company with 201-500 employees
It has a very good integration system that integrates with all Azure services, all threat intelligence data models, and integrates very well with other systems such as Palo Alto.
Infosec at a government with 10,001+ employees
Microsoft Defender XDR shows tremendous scalability, much more so than on-premises solutions.
Infrastructure engineer at Cetera Financial Group
Trellix XDR has good scalability because it can handle multiple security sources and multiple logs.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
in our environment, we have fed a lot of data logs into the tool, and it has been reliable and scalable with no issues.
Security Consultant at Deloitte
You can scale from ten licenses to several thousand.
System Administrator at a consultancy with 11-50 employees
 

Stability Issues

Sentiment score
8.0
Cortex XDR is praised for stability, reliability, minimal bugs, and superior performance, despite occasional false alerts and update issues.
Sentiment score
8.2
Microsoft Defender XDR is highly stable and reliable, with minimal bugs and consistently positive user feedback on performance.
Sentiment score
7.8
Trellix XDR is reliable with a strong support team, occasional downtime issues, and solid security expertise despite update concerns.
Cortex remains fast and responsive, even with increasing data and alerts.
Final Year Student at Gitam University
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR by Palo Alto Networks can be trusted completely.
Soc Analyst at Softcell Technologies Limited
The service has remained consistently online, with any issues isolated to specific components, suggesting a well-designed and modular architecture.
Senior System Engineer at a sports company with 5,001-10,000 employees
The services within our ecosystem have been reliable, meeting their SLAs.
Infrastructure engineer at Cetera Financial Group
It provides high-fidelity signals.
Information Security Analyst at a educational organization with 10,001+ employees
Support and stability are good. They are continuously improving.
Solutions Architect at Mideast Communication Systems-MCS
The system would go down for half an hour, an hour, or two hours in the off-hours which would then impact the business, impact the alerts, and the flow of alert.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
There is no downtime, or if there is, prior notification is sent to us so we can prepare accordingly.
Cyber Security Engineer Ii (Vulnerability & Threat Management) at FICO
 

Room For Improvement

Cortex XDR needs interface improvements, better integrations, cost-effectiveness, enhanced automation, real-time monitoring, and ease of use.
Microsoft Defender XDR requires better integration, simpler UI, enhanced threat intelligence, streamlined onboarding, improved documentation, and more affordable pricing.
Trellix XDR challenges include high costs, complex setup, compatibility issues, and slow support, limiting accessibility and effectiveness.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
Final Year Student at Gitam University
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
Pre Sales Architect at network techlab
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cyber Security Information Security Specialist at MHM Holding GmbH
The licensing process needs improvement and clarification.
Owner at a consultancy with 11-50 employees
Improvements are needed in automated response capabilities.
Security manager at a consultancy with 10,001+ employees
If you have a central location where you perform one isolation method, all other potentially affected systems that have been touched may also be isolated simultaneously.
CISO at Loeb & Loeb LLP
Trellix support team is not highly regarded because they follow a whole hierarchical process to escalate the complaints and the feedback requests, and the resolution can take very long, from two to three weeks to a month, which is not really viable in a cybersecurity landscape which is moving this fast.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
Continuous enhancement to automation and AI-driven threat prioritization would further reduce analysts' workflow and improve response effectiveness.
Business development executive at Digitaltrack solution Pvt Ltd
The trend these days is moving toward AI security, and Trellix XDR should align with this direction.
Solutions Architect at Mideast Communication Systems-MCS
 

