What is endpoint detection and response (EDR) software?

EDR software is used to help companies identify and remediate threats related to network-connected endpoints. EDR solutions inform security professionals of vulnerable or infected endpoints and guide them through the remediation process. After incidents have been resolved, EDR tools help teams investigate issues and the vulnerable components that allow an endpoint to become compromised. Continuous monitoring is one of the core capabilities of endpoint detection technologies. These monitoring features provide complete and continuous visibility across a company’s network-connected endpoints. Individuals can monitor behaviors, vulnerabilities, and activity for abnormalities. When abnormalities are identified, the detection portion of EDR technology transitions to the response portion. Endpoint response begins with alerting and containment. Security professionals are alerted of threats present to their systems and isolate potentially compromised endpoints from further network access; this helps prevent one infected endpoint from becoming hundreds. Once systems are properly organized to contain malware and threat actors, security teams can work to remove malware and prevent future access from actors to endpoint devices. EDR platforms store threat data related to security incidents, improving a team's ability to defend against threats in the future by helping them identify root causes and threat actors. Additionally, zero-day exploits may be identified, and other vulnerabilities may be remediated as a result. This will help prevent third-party privilege escalation, malware injection, and unapproved endpoint control from occurring in the future. Some EDR products provide machine learning capabilities to analyze events, improve threat hunting, and reduce false positives by automating protection and remediation processes.

Key benefits of EDR software

Monitor endpoints and detect issues or security incidents Remediate present threats to endpoints Investigate incidents to identify causes Contain threats and restrict access to other endpoints or networks

Why use endpoint detection and response solutions?

Endpoints are some of the most vulnerable components of a business' network structure. One vulnerable endpoint could cause a company’s entire network, databases, and sensitive information to become exposed or stolen. EDR systems will help secure individual endpoints, detect issues as they arise, and contain threats that make their way beyond traditional security structures. Endpoint protection is even more relevant considering the growing popularity of bring-your-own-device (BYOD) policies. When employees are in complete control over downloads, applications, and updates, security must be a priority. Every day professionals are not the most security-savvy individuals and may unintentionally compromise their devices or put business information at risk. Zero-day threats—While traditional prevention tools such as antivirus software or firewall technology are helpful as the first line of defense, zero-day threats are bound to occur. The nature of these threats means they have yet to be discovered and, therefore, cannot be defended against. EDR solutions will help identify new threats as they arise and remediate them before damage occurs. Visibility and control—Continuous monitoring and endpoint visibility help defend against traditional malware and sophisticated threats. Monitoring can help identify known threats as they arise and detect minute details that indicate the presence of advanced threats. Hackers are always developing new ways to enter networks undetected through fileless malware or malicious code injection. Monitoring capabilities will improve a team’s ability to detect anomalies caused by outside actors and threats. Analysis and deterrence — EDR software improves a security organization’s ability to review the data associated with security events, data breaches, and network attacks. The data collected from these events can be reviewed back to the initial onset and used to identify the vulnerability or exploit used. Once identified, security teams and software developers can work collectively to resolve flaws and prevent similar attacks from occurring in the future.

Page 2 | Best Endpoint Detection & Response (EDR) Software Solutions: User Reviews from January 2026

Cortex XDR

Cortex XDR is the industry’s first extended detection and response platform that stops modern attacks by integrating data from any source. With Cortex XDR, you can harness the power of AI, analytics and rich data to detect stealthy threats. Your SOC team can cut through the noise and focus on what matters most with intelligent alert grouping and incident scoring. Cross-data insights accelerate investigations, so you can streamline incident response and recovery. Cortex XDR delivers peace of mind with best-in-class endpoint protection that achieved the highest combined protection and detection scores in the MITRE ATT&CK® round 3 evaluation. The Cortex XDR platform collects and analyzes all data, so you can gain complete visibility and holistic protection to secure what’s next.

Average Rating: 4.5/5.0

Total Reviews: 82

How Do G2 Users Rate Cortex XDR?

Ease of Admin: 8.5/10 (Category avg: 8.8/10)
Has the product been a good partner in doing business?: 9.0/10 (Category avg: 9.0/10)
Quality of Support: 8.7/10 (Category avg: 8.7/10)
Ease of Use: 8.4/10 (Category avg: 8.7/10)

Who Is the Company Behind Cortex XDR?

Seller: Palo Alto Networks
Company Website:
Year Founded: 2005
HQ Location: Santa Clara, CA
Twitter: @PaloAltoNtwks
128,951 Twitter followers
LinkedIn® Page: www.linkedin.com
22,313 employees on LinkedIn®

Who Uses This Product?

Top Industries: Computer & Network Security, Information Technology and Services
Company Size: 41% Medium, 40% Large

What Do G2 Reviewers Say About Cortex XDR?

