No more typing reviews! Try our Samantha, our new voice AI agent.

Tanium vs ThreatLocker Zero Trust Platform comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
112
Ranking in other categories
Endpoint Detection and Response (EDR) (6th), Extended Detection and Response (XDR) (4th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Tanium
Ranking in Endpoint Protection Platform (EPP)
17th
Average Rating
7.8
Reviews Sentiment
6.2
Number of Reviews
22
Ranking in other categories
Server Monitoring (4th), Vulnerability Management (26th), Endpoint Detection and Response (EDR) (22nd), Unified Endpoint Management (UEM) (7th)
ThreatLocker Zero Trust Pla...
Ranking in Endpoint Protection Platform (EPP)
6th
Average Rating
9.4
Reviews Sentiment
7.1
Number of Reviews
77
Ranking in other categories
Network Access Control (NAC) (4th), Advanced Threat Protection (ATP) (4th), Application Control (1st), ZTNA as a Service (4th), ZTNA (5th), Ransomware Protection (1st)
 

Mindshare comparison

As of June 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.7%, down from 3.8% compared to the previous year. The mindshare of Tanium is 2.4%, down from 2.5% compared to the previous year. The mindshare of ThreatLocker Zero Trust Platform is 1.3%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.7%
ThreatLocker Zero Trust Platform1.3%
Tanium2.4%
Other92.6%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
MA
Division Manager, Information Technology at a legal firm with 51-200 employees
Centralized policies have improved remote endpoint control and have simplified data visibility
The integration is not simple and easy. It requires experienced users or people who have done the implementation. When certain policies are applied, they do not immediately push the policies. For example, we manage endpoint device USB access. We set a policy to block it, but it does not come into effect immediately. Sometimes it takes three or four days for it to reflect. That is a pain point. I have raised this issue with support as well, but they said that I need to limit the number of devices in the policy. In terms of application deployment, for us, it was seamless.
Santo Joy - PeerSpot reviewer
Head Of Cyber Security at a outsourcing company with 201-500 employees
Security controls have been strengthened with granular application, ringfencing, and access policies
The features of ThreatLocker Zero Trust Endpoint Protection Platform that I like the most are the Ringfencing, elevation control, storage control, and application whitelisting functionality. For examples of how these features benefit my company, we were looking for a solution across various vendors to actually implement application whitelisting controls. ThreatLocker's agent, which is very lightweight and does not use much CPU or RAM, helped us achieve that solution. Ringfencing was an add-on that ticked off a lot of Australian framework security controls, which is the reason we chose it. My impression of the allowlisting feature in terms of managing which software, scripts, and libraries run on my devices is that ThreatLocker's community page has a lot of information around this, which is very helpful. Not only that, the Cyber Hero support that ThreatLocker provides gives us insights and best practices, helping us achieve that solution and guiding us to the right platform. The impact of Ringfencing on controlling the behavior of approved applications has been a big winner for us because it is something that many other platforms do not provide as a functionality. Having that allowed us to identify what applications talk to each other, which is something that many other platforms do not do. The network control feature impacts my ability to manage network traffic across my endpoints and servers. We have not used this widely across all our partners, but wherever required, we use it. It has been an easy solution for those customers to get that control implemented. The elevation feature's role in facilitating just-in-time administrative access for approved applications shows that elevation control helps in many use cases involving remote control platforms, door usage, and security system platforms that require local admins. There are many solutions that provide this functionality, but the licensing cost seems to be expensive, and it also adds another solution into the mix. Rather than doing that, we try to use ThreatLocker Zero Trust Endpoint Protection Platform to achieve that control. Regarding the storage control feature, I have used it. The primary function is USB blocking, which is very widely adopted, and also just locking down and allowing certain users to access certain file locations helps us there. When it comes to enforcing policy-driven access over various storage devices, it depends on the business risk adapted by the companies that we support, but generally the use case is USB and external storage devices where companies know that is a risk, but they do not have appropriate solutions. There are EDR platforms that claim to do this, but ThreatLocker Zero Trust Endpoint Protection Platform does it at an advanced level. My assessment of the efficiency of the real-time threat intelligence and category controls employed by Web Control in blocking malicious and non-compliant sites leads me to think that Web Control is another functionality within ThreatLocker Zero Trust Endpoint Protection Platform that is an add-on on top of the current set. That is another solution that we use based on what is required for the company, but again, that is not widely adapted yet for our partners.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is easy to use."
"Based on my experience, I would recommend Cortex XDR by Palo Alto Networks to other people."
"The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past."
"The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices."
"Cortex XDR by Palo Alto Networks saves time in various ways, although the user interface is fairly standard."
"The tool is easy to use."
"From a single pane of glass, you can easily manage all of your endpoints."
"Cortex XDR's most valuable feature is its intelligence-based dashboards."
"The interrogation piece was the most valuable feature because it was very detailed."
"Tanium is a very good product and I would rate it eight or nine out of ten."
"I would say Tanium is the best tool for vulnerability management."
"The insights we gain from our endpoints and the management capabilities that Tanium provides have been a boon to our operations and security."
"I like the fact that you can create patching campaigns depending on the area of your network that you want to address first. I like the ability it has to make several campaigns that work in parallel."
"Tanium is used for endpoint management, specifically patching and configuration management."
"Tanium's most valuable features are patch management, inventory, and distribution software."
"When I push a quick update, it's done right away, and I can rescan immediately to confirm completion within minutes."
"ThreatLocker Zero Trust Endpoint Protection Platform benefits our company because we can be secure while remaining relaxed, as we are only expecting normal behavior and nothing unusual."
"We use it most heavily for elevation control, blocking and giving rights only to certain people or devices, and not allowing the rest to access the software. Elevation control has been second to none for me."
"Blocking is done comprehensively."
"ThreatLocker stands out because they understand application whitelisting and elevation controls deeply, addressing real issues effectively."
"Customer service is good. The Cyber Hero program ensures there is always someone available to help."
"ThreatLocker provides visibility into user activity and application usage, empowering organizations to define acceptable applications and web browsers."
"ThreatLocker Zero Trust Endpoint Protection Platform has helped our company save on operational costs and expenses significantly."
"The most valuable feature is its learning capability."
 

