Try our new research platform with insights from 80,000+ expert users

Cortex XSIAM vs ServiceNow Security Operations comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XSIAM
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
11
Ranking in other categories
Security Information and Event Management (SIEM) (18th), Identity Threat Detection and Response (ITDR) (7th), AI-Powered Cybersecurity Platforms (8th)
ServiceNow Security Operations
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
20
Ranking in other categories
Security Incident Response (2nd), Security Orchestration Automation and Response (SOAR) (9th), Risk-Based Vulnerability Management (10th)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Cortex XSIAM is designed for Security Information and Event Management (SIEM) and holds a mindshare of 2.6%, up 0.5% compared to last year.
ServiceNow Security Operations, on the other hand, focuses on Security Incident Response, holds 19.2% mindshare, up 11.9% since last year.
Security Information and Event Management (SIEM)
Security Incident Response
 

Featured Reviews

Forrest Stevens - PeerSpot reviewer
A robust security operation that ensures achieving automation, stability, and scalability
There is room for improvement in some areas, and I would highlight three key aspects. Firstly, the Attack Surface Management (ASM) module could benefit from more contextual depth. Currently, it tends to provide a broad overview without enriched context, and there's room for enhancement in this regard. Secondly, further integration capabilities with various other software products that can seamlessly tie into Cortex XSIAM would be advantageous. This would enhance its versatility and interoperability within a broader ecosystem. Regarding performance, there's potential for optimization. When multiple tabs are open in Cortex XSIAM, it can experience slowdowns, leading to longer load times for web pages. It's worth noting that this isn't a severe issue, and it doesn't entail waiting for extended periods, but there is room for improvement in terms of performance optimization.
KishoreKumar4 - PeerSpot reviewer
A low-cost and open-source tool for incident and change management
If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cortex XSIAM enhances our ability to apply endpoint protection policies, implement restrictions, conduct scans, and engage in sandboxing."
"One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities."
"It does a better job of identifying anomalies that are more likely to be incidents of compromise without as many false positives or false negatives."
"It is an effective solution in terms of performance and functionalities."
"The most valuable features of Cortex XSIAM are the machine learning used to identify threats, the complexity of the environment of products, and efficiency."
"I would give Cortex XSIAM a rating of ten out of ten."
"The flexibility for creating manual workflows stands out."
"It operates on a single, extensive database which enables it to excel in detecting threats and anomalies across the network and endpoints, delivering a highly effective and comprehensive security solution."
"The solution is available over the cloud and is easy to manage."
"The "follow" feature is really good. If the user is not responding, there's an option to "follow". Just click on the button, and it will automatically trigger an email to the end user."
"We refer to the setup and installation guide provided by ServiceNow. They have good documentation, which makes it easier to handle the process."
"My favorite feature is the application vulnerability scanner."
"The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product."
"It gives you the ability to bring data into the system. The workflows are out of the box, and it gives you the ability to auto-assign the incidents based on criteria and vulnerabilities."
"The SOAR module of ServiceNow Security Operations is the most valuable feature"
"It has helped optimize security costs by consolidating multiple tools into one platform."
 

Cons

"The solution’s pricing and technical support could be improved."
"I am not sure if any improvements are needed right now."
"The standard integrations are very limited, and the integrations available are not listed in the marketplace. Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long."
"Cortex could improve the detection and online resolution of security vulnerabilities."
"It could provide more integration with a large variety of products."
"The platform isn't very developer-friendly and it should provide more flexibility and ease."
"Further integration capabilities with various other software products that can seamlessly tie into Cortex XSIAM would be advantageous."
"The first impression is that XSIAM would be more expensive than others we tried."
"Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time."
"The solution needs to make customization easier. You cannot do much customization immediately. It requires an extensive workload. If the customization process was user-friendly, it would be much better."
"An area for improvement I observed in ServiceNow Security Operations is the need to maintain correct CMDB data because if you're unable to do this, you can't perfectly maintain the vulnerability data. CMDB data in ServiceNow Security Operations needs to be accurate. As I've been working on ServiceNow Security Operations for only seven months, I still need more time to try all its modules before I can give recommendations regarding additional features I'd like to see in the solution."
"The initial setup is difficult."
"There are limitations for the third-parties that are providing the inputs. They should increase the robustness of the solution."
"They should stick to the roadmap and continue to build plugins and integrations with other third parties, enhance the UI, and enhance the reporting. It's all good. They should just continue enhancing the releases."
"It doesn't interact with things very well."
"One area for improvement for the product is the need to tailor and alter some codes for customization, which can cause issues during upgrades. It does not support customized operations."
 

Pricing and Cost Advice

"In terms of pricing, we found Cortex XSIAM to offer a very reasonable and competitive rate."
"Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing."
"The product cost could be considered value for money compared to other solutions in the market, though it is quite high."
"The solution comes at a significant cost."
"The solution is expensive compared to its competitors."
"Compared to competitor tools, ServiceNow Security Operations is more affordable"
"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."
"The product is more expensive than other solutions."
"It is an expensive product."
"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."
"This product is a good value for the money."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
842,651 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Financial Services Firm
10%
Manufacturing Company
10%
Government
7%
Financial Services Firm
21%
Government
10%
Manufacturing Company
10%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Cortex XSIAM?
It is an effective solution in terms of performance and functionalities.
What is your experience regarding pricing and costs for Cortex XSIAM?
The product is very expensive. Additional integration and support are not provided by Cortex and must be purchased from partners. This adds to the cost and delays projects due to resource dependency.
What needs improvement with Cortex XSIAM?
The standard integrations are very limited, and the integrations available are not listed in the marketplace. Obtaining validation for integrations from Palo Alto takes around eight months, which i...
What do you like most about ServiceNow Security Operations?
The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product.
What is your experience regarding pricing and costs for ServiceNow Security Operations?
The product is more expensive than other solutions like Archer but offers more features, making the pricing justifiable.
What needs improvement with ServiceNow Security Operations?
Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time.
 

Overview

 

Sample Customers

Information Not Available
DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: March 2025.
842,651 professionals have used our research since 2012.