No more typing reviews! Try our Samantha, our new voice AI agent.

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Palo Alto Networks Cortex XSOAR offers excellent automation and playbook creation, significantly improving response times in a SOC environment.
The orchestration features provide a high-level overview of critical log information, aiding in efficient data management and monitoring.
The integration capabilities of Cortex XSOAR with other platforms are seamless, enhancing overall security operations and incident management.
Cortex XSOAR's extensive library of plugins and integrations allows for easy deployment and out-of-the-box functionality with various tools.
The use of Palo Alto Networks Cortex XSOAR has improved mean time to resolution (MTTR) for incidents, enhancing security SOC operations by more than 80% to 90%.

CONS

Documentation for building automation is insufficient and requires improvement.
Palo Alto Networks Cortex XSOAR lacks EBA functionality and SIEM features.
The scalability and flexibility of Palo Alto Networks Cortex XSOAR are limited, impacting usability and integration.
The pricing model for Palo Alto Networks Cortex XSOAR is expensive compared to competitors.
System performance issues arise during high alert influx, leading to a slowdown in information access.
 

Palo Alto Networks Cortex XSOAR Pros review quotes

CC
Enterprise Security Architect V at FirstEnergy
May 12, 2025
What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali.
Sricharan R - PeerSpot reviewer
Lead Application Security Engineer Iv at a financial services firm with 5,001-10,000 employees
Mar 6, 2026
Palo Alto Networks Cortex XSOAR has had a huge impact on our organization's mean time to resolution for incidents, improving the security SOC operations efficiency tremendously, by more than 80% to 90%.
DayaramGoyal - PeerSpot reviewer
Vice President, Technology at Cache Digitech Pvt Ltd.
Aug 18, 2025
Palo Alto Networks Cortex XSOAR is a good product with enhanced and efficient playbooks, as demonstrated during our use case simulations.
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
893,311 professionals have used our research since 2012.
AP
Assistant Security Architect at Cloudnomics
Mar 2, 2026
Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise.
NikhilSharma2 - PeerSpot reviewer
Manager at Deloitte
Aug 23, 2024
The orchestration in XSOAR is significantly easier compared to other SOAR tools I've used.
Engineerinfosec67 - PeerSpot reviewer
Presale Engineer at Westcon-Comstor
Dec 23, 2024
Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents.
Shubham Pandharpote - PeerSpot reviewer
Cyber Security Analyst at Altisec Technologies Pvt Ltd
Sep 24, 2024
The most valuable features of Cortex XSOAR include its vast library of plugins, which allow us to integrate various tools and solutions seamlessly.
Chetankumar Savalagimath - PeerSpot reviewer
Delivery Manager at a tech services company with 1,001-5,000 employees
Oct 19, 2023
For organizations that are stable with their security operations, like those with around 50 members in their security team running full-phased operations 24/7, Cortex is necessary.
Jasmin Surani - PeerSpot reviewer
Senior Cybersecurity Engineer (Security Operations & Engineering) at a manufacturing company with 10,001+ employees
Jan 3, 2024
The most valuable feature is its capability to automate responses and collect information for any security event before you even delve into the details. It's a vast product with an active roadmap, so I'm satisfied with it for now. It's very efficient at data collection and correlation.
Iskandar Iskak - PeerSpot reviewer
Director Sales for Education Market at Telekom Malaysia
May 23, 2023
The repository of playbooks and the integration between Palo Alto and IBM QRadar are some useful features
 

Palo Alto Networks Cortex XSOAR Cons review quotes

CC
Enterprise Security Architect V at FirstEnergy
May 12, 2025
One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation.
Sricharan R - PeerSpot reviewer
Lead Application Security Engineer Iv at a financial services firm with 5,001-10,000 employees
Mar 6, 2026
I think the areas of Palo Alto Networks Cortex XSOAR that could be improved are mainly in UX.
DayaramGoyal - PeerSpot reviewer
Vice President, Technology at Cache Digitech Pvt Ltd.
Aug 18, 2025
It was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
893,311 professionals have used our research since 2012.
AP
Assistant Security Architect at Cloudnomics
Mar 2, 2026
While I personally appreciate this approach, I have observed that junior analysts on my team find it difficult to build playbooks.
NikhilSharma2 - PeerSpot reviewer
Manager at Deloitte
Aug 23, 2024
The user interface (UI) is quite heavy and takes time to load, which is a major drawback.
Engineerinfosec67 - PeerSpot reviewer
Presale Engineer at Westcon-Comstor
Dec 23, 2024
The product can be tailored for each deployment to respond to specific customer needs, and this complexity may be seen as a downside.
Shubham Pandharpote - PeerSpot reviewer
Cyber Security Analyst at Altisec Technologies Pvt Ltd
Sep 24, 2024
Creating complex playbooks using coding languages, such as Python, could be easier.
Chetankumar Savalagimath - PeerSpot reviewer
Delivery Manager at a tech services company with 1,001-5,000 employees
Oct 19, 2023
Previously, when Demisto was, there was a community edition; we could use it, reinstall it, and customize it. Since Palo Alto took over, it has become more financially oriented. It's business, but they could offer a pro model and a lighter model for different needs.
Jasmin Surani - PeerSpot reviewer
Senior Cybersecurity Engineer (Security Operations & Engineering) at a manufacturing company with 10,001+ employees
Jan 3, 2024
There is room for improvement in support. The response time could be faster.
Iskandar Iskak - PeerSpot reviewer
Director Sales for Education Market at Telekom Malaysia
May 23, 2023
It is not a very scalable solution.