Try our new research platform with insights from 80,000+ expert users

Expel vs Palo Alto Networks Cortex XSOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 9, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Expel
Ranking in SOC as a Service
4th
Average Rating
9.0
Reviews Sentiment
7.6
Number of Reviews
1
Ranking in other categories
Managed Detection and Response (MDR) (19th)
Palo Alto Networks Cortex X...
Ranking in SOC as a Service
2nd
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
46
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd)
 

Mindshare comparison

As of April 2025, in the SOC as a Service category, the mindshare of Expel is 9.3%, down from 10.2% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 21.9%, up from 9.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
SOC as a Service
 

Featured Reviews

reviewer2578461 - PeerSpot reviewer
Rapid threat management and diverse technology integration for effective monitoring
Expel has made it easier for companies to monitor and manage various log sources. With its vast integration portfolio, customers can efficiently monitor diverse environments. Time to value is quick, as Expel can turn their service up very rapidly. They have both automated active responses and human processes that quicken threat resolution.
NikhilSharma2 - PeerSpot reviewer
Ability to multiple playbooks to fetch data from multiple firewalls and utomated several tasks, including vulnerability scans and SOCL (Security Orchestration, Automation
Recently, they started implementing microservices in XSOAR, which has improved quality and addressed previous issues. However, they should focus more on licensing costs. The user licensing fees are quite high. For example, I received a quote for XSOAR, and it was $12,000 per user per year. If you have a SOC team of 30 members/analysts, you're looking at a substantial expense. They should consider reducing these costs since this high pricing seems to be more about profit. So, there is room for improvement in the pricing. Moreover, the reporting and dashboard features are decent but could be improved. The user interface (UI) is quite heavy and takes time to load, which is a major drawback.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses."
"The automation is excellent."
"I chose Cortex XSOAR because the client also has Palo Alto firewalls. I can incorporate the data from the Palo Alto firewalls into Cortex and send it into the same data lake to manipulate that data. It lets me manage and monitor the data in one place."
"The product is quite easy to use."
"I have found the solution very useful, it integrates well with other platforms."
"The most valuable features are simplicity and ease of integration."
"What I like most about Palo Alto Networks Cortex XSOAR is how user-friendly it is for development. It is much simpler to work with compared to similar tools I've used."
"I am satisfied with the product overall."
"It is a scalable solution."
 

Cons

"The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management."
"Its dashboard features need improvement."
"It's only one cloud right now. It might be helpful for some companies to have an on-premies option."
"For building automation, there is not a lot of good documentation. The documentation is there, but it is not very good from my perspective. There should be an improvement in this area. I don't see issues with anything else. In terms of new features, I have heard that other products have EBA functionality. It would be good if this functionality could be added."
"Creating complex playbooks using coding languages, such as Python, could be easier."
"The solution requires DV but does not support open-source DV elastic searches."
"Palo Alto needs to develop more AI-centric products."
"I would like to see Cortex become less dependent on Active Directory and group policies to manage the deployment. Maybe I need to update my understanding of how to deploy it, but that's the way I know how to use it."
"The solution's technical support could be better."
 

Pricing and Cost Advice

Information not available
"The solution is a bit on the expensive side."
"The solution is based on an annual licensing model that is expensive."
"It is approx $10,000 or $20,000 per year for two user licenses."
"From the cost perspective, I have heard that its price is a bit high as compared to other similar products."
"Palo Alto offers significant discounts to customers who purchase the products repeatedly."
"On a scale of one to ten, where one is a low price, and ten is a high price, I rate the pricing a nine."
"Cortex XSOAR's price could be lower."
"There is a yearly license required for this solution and it is expensive."
report
Use our free recommendation engine to learn which SOC as a Service solutions are best for your needs.
848,716 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
19%
Financial Services Firm
10%
Manufacturing Company
7%
Government
7%
Financial Services Firm
15%
Computer Software Company
13%
Manufacturing Company
9%
Government
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Expel?
Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.
What needs improvement with Expel?
The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for m...
What is your primary use case for Expel?
I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Even though customers often comment on the price, the potential savings come from managing a large number of security events with a limited number of analysts. This leads to economic advantages des...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The complexity of Cortex XSOAR has a trade-off with its versatility. The product can be tailored for each deployment to respond to specific customer needs, and this complexity may be seen as a down...
 

Also Known As

Workbench, Expel SOC-as-a-Service
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Amanda Fennell CSO
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Arctic Wolf Networks