Palo Alto Networks Cortex XDR is an endpoint security and detection-and-response product that combines prevention, endpoint telemetry, investigation, response, and cross-source analytics.
Research by Global Tool Radar Research SystemEvidence checked: Sep 23, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
Best for
You need endpoint prevention together with correlated investigation across endpoint, network, cloud, identity, and email data: Cortex XDR is positioned to connect those telemetry sources, prioritize attacks with AI, and support endpoint protection workflows.
Your security team requires endpoint and third-party log collection for detection and investigation: Cortex XDR Pro per Endpoint is the documented license for tailored endpoint and third-party log collection.
More buying conditions
You need native automated disruption and response after investigation: The product page states that analysts can run native automation to disrupt an attack after tracing alert execution paths.
Not for
You require 24/7 managed detection and response to be included in the base endpoint license: Palo Alto Networks presents 24/7 managed defense as Cortex XDR used with separately scoped Unit 42 services.
You need guaranteed Pro-level capabilities for more endpoints than you license: When available Pro per Endpoint capacity is exhausted, affected endpoints fall back to Prevent policy and do not retain Pro-specific capabilities.
Pricing
Sales-assisted endpoint licensing with documented Prevent and Pro per Endpoint editions; optional data, retention, forensics, and managed-service scope may expand the purchase.
Paid amounts unverified — check official pricing
Free or trial access
No permanent free plan is stated. The official product page offers a personal demo, but no time-limited trial duration or trial entitlement is stated.
Product scope
Product functionality and purchase scope
This profile evaluates Cortex XDR endpoint security, centered on the documented Cortex XDR Prevent and Cortex XDR Pro per Endpoint license editions for endpoint protection, detection, investigation, and response.
Product checked: Sep 23, 2026
Functionality reviewed
Cortex XDR Prevent endpoint license
Cortex XDR Pro per Endpoint license
Cortex XDR agent endpoint protection and telemetry
Endpoint threat detection, investigation, and native response workflows
Non-target functionality excluded from scoring
Cortex XDR Cloud per Host
Cortex XDR Pro per Gigabyte
Cortex XSIAM
Cortex XSOAR
Cortex Xpanse
Unit 42 managed detection and response services
Extended Threat Hunting Data, Forensics, Host Insights, retention, and other optional add-ons unless separately purchased
Purchase paths
Pricing checked: Sep 23, 2026
Cortex XDR with Unit 42 Services: A related managed-services route combining Cortex XDR with Unit 42 managed detection and response, threat hunting, incident response, or cyber risk management services.
Pricing plans
Palo Alto Networks Cortex XDR pricing table
Pricing checked: Sep 23, 2026
Official factConfidence 83%2 linked sources
Palo Alto Networks directs buyers to contact its team for a Cortex XDR demo. The reviewed official product and license-plan sources identify Prevent and Pro per Endpoint editions, but do not disclose United States public list prices, billing cadence, minimum purchase, renewal terms, or contract commitments.
Public pricing and contract terms are not disclosed in the reviewed official sources: Buyers should obtain a written quote covering endpoint capacity, optional modules, retention, implementation, billing cadence, minimum purchase, and renewal terms.
Advanced data collection and retention can require separately purchased components: XTH expands collection, while retention and forensics documentation identifies purchasable add-ons and separate requirements.
Multilayer endpoint prevention: Blocks malware, ransomware, behavioral-based attacks, and exploits; includes device control, firewall protection, and disk encryption; Applies to the Cortex XDR Prevent license.
Organizations primarily seeking multilayer endpoint prevention and protection controls.
Cortex XDR Pro per EndpointCortex XDR Pro per Endpoint licenseSupporting pricing evidenceAmount unverified — check official pricing
Endpoint and third-party log collection: Tailored data collection for detection and investigation visibility; Applies to the Cortex XDR Pro per Endpoint license.
Pro capability capacity: Limited to the number of agents allocated by the license; Endpoints above available Pro per Endpoint capacity fall back to Prevent policy after the documented grace period.
Security teams that need endpoint and third-party log collection for detection and investigation visibility.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
Cortex XDR Prevent → Cortex XDR Pro per Endpoint
The buyer needs tailored endpoint and third-party log collection for broader detection and investigation visibility.
Pro-level endpoint and third-party log collection for detection and investigationPlan-dependent capability
Pro per Endpoint supplies the documented tailored collection capability; the current license-allocation documentation says Prevent fallback does not include Pro-specific capabilities.