Setup Cost

Cortex XDR offers advanced features with perceived high costs, pricing varies by organization size, subscription, and potential extra feature charges.
Microsoft Defender XDR offers low setup costs but complex pricing, requiring careful planning to manage licensing and regional updates.
Trellix XDR offers competitive pricing for large enterprises, but recent price increases challenge affordability for small businesses.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
Consultant at a tech services company with 1,001-5,000 employees
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Senior Process Expert at A.P. Moller - Maersk
Compared to CrowdStrike, which is very costly, and SentinelOne, which is also very costly, Cortex XDR by Palo Alto Networks is a medium cost-efficient solution.
Soc Analyst at Softcell Technologies Limited
There are certainly savings when using Microsoft Defender XDR, which can range from 30%, 40%, and even up to 50%.
Director, Sales at a tech vendor with 201-500 employees
I would rate the pricing as eight out of ten, indicating it is a reasonable cost for the product.
Security manager at a consultancy with 10,001+ employees
Microsoft purposefully obfuscates this through marketing ploys to hide costs.
Senior System Engineer at a sports company with 5,001-10,000 employees
But currently, they have bumped up the prices and that is why we have now moved to a different solution totally. We have left Trellix XDR.
Associate Cybersecurity Analyst at a tech vendor with 10,001+ employees
My experience with pricing, setup cost, and licensing shows that the pricing is very competitive and not overly expensive.
Security Engineer at i360
 