Cons

"The solution needs better reports. I think they should let the customer go in and customize the reports."
"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."
"A better pricing plan would make this product more competitive."
"A little bit more automation would be nice."
"Cortex XDR should have a lightweight agent, and the agent size should not be heavy."
"Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."
"It is not easy to sell Cortex XDR, not because it isn't a good tool. Its marketing needs to be improved."
"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"Tanium’s scalability could be improved."
"Any movement into a SaaS solution has challenges since the processes and data flows are not well defined. Hence, you need to build it at the same time."
"Tanium required local admin or root rights on Mac devices, which did not comply with our security policies. This made the solution less suitable for our restrictive environment."
"They could improve the UI."
"Our biggest issue with the solution is its lack of mobility."
"Tanium's limitations should be improved because although it is a great tool, it is limited to only a few classes during a session."
"The main issues are the network connection because different customers have issues with their networks. It's difficult implementing this type of solution because the network is the main feature in the architecture for these types of solutions. Tanium could improve by creating some network optimization."
"The most painful thing is the interface. It's a bit unclear sometimes."
"Something we have come up against a couple of times is that we have two clients that are software developers. They create software that doesn't have digital signatures and that's not easy to categorize or whitelist with ThreatLocker. We have to go in and make custom rules to allow them to do their work and to be protected from malicious threats."
"Efficiency-wise, it was a bit harder in the beginning because we were new to the product and it was a lot of overhead to manage it."
"Initially, the learning curve was slightly high for me, however, that has been resolved now."
"ThreatLocker University offers many good training modules, but more in-depth training for advanced platforms would be beneficial."
"I have several clients in the last few months that have definitely caused a problem where a domain controller completely destroyed replication once Network Control was put in place, and now our AVD servers in Azure also lose domain trust occasionally and it is intermittent, making it rather hard to prove to ThreatLocker Zero Trust Endpoint Protection Platform that they really need to look at when there is a VPN in the middle of a domain controller."
"The user experience could be improved."
"Scalability is challenging, not due to the platform. Scaling ThreatLocker Zero Trust Endpoint Protection Platform usage requires dedicated resources for maintenance."
"I have encountered some problems with stability, however, they are resolved quickly."
 

