No more typing reviews! Try our Samantha, our new voice AI agent.

SentinelOne Singularity Endpoint vs Trellix XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 9, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
5th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
SentinelOne Singularity End...
Ranking in Extended Detection and Response (XDR)
2nd
Average Rating
8.8
Reviews Sentiment
7.1
Number of Reviews
237
Ranking in other categories
Security Information and Event Management (SIEM) (6th), Endpoint Protection Platform (EPP) (3rd), Anti-Malware Tools (2nd), Endpoint Detection and Response (EDR) (2nd), AI-Powered Cybersecurity Platforms (3rd), AI Observability (4th)
Trellix XDR
Ranking in Extended Detection and Response (XDR)
35th
Average Rating
8.0
Reviews Sentiment
7.3
Number of Reviews
4
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.1% compared to the previous year. The mindshare of SentinelOne Singularity Endpoint is 5.9%, up from 5.0% compared to the previous year. The mindshare of Trellix XDR is 0.8%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
SentinelOne Singularity Endpoint5.9%
Cortex XDR by Palo Alto Networks4.7%
Trellix XDR0.8%
Other88.6%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Vaibhav Mahendra Kolhe - PeerSpot reviewer
Soc Analyst at Softcell Technologies Limited
Automation has reduced alerts and freed the soc team to focus on faster incident response
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.
Ahmed El-Sakka - PeerSpot reviewer
Solutions Architect at Mideast Communication Systems-MCS
AI-driven threat hunting has boosted incident response and simplifies unified security management
The AI-assisted troubleshooting and threat hunting capabilities, along with the machine learning functionality, are the biggest advantages of Trellix XDR that stand out for me. The automated threat detection part is used for security, and it is part of the offering. The core functionality includes EDR and NDR, and Trellix XDR gets threat detection on both the network and endpoint levels. Trellix XDR adds the excellent threat hunting capabilities as well, and it includes forensics. Regarding contextual data enrichment, it helps me prioritize threats with Trellix XDR. The data enrichment is intent-based, where I can describe what I want to see, and it will retrieve that information for me. It provides logs and feedback in very understandable English commands when it comes to context. This is accomplished through their use of AI.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cortex XDR by Palo Alto Networks has helped lighten the load of our security analysts because it was the major tool that we were using and the one we utilized most."
"Best solution for avoiding security breaches, malware attacks, and other kinds of security issues."
"Its interface and pricing are most valuable, and it is better than other vendors in terms of security."
"It can automatically correlate events and logs, which is very helpful for an IT administrator. It can correlate different kinds of malware activities over a network, agent, or host system. You do not need to do it manually. It is a good feature. It is also a user-friendly solution. We have deployed it on the cloud because our space does not provide any flexibility for on-premises deployment, but Palo Alto has added some flexibility to install it on-premises. It must be like the same Cortex XDR agent for all the VPN services, web filtering services, and everything else."
"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"The product's initial setup phase is very easy."
"Cortex XDR features advanced threat detection capabilities."
"I like the centralized console and the predictive analysis it does of malware. It is very stable and also scalable."
"Singularity Complete has helped reduce alerts."
"Tracking down which devices don't currently have SentinelOne on them is the most valuable feature of the product."
"Overall, it's effectiveness is 100 percent because we don't see many outbreaks anymore."
"The customer support for this solution is good."
"If you want to protect your environment and sleep soundly at night, and if you're in the security industry, I highly encourage you to deploy SentinelOne and just watch what it's capable of."
"The solution works well in general."
"Most of the features are valuable. As a system integrator, agent deployment is valuable. It also fits the requirements of most of the clients."
"The security aspect is the most valuable feature for me."
"The AI-assisted troubleshooting and threat hunting capabilities, along with the machine learning functionality, are the biggest advantages of Trellix XDR that stand out for me."
"Because Trellix gives us multiple types of modules, we are using a single ePO console for multiple solutions including application control, DLP, and XDR."
"The analytics assessment and flexibility of the platform are valuable."
"Trellix XDR is an excellent solution that is continually improving."
"It contributes to our system's robust event detection and analysis, enabling us to respond effectively to incidents."
 