Plan: Cortex XDR Prevent: Unavailable · Cortex XDR Pro per Endpoint: Included
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
Evidence confidence
80%
AI claim confidence
90%
Required-field evidence status
76%
Evidence freshness
100%
Field traceability
100%
Model agreement
96%
Why this confidence level
Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
6 of 8 weighted claims have evidence links.
3 A1 documentary official sources and 1 A2 official product sources are linked.
2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
No weighted claim is past the review window.
No blocking evidence conflict was identified.
Endpoint behavioral detection quality30%
81
Cortex XDR Prevent includes multilayer endpoint prevention for malware, ransomware, behavioral-based attacks, and exploits, which supports behavioral detection use cases, but the supplied facts do not quantify detection performance or tuning depth.
Investigation telemetry depth25%
81
Cortex XDR Pro per Endpoint adds endpoint and third-party log collection for detection and investigation visibility, and the product also correlates endpoint, network, cloud, identity, and email data, giving investigators broader telemetry coverage with the boundary that deeper collection is tied to Pro scope and optional extensions.
Response and remediation effectiveness20%
76
The product includes native automation for attack disruption, which supports response workflows, but the facts do not establish the full remediation toolset, recovery workflow depth, or incident orchestration scope.
Threat hunting workflow15%
71
The product supports investigation visibility across multiple signal sources and includes AI-assisted detection and attack prioritization, which can help hunting workflows, but the supplied facts do not establish dedicated hunting content, query depth, or hunting governance controls.
Endpoint scale operations10%
67
Pro capability is limited to the number of agents allocated by the license, and over-capacity endpoints fall back to Prevent policy after the documented grace period, so operational scale is workable but explicitly constrained by licensed capacity and SKU management.
Public review signals
Cortex XDR has favorable public ratings across three product profiles
The retained profiles show positive aggregate ratings, while Capterra and TrustRadius include some historical Traps-era feedback and should be interpreted with that continuity in mind.
Public review signals updated: Aug 10, 2026
Capterra4.4/5
Review count
18 reviews
Source context
Cortex XDR on CapterraDocumented product successor
View sourceHistory baseline established: Aug 10, 2026
TrustRadius8.5/10
Reviews and ratings
77 reviews and ratings
Source context
Cortex XDR on TrustRadiusExact product
View sourceHistory baseline established: Aug 10, 2026
Multilayer endpoint prevention for malware, ransomware, behavioral-based attacks, and exploits
Endpoint device control, firewall protection, and disk encryption
Correlation of endpoint, network, cloud, identity, and email data
AI-assisted detection and attack prioritization
Endpoint and third-party log collection with Cortex XDR Pro per Endpoint
Native automation for attack disruption
Detailed strengths and purchase cautions
Pros
Why it is worth considering
Cortex XDR Prevent includes multilayer endpoint prevention for malware, ransomware, behavioral-based attacks, and exploits, plus device control, firewall protection, and disk encryption.
Cortex XDR Pro per Endpoint adds endpoint and third-party log collection for detection and investigation visibility.
The product is documented to correlate endpoint, network, cloud, identity, and email data, which supports cross-source investigation workflows.
Native automation for attack disruption can support response workflows when a buyer wants more than detection alone.
Cons
What to confirm before buying
Public pricing, billing cadence, minimum purchase, renewal terms, and contract commitments are not disclosed in the reviewed official sources, so buyers need a sales quote before commercial comparison.
Pro-specific capabilities are limited by the number of agents allocated by the license, and endpoints above capacity fall back to Prevent policy after the documented grace period.
Advanced collection, retention, forensic data, and managed defense may require separately purchased add-ons or services.
Unit 42 MDR is not included in the base endpoint license, so buyers needing managed detection and response must scope that separately.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
Response and remediation effectiveness: 74–77 (3-point range)
GPTAI-assisted buyer perspective77
Cortex XDR fits buyers that want endpoint prevention, detection, investigation, and response in one sales-assisted product, especially when they can use endpoint and third-party log collection on Pro per Endpoint and correlate signals across endpoint, network, cloud, identity, and email. The main purchase checks are the exact SKU, the purchased endpoint capacity for Pro-specific capabilities, and any add-ons for retention, forensics, or managed service scope.
Review confidence
77/100
Model details
Strengths
Cortex XDR Prevent includes multilayer endpoint prevention for malware, ransomware, behavioral-based attacks, and exploits, plus device control, firewall protection, and disk encryption.
Cortex XDR Pro per Endpoint adds endpoint and third-party log collection for detection and investigation visibility.
The product is documented to correlate endpoint, network, cloud, identity, and email data, which supports cross-source investigation workflows.
Native automation for attack disruption can support response workflows when a buyer wants more than detection alone.
Cautions
Public pricing, billing cadence, minimum purchase, renewal terms, and contract commitments are not disclosed in the reviewed official sources, so buyers need a sales quote before commercial comparison.
Pro-specific capabilities are limited by the number of agents allocated by the license, and endpoints above capacity fall back to Prevent policy after the documented grace period.
Advanced collection, retention, forensic data, and managed defense may require separately purchased add-ons or services.
Unit 42 MDR is not included in the base endpoint license, so buyers needing managed detection and response must scope that separately.
xAIAI-assisted buyer perspective73
Cortex XDR fits security operations teams that want multilayer endpoint prevention plus cross-source detection, investigation, and automated disruption in a sales-assisted enterprise purchase, provided Pro agent capacity, optional data modules, and exact SKU entitlements are confirmed in the quote.
Review confidence
73/100
Model details
Strengths
Prevent includes multilayer endpoint controls that block malware, ransomware, behavioral-based attacks, and exploits while also covering device control, firewall protection, and disk encryption.
The product correlates endpoint activity with network, cloud, identity, and email signals and applies AI-assisted detection with attack prioritization for SOC triage.
Pro per Endpoint adds tailored endpoint and third-party log collection that expands detection and investigation visibility beyond prevention-only controls.
Native automation for attack disruption supports response actions inside the same product used for prevention and investigation.
Cautions
Public list prices, billing cadence, minimum purchase, renewal terms, and contract commitments are not disclosed and require a written sales quote.
Pro-specific capabilities apply only to the number of licensed agents, and endpoints above that capacity fall back to Prevent policy after the documented grace period.
Unit 42 managed detection and response is a related service rather than an included base-license entitlement.
Extended Threat Hunting Data, retention, forensics, and managed defense may require separately purchased add-ons or services beyond the core Prevent or Pro endpoint license.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
Official sources
4
Broad product review sources
2
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Sep 23, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handling
Unresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.
Verified findingsMultilayer endpoint prevention for malware, ransomware, behavioral-based attacks, and exploits
Endpoint device control, firewall protection, and disk encryption
Correlation of endpoint, network, cloud, identity, and email data
AI-assisted detection and attack prioritization
Endpoint and third-party log collection with Cortex XDR Pro per Endpoint
Native automation for attack disruption
Optional Extended Threat Hunting Data for expanded collection
Palo Alto Networks directs buyers to contact its team for a Cortex XDR demo. The reviewed official product and license-plan sources identify Prevent and Pro per Endpoint editions, but do not disclose United States public list prices, billing cadence, minimum purchase, renewal terms, or contract commitments.
Verification notes and unresolved itemsNo permanent free plan is stated. The official product page offers a personal demo, but no time-limited trial duration or trial entitlement is stated.
Sales-assisted endpoint licensing with documented Prevent and Pro per Endpoint editions; optional data, retention, forensics, and managed-service scope may expand the purchase.
No public numeric starting price is stated on the reviewed official Cortex XDR product and licensing sources.
The reviewed official product page is a demo-contact route and does not display a numeric United States price, billing cadence, minimum purchase, commitment term, renewal term, permanent free edition, or time-limited trial term.
The current license comparison explicitly names Cortex XDR Prevent and Cortex XDR Pro per Endpoint.
It is a security solution that combines visibility into network traffic, user behavior, and endpoint activity with prevention, detection, investigation, and response workflows.
What is the difference between Cortex XDR Prevent and Pro per Endpoint?
Prevent provides multilayer endpoint protection controls. Pro per Endpoint adds tailored endpoint and third-party log collection for detection and investigation visibility.
Is Cortex XDR publicly priced?
No public numeric price, billing cadence, or contract term was stated in the reviewed official product and license-plan sources; Palo Alto Networks provides a demo-contact route.
Is Unit 42 MDR included with Cortex XDR?
No. Palo Alto Networks presents Unit 42 managed detection and response as a related service used with Cortex XDR.
Popular comparisons
Common Palo Alto Networks Cortex XDR comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.