Valuable Features

Cortex XDR excels in threat detection and response with AI integration, multi-layered security, and user-friendly automation features.
Microsoft Defender XDR enhances security with cross-domain correlation, automation, integration, centralized management, and multi-tenant capabilities.
Trellix XDR enhances threat detection and response through automation, integration, AI assistance, and contextual data, improving security operations.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
Cyber Security Manager at Welab bank
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
Pre Sales Architect at network techlab
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
Final Year Student at Gitam University
With Microsoft threat intelligence information, it detects various types of threats, including insider attacks, malicious content, and data exfiltration.
Security manager at a consultancy with 10,001+ employees
This allows us to secure our systems in advance and proactively improve security, rather than waiting for incidents to occur.
Works at Hometrack
Once we have it on the security dashboard, we can see a real-time storyline.
Information Security Analyst at a educational organization with 10,001+ employees
The core functionality includes EDR and NDR, and Trellix XDR gets threat detection on both the network and endpoint levels.
Solutions Architect at Mideast Communication Systems-MCS
The second feature is its ability for cross-platform threat correlation, meaning the platform helps to correlate all events across endpoints, network activity, security controls, and threat intelligence sources, providing us with a more in-depth view in terms of threat detection and threat research.
Security Consultant at Deloitte
You can start as a small company and when you own Trellix XDR, as your company grows, you can grow your Trellix XDR subscription from on-premise, for example, to the cloud.
System Administrator at a consultancy with 11-50 employees
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
117
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Microsoft Defender XDR
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
108
Ranking in other categories
Endpoint Detection and Response (EDR) (9th), Microsoft Security Suite (4th)
Trellix XDR
Ranking in Extended Detection and Response (XDR)
18th
Average Rating
7.6
Reviews Sentiment
6.6
Number of Reviews
10
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.5%, down from 5.0% compared to the previous year. The mindshare of Microsoft Defender XDR is 3.8%, down from 5.6% compared to the previous year. The mindshare of Trellix XDR is 0.8%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.5%
Microsoft Defender XDR3.8%
Trellix XDR0.8%
Other90.9%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
reviewer2812758 - PeerSpot reviewer
Infosec at a government with 10,001+ employees
Integrated defenses have unified threat hunting, phishing simulations, and identity investigations
I appreciate Microsoft Defender XDR's MDE, Microsoft Defender tool, which has Attack Simulator. Instead of doing a phishing campaign and getting a separate tool, Microsoft Defender XDR does it all. These features of Microsoft Defender XDR have helped us conduct a phishing campaign quarterly, which has been beneficial. I also appreciate the fact that it has Defender for Office integrated, Defender for Identity, and everything integrated together. I would describe the process of using Microsoft Defender XDR to prioritize incidents in my security operations as quite decent. I appreciate the automatic alerting system where any incidents or alerts we receive come directly to our email. From there, we can open the email, go directly to Microsoft Defender XDR, and start our investigations and remediations. I perceive the integration of security and identity access management in Microsoft Defender XDR as affecting my identity protection strategies very well because it is well integrated with Purview, integrated well with Entra ID, and integrated well with Exchange. I especially appreciate MDO, the Office product. If anything happens and I want to conduct an investigation, it takes me directly to Exchange, where I can also investigate any emails or phishing incidents. Instead of going to different portals, everything can be done from Microsoft Defender XDR. If necessary for further investigation, Microsoft Defender XDR then directs me to that environment. I would assess the integration of AI in guiding security actions within Microsoft Defender XDR as quite positive. Recently, Security Copilot went big, and it is beneficial that I can use that, especially to write KQL. I can do threat hunting features and intelligence all within using Microsoft's Security Copilot. It also has a nice AI feature for threat hunting. I know that all the Defender logs go to Sentinel, and I can pull it up from Microsoft Defender XDR or from Sentinel. The fact that I can actually do all that within Microsoft Defender XDR is a nice feature. In the top module, I can do threat lookups, and I can actually type KQLs in Microsoft Defender XDR and look up incidents. Predictive shielding has had a nice impact on my proactive security measures. It is beneficial that it has, similar to Entra ID, a secure score. For me to improve the product, the secure score helps me out. If I rate it from highest to lowest, I can see what things I can improve. Secure score helps me see what areas I can improve in Microsoft Defender XDR to increase my score and bring it to 80 or more. Knowing Microsoft Defender XDR from using it since 2019, before COVID days, I know that they have improved significantly. It is much more user-friendly and has a very nice vulnerability feature that I find handy and useful. The fact that this feature integrates into Intune is also very decent.
Twinkle Solanki - PeerSpot reviewer
Business development executive at Digitaltrack solution Pvt Ltd
Unified threat detection has improved investigations and now speeds up incident response
While Trellix XDR is a strong platform overall, there are a few areas where it could be improved. The initial setup and configuration can be complex, especially for organizations with diverse environments. Some additional advanced features also have a learning curve and may require extra training for security teams to fully utilize them. Moreover, reporting and dashboard customization could be more flexible, allowing users to create highly customized views and reports more easily. There are also areas that could optimize detection surveys. Addressing these areas would further enhance the overall experience and operational effectiveness. One additional improvement would be deeper integration with a wider range of third-party security tools and cloud platforms. While Trellix XDR integrates with many solutions, simplifying the integration management would help organizations with complex security ecosystems. I would like to see more out-of-the-box reports and executive-level dashboards that make it easier to communicate security metrics to leadership. Finally, continuous enhancement to automation and AI-driven threat prioritization would further reduce analysts' workflow and improve response effectiveness. Overall, these are areas that need refinement rather than being major concerns, as the platform still delivers strong security and operational value.
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
911,493 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
12%
Construction Company
12%
Comms Service Provider
10%
Financial Services Firm
10%
Financial Services Firm
9%
Computer Software Company
9%
Comms Service Provider
7%
Outsourcing Company
7%
Financial Services Firm
14%
Outsourcing Company
14%
Computer Software Company
12%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise21
Large Enterprise54
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise28
Large Enterprise41
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise3
Large Enterprise8
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with the pricing, setup costs, and licensing of Microsoft Defender XDR is that we are on an E5 license,...
What needs improvement with Microsoft 365 Defender?
From my perspective, Microsoft Defender XDR can be improved with better visibility in certain areas where I can trigg...
What is your primary use case for Microsoft 365 Defender?
My main use cases for Microsoft Defender XDR are telemetry, advanced hunting, and the ability to perform host isolati...
What is your experience regarding pricing and costs for Trellix XDR?
My experience with pricing, setup cost, and licensing shows that the pricing is very competitive and not overly expen...
What needs improvement with Trellix XDR?
Price is the main area for improvement in the product. Overall, it seems to be positioned more for larger organizatio...
What is your primary use case for Trellix XDR?
I have used Trellix XDR for two years in a partnership capacity.
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
MVision XDR, MVision eXtended Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Information Not Available
Find out what your peers are saying about Microsoft Defender XDR vs. Trellix XDR and other solutions. Updated: August 2026.
911,493 professionals have used our research since 2012.