Cons

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control."
"The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."
"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files."
"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."
"The GUI could be improved."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"This is a very costly product."
"Cortex XDR by Palo Alto Networks could improve by offering remote management."
"The ease of use can be better in Deep Visibility. It is not always the easiest. If I have not been in there in the Deep Visibility module for a long time, I do not always find it that easy to use. I tend to go and have to consult the help quite often if I have not been in there a long time."
"I believe that CAM and Clearwater are superior to Singularity Platform."
"From the data security point of view, SentinelOne Singularity Complete is not good."
"The learning curve was a little steep."
"SentinelOne is causing a problem with the data service that causes one of our applications to crash randomly. We're still looking for a permanent fix, but we have implemented a temporary workaround that excludes that application from the scan."
"I am not a fan of the UI and feel it has room for improvement."
"If they can extend their product further on the DLP side of it so that I don't have to have another agent run exclusively for DLP production, that would be ideal."
"SentinelOne's performance and the accuracy of its incident filtering could be improved."
"Technical support is crucial, especially when facing critical issues. It's rated six out of ten. Improvements are needed in the support sector, with a focus on providing expert assistance during production periods."
"The platform should enhance compatibility with all other SIEM solutions."
"Trellix XDR should get involved in AI security itself."
"The EdgeGear solution is an area that requires attention, specifically regarding AI solutions and intelligence features."
"The CPU utilization is very high with Trellix XDR; we are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization, which creates big challenges for us."
 

Pricing and Cost Advice

"The pricing is okay, although direct support can be expensive."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"This is an expensive solution."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."
"It's about $55 per license on a yearly basis."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"SentinelOne Singularity Complete is reasonably priced."
"SentinelOne Singularity Complete's pricing is affordable."
"We buy the licensing in bulk. From a pricing standpoint, because we buy in bulk, we get very good pricing. Based on its functionality and capabilities, it is well worth the price. I do not think it is at all expensive based on what you get in the solution. We use the complete up to the core. Our pricing is probably a little bit more than somebody who is on the core. In general, it is well worth what you get for the price you pay."
"SentinelOne Singularity Complete meets all enterprise requirements and is priced accordingly."
"We are on a subscription model by choice. Therefore, we are paying a premium for the flexibility. We would have huge cost savings if we committed to a three-year buy-in. So, it's more expensive than the other solutions that we were looking at, but we have the flexibility of a subscription model. I think the pricing is fair. For example, if we had a three-year tie-in SentinelOne versus Cylance or one of the others, there is not that much difference in pricing. There might be a few euro or dollars here and there, but it's negligible."
"It is comparatively cheap in the market and provides a good price point."
"Its price is per endpoint per year. One of the features of its licensing is that it is a multi-tenanted solution. From an MSSP point of view, if I want to have several different virtual clouds of customers, it is supported natively, which is not the case with, for example, Microsoft Defender. Another nice thing about it is that you can buy one license if you want to. Some vendors insist that you buy 50 or 100, whereas here, you can just buy one."
"I did not notice a significant increase in cost after adding SentinelOne."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
893,164 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
9%
Manufacturing Company
8%
Computer Software Company
11%
Manufacturing Company
8%
Financial Services Firm
8%
Government
6%
Computer Software Company
18%
Comms Service Provider
10%
Healthcare Company
10%
Financial Services Firm
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise21
Large Enterprise48
By reviewers
Company SizeCount
Small Business109
Midsize Enterprise59
Large Enterprise79
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for SentinelOne Singularity?
It is neither too costly, but definitely, it is one of the advantages that SentinelOne is quite adapted towards the p...
What needs improvement with SentinelOne Singularity?
I have encountered an issue related to the alerting mechanism in SentinelOne Singularity Complete. Sometimes I need t...
What is your experience regarding pricing and costs for Trellix XDR?
Since I'm a technical engineer, I don't deal with pricing or licensing. Our sales team handles those aspects.
What needs improvement with Trellix XDR?
The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solu...
What is your primary use case for Trellix XDR?
We are selling Trellix XDR products including DLP and EPP solutions. We sell Trellix XDR for endpoint protection. We ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Sentinel Labs, SentinelOne Singularity, Singularity Platform
MVision XDR, MVision eXtended Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Information Not Available
Find out what your peers are saying about SentinelOne Singularity Endpoint vs. Trellix XDR and other solutions. Updated: April 2026.
893,164 professionals have used our research since 2012.