G2

Verified User in Investment Management

Enterprise (> 1000 emp.)

10/23/2026

"Cortex XDR Simplifies Endpoint Security with a Unified Console and Reliable AI Detection"

4.5/5

What do you like best about Cortex XDR?

What I like most about Cortex XDR is how much it simplifies our endpoint security. The single console brings endpoint, network and cloud alerts together, and related alerts are grouped into one incident, so I can follow an attack story without switching between tools. It works well with Palo Alto firewalls and sends alerts straight into SIEM, which keeps our SOC working from one view. The agent is light on Windows, Linux and Mac machines, definitions update on their own, and the SaaS platform has been very reliable. Having one agent instead of separate antivirus and EDR tools has cut down tool sprawl and given us better value. Rollout across a large estate was simple, coverage gaps are easy to spot, and Palo Alto support has been responsive. Above all, I value the AI driven behavioural detection, which catches threats that signature tools miss, and the way it keeps getting better at filtering out false positives as we close them correctly. Review collected by and hosted on G2.com.

What do you dislike about Cortex XDR?

What I dislike most about Cortex XDR is that it doesn't cover our full estate. AIX and mainframe systems aren't supported, and once an operating system reaches end of life, Palo Alto stops providing agents for it, which leaves legacy servers exposed and pushes us into exception handling. On some applications, the agent has caused compatibility or performance problems, so we've had to disable it and record the reason, which adds work and leaves a gap. The console is powerful but takes time to learn, and tuning out false positives early on takes real analyst effort before the alerts settle down. Integrations outside the Palo Alto ecosystem work, but they don't feel as smooth as the native ones. Licensing is also on the expensive side compared with bundled alternatives such as Microsoft Defender, which makes it harder to prove ROI to the business. I'd also like onboarding guidance that is clearer and better suited to complex enterprise environments, and more transparency into how the AI reaches its detection decisions. Review collected by and hosted on G2.com.

What problems is Cortex XDR solving and how is that benefiting you?

Cortex XDR replaces separate security tools with one agent that protects our Windows, Linux and Mac endpoints and servers, both on premises and in the cloud. Its behavioural detection catches threats that signature tools miss, and it automatically blocks suspicious files. The biggest benefit for me is faster investigations: related alerts are grouped into one incident and sent to SIEM, so our SOC can triage and respond from a single view. Regular coverage checks show that devices are protected, false positive tuning keeps alert noise low, and it's easier to evidence our controls for audit, which lets the team focus on real threats. Review collected by and hosted on G2.com.