Pricing and Cost Advice

"It's about $55 per license on a yearly basis."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"The pricing is a little bit on the expensive side."
"The pricing is okay, although direct support can be expensive."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"The tool's price is moderate."
"Cortex XDR's pricing is ok."
"It is higher than some competitors in the market."
"The solution is expensive but it's a good investment."
"The solution offers value for money."
"The product's pricing differs from region to region depending on negotiations and the number of endpoints."
"There is an annual license required to use this solution."
"It's an expensive solution. It would be nice if the cost were lower."
"Tanium is a more expensive solution in Latin America than some of the competitors, such as BigFix."
"The pricing works fine for me. It's very reasonably priced."
"Although the pricing seems good, there have been inconsistencies in contract negotiations."
"Considering what this product does, ThreatLocker is very well-priced, if not too nicely priced for the customer."
"I do not know about the licensing and price as it comes bundled from our MSP. However, it seems fairly reasonable for us, which is why we chose it."
"We have encountered a few challenges regarding pricing, contract renewals, and additions. As we explored adding features like Cyber Hero, it proved to be an increased expense for our clients. This was primarily a mistake on our part due to how we initially priced it to clients."
"So far, it has been great. I have no complaints. Of course, everybody wishes it was cheaper."
"Its price is fair. They have added some additional things to it beyond allowlisting. They are up-charging for them, but in terms of the value we get and the way it impacts us, we get a bang for our buck with ThreatLocker than a lot of our other security tools."
"I believe ThreatLocker's pricing model is fair and flexible, allowing account managers to offer customized deals based on our specific needs."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
9%
Financial Services Firm
14%
Government
10%
Manufacturing Company
9%
Healthcare Company
7%
Computer Software Company
13%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise52
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise3
Large Enterprise12
By reviewers
Company SizeCount
Small Business53
Midsize Enterprise13
Large Enterprise11
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Tanium?
While there is always room for improvement, I am pleased with Tanium.
What is your primary use case for Tanium?
The primary use case for Tanium ( /products/tanium-reviews ) is compliance, patching, and inventory as part of the co...
What advice do you have for others considering Tanium?
For smaller companies, Tanium is quite a big investment, and one needs to have a considerable setup to make it econom...
What is your experience regarding pricing and costs for ThreatLocker Allowlisting?
My experience with pricing, setup cost, and licensing for ThreatLocker Zero Trust Endpoint Protection Platform is goo...
What needs improvement with ThreatLocker Allowlisting?
My experience with ThreatLocker Zero Trust Platform has been fairly good with not a lot of complaints. If I have to s...
What is your primary use case for ThreatLocker Allowlisting?
I currently work in the Enterprise GitLab platform for Scania where we have a lot of users using our GitLab platform ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Tanium Inc Cloud, Tanium XEM
Protect, Allowlisting, Network Control, Ringfencing
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
JPMorgan Chase, eBay, Amazon, US Bank, MetLife, pwc, Cerner, Delphi, MGM Grand, New York Life
Information Not Available
Find out what your peers are saying about Tanium vs. ThreatLocker Zero Trust Platform and other solutions. Updated: June 2026.
900,644 professionals have used our research since 2012.