AI-generated summary from verified user reviews

Pros

Users find the ease of use of Cortex XDR exceptional, appreciating its intuitive interface and effective management.
Users value the rapid and accurate threat detection capabilities of Cortex XDR, enhancing their cybersecurity experience.
Users value the unified detection and response capability of Cortex XDR, enhancing threat investigation efficiency and accuracy.
Users value the intelligent alert system of Cortex XDR, which minimizes unnecessary notifications and enhances focus.
Users value the advanced AI technology in Cortex XDR, which delivers relevant alerts without overwhelming notifications.

Cons

Users experience a noticeable performance impact on lower-end systems when using the Cortex XDR agent.
Users face compatibility issues with Cortex XDR, limiting the installation of certain essential software on their systems.
Users find the complexity of Cortex XDR challenging, especially when customizing detections and tuning policies.
Users find the management complexity of Cortex XDR challenging, with a steep learning curve for policy tuning.
Users find the difficult learning curve of Cortex XDR challenging, especially when tuning policies and customizing detections.

What Are Recent G2 Reviews of Cortex XDR?

"Robust Threat Detection, But a Steep Learning Curve"

Rating: 4.0/5.0 stars

— Dev S.

Best Endpoint Detection & Response (EDR) Software Solutions - Page 2

How Many Endpoint Detection & Response (EDR) Software Products Does G2 Track?

Category Stats (Sep 2026)

How Does G2 Rank Endpoint Detection & Response (EDR) Software Products?

G2 Grid® for Endpoint Detection & Response (EDR) Software

How Do G2 Users Rate Cortex XDR?

Who Is the Company Behind Cortex XDR?

Who Uses This Product?

What Do G2 Reviewers Say About Cortex XDR?

Pros

Cons

What Are Recent G2 Reviews of Cortex XDR?

What Are G2 Users Discussing About Cortex XDR?

How Do G2 Users Rate Cisco Secure Endpoints?

Who Is the Company Behind Cisco Secure Endpoints?

Who Uses This Product?

What Do G2 Reviewers Say About Cisco Secure Endpoints?

Pros

Cons

What Are Recent G2 Reviews of Cisco Secure Endpoints?

What Are G2 Users Discussing About Cisco Secure Endpoints?

How Do G2 Users Rate Todyl Security Platform?

Who Is the Company Behind Todyl Security Platform?

Who Uses This Product?

What Do G2 Reviewers Say About Todyl Security Platform?

Pros

Cons

What Are Recent G2 Reviews of Todyl Security Platform?

How Do G2 Users Rate Microsoft Defender for Endpoint?

Who Is the Company Behind Microsoft Defender for Endpoint?

Who Uses This Product?

What Do G2 Reviewers Say About Microsoft Defender for Endpoint?

Pros

Cons

What Are Recent G2 Reviews of Microsoft Defender for Endpoint?

What Are G2 Users Discussing About Microsoft Defender for Endpoint?

How Do G2 Users Rate WatchGuard Endpoint Security?

Who Is the Company Behind WatchGuard Endpoint Security?

Who Uses This Product?

What Do G2 Reviewers Say About WatchGuard Endpoint Security?

Pros

Cons

What Are Recent G2 Reviews of WatchGuard Endpoint Security?

What Are G2 Users Discussing About WatchGuard Endpoint Security?

How Do G2 Users Rate Carbon Black EDR?

Who Is the Company Behind Carbon Black EDR?

Who Uses This Product?

What Do G2 Reviewers Say About Carbon Black EDR?

Pros

Cons

What Are Recent G2 Reviews of Carbon Black EDR?

What Are G2 Users Discussing About Carbon Black EDR?

How Do G2 Users Rate N-able N-central?

Who Is the Company Behind N-able N-central?

Who Uses This Product?

What Do G2 Reviewers Say About N-able N-central?

Pros

Cons

What Are Recent G2 Reviews of N-able N-central?

What Are G2 Users Discussing About N-able N-central?

How Do G2 Users Rate Trellix Endpoint Security?

Who Is the Company Behind Trellix Endpoint Security?

Who Uses This Product?

What Do G2 Reviewers Say About Trellix Endpoint Security?

Pros

Cons

What Are Recent G2 Reviews of Trellix Endpoint Security?

What Are G2 Users Discussing About Trellix Endpoint Security?

How Do G2 Users Rate Palo Alto Cortex XSIAM?

Who Is the Company Behind Palo Alto Cortex XSIAM?

Who Uses This Product?

What Do G2 Reviewers Say About Palo Alto Cortex XSIAM?

Pros

Cons

What Are Recent G2 Reviews of Palo Alto Cortex XSIAM?

What Are G2 Users Discussing About Palo Alto Cortex XSIAM?

How Do G2 Users Rate Kaspersky Next EDR Expert?

Who Is the Company Behind Kaspersky Next EDR Expert?

Who Uses This Product?

What Do G2 Reviewers Say About Kaspersky Next EDR Expert?