No more typing reviews! Try our Samantha, our new voice AI agent.

Symantec XDR vs Trellix Endpoint Security Platform comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
112
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Symantec XDR
Ranking in Extended Detection and Response (XDR)
49th
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
Trellix Endpoint Security P...
Ranking in Extended Detection and Response (XDR)
8th
Average Rating
8.0
Reviews Sentiment
6.7
Number of Reviews
168
Ranking in other categories
Endpoint Protection Platform (EPP) (7th), Endpoint Detection and Response (EDR) (9th)
 

Mindshare comparison

As of June 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.6%, down from 5.1% compared to the previous year. The mindshare of Symantec XDR is 0.5%, up from 0.1% compared to the previous year. The mindshare of Trellix Endpoint Security Platform is 3.4%, up from 3.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks4.6%
Trellix Endpoint Security Platform3.4%
Symantec XDR0.5%
Other91.5%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
BR
Cyber Security Consultant at I(TS)² Saudi Arabia
A scalable and stable solution with straightforward deployment
We can generate maps from the environment. For example, suppose there is a virus that has a zero-day attack and is publicly unknown. We can block that and keep it away from the network so it is not further replicated. It also has custom white and black lists. We can add a good reputation on both lists and use the sonar technology for Symantec and the online network for advanced reports.
PankajKumar24 - PeerSpot reviewer
IT Manager at Gigabit Technologies Pvt Ltd
Advanced threat prevention has strengthened incident response and customized security workflows
The biggest advantage of Trellix Endpoint Security Platform is the ATP solution, which provides advanced threat prevention. Machine learning algorithms are available in the product as part of the threat anti-malware, including predictive machine learning and behavioral analysis, which are integral to the anti-malware module of EPP. In terms of my experience with the machine learning algorithms for analysis and threat detection, we are analyzing logs provided by Trellix, but we are not able to conduct specific machine learning analysis on those logs. The automated response mechanisms in the products help with incident management because we have to create playbooks in Trellix console for automation, which we need to enable. The customizable dashboard of Trellix Endpoint Security Platform definitely contributes to the decision-making process, as we customize the dashboard according to customer requirements. When it comes to integration aspects, we are able to integrate Trellix Endpoint Security Platform with SIEM or SOAR solutions using the ePO console, which enhances threat detection capabilities. Reporting and analytics aspects have an impact on security posture assessment, as we are able to fetch reports in the ePO console customized according to customer requirements for downloading and sending via email.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Has great threat detection capabilities."
"They did what they said, and this solution could apply to any scenario."
"Its ability to react to cyber data attacks is awesome. That is pretty much the use of it. What blows your mind is the ability to access your assets remotely and see what is actually going on with them. You can not only see them in a console. You can also react very rapidly to your assets that are compromised."
"My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one."
"The tool is designed to scale for large enterprises and handle large volumes of data."
"The product is very good, it has caught a lot of exploits that most products would not."
"From the Palo Alto side, whatever they buy, they integrate that really well into their integration suite, and that makes a massive difference."
"The stability of this product is very good."
"You can advise the solution and protect your environment."
"We can block a virus that has a zero-day attack and is publicly unknown and keep it away from the network so it is not further replicated."
"The most valuable features are the adaptive tech on McAfee."
"What I like best is the integrated end-to-end security that works with the security information and events manager."
"I would recommend this solution."
"The features we have found most valuable have been containment as well as the ability to triage agent activities."
"The most valuable feature of Trellix Endpoint Security is its extensive customization capability, which allows me to create and deploy policies autonomously, suiting my individual needs."
"I have not faced any problems with scalability so far, but we are starting an upgrade or overhaul."
"It is very valuable in finding out unknown malware."
"Provides protection against threats."
 

Cons

"I feel that it should not be a licensed activity because a feature should allow us to see applications running on end devices."
"There are some default policies which sometimes affect our applications and cause them to run around."
"The configuration could be simplified. I would like to see better protection, specifically to protect email applications."
"It should support more mobile operating systems. That is one of the cons of their infrastructure right now."
"We would also like to have advanced tech protection and email scanning."
"Currently, we are monitoring all USB drives and ports but we would like to improve our device control capabilities."
"However, if you do not have Palo Alto in your environment, you are paying these additional services just for Cortex XDR by Palo Alto Networks, so it is not a cost-effective solution."
"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"The solution should have better reporting."
"The Linux support is very poor."
"Sometimes, while installing the ePO, we were getting so many errors and I don't know why it happened."
"Its pricing needs to be improved."
"The agent is very heavy, so we have to ensure that we have a lightweight agent for Windows systems."
"In our experience, McAfee Endpoint Protection could improve the word control feature."
"Patch management is unavailable"
"The solution can be expensive."
"In some cases, the detection part was not accurate enough. We even had some incidents that were not detected."
 

Pricing and Cost Advice

"Cortex XDR’s pricing is very reasonable."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"I don't like that they have different types of licenses."
"Cortex XDR by Palo Alto Networks is an expensive solution."
"The price is on the higher side, but it's okay."
"I am using the Community edition."
"The pricing is a little bit on the expensive side."
Information not available
"Pricing for McAfee MVISION Endpoint is not very good, and I would rate its cost three out of five, though I won't be able to mention how much its actual price is."
"Customers would need to purchase a license. If a customer purchases an MVISION Endpoint license, he may use that license to install ENS. It's a flexible license where you have the option to either use the McAfee security software or the Windows Defender managed by McAfee, which is MVISION Endpoint."
"I don't think there are any extra expenses besides its licensing costs."
"I think Trellix is more on the higher side of the market, just on a general scale, but I also think it depends on what particular package you choose."
"The price of the product is similar to the ones in the market that offer the same features."
"There are some extra expenses for using the product, in addition to licensing related to the maintenance of the product."
"They should reduce the cost or make it free, open-source software."
"This product is costly."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
900,747 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
9%
No data available
Manufacturing Company
11%
Financial Services Firm
11%
Government
9%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise52
No data available
By reviewers
Company SizeCount
Small Business68
Midsize Enterprise39
Large Enterprise67
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Ask a question
Earn 20 points
How does McAfee Endpoint Security compare with MVISION?
The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deplo...
How does Crowdstrike Falcon compare with FireEye Endpoint Security?
The Crowdstrike Falcon program has a simple to use user interface, making it both an easy to use as well as an effec...
What is your experience regarding pricing and costs for McAfee Endpoint Security?
I don't have visibility on pricing because it is negotiated by a different team, as I look after the technical side.
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
McAfee Endpoint Security, McAfee Endpoint Protection, Intel Security Total Protection for Endpoint, McAfee Complete Endpoint Protection, Trellix Endpoint Security (ENS)
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
inHouseIT, Seagate Technology
Find out what your peers are saying about CrowdStrike, SentinelOne, TrendAI and others in Extended Detection and Response (XDR). Updated: June 2026.
900,747 professionals have used our research since 2012.