Palo Alto Networks Cortex XDR review

Cortex XDR is Palo Alto Networks' answer for security teams that need endpoint protection tied to everything else. It connects endpoint, network, cloud, identity and email data and uses AI to detect and prioritize attacks; Palo Alto notes that 87% of attacks span multiple vectors. On the endpoint it combines behavioral analytics with Agentic Endpoint Security to stop zero-day exploits, fileless malware and unmanaged AI tools. The Cortex AgentiX Assistant adds AI agents that investigate and respond, and the same sensor can extend to NG-SIEM, endpoint data loss prevention, exposure management, email and cloud security. Unit 42 offers managed detection and response, managed threat hunting and incident response inside the customer's tenant. Palo Alto lists a Leader position in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms. It is the most capable platform on this list for a SOC, but there is no public price, and a small IT team will not use most of it.

Who it is for

Enterprise security operations teams that correlate data across many sources

Price

See vendor pricing (USD check pending).

US price check pending. See the vendor pricing page.

Key features

• Detection across endpoint, network, cloud, identity and email data with AI
• Agentic Endpoint Security for autonomous AI agents and unmanaged AI tools
• Cortex AgentiX Assistant with AI agents that investigate and respond
• NG-SIEM, endpoint DLP and exposure management on the same sensor
• Unit 42 managed detection and response inside the Cortex XDR tenant

Strengths and weaknesses

• Strength: Correlates far more data sources than endpoint-only tools
• Strength: Strong third-party test record listed by the vendor
• Strength: Managed services from Unit 42 run in the same tenant
• Weakness: No public price
• Weakness: Built for SOC teams, heavy for a small IT department
• Weakness: Many capabilities depend on other Cortex products

Key facts

• Data sources: Endpoint, network, cloud, identity, email
• Industry recognition: Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms
• Managed service: Unit 42 MDR
• Pricing: Quote based

Where it ranks

Palo Alto Networks Cortex XDR is No. 9 in our Best Endpoint Security Software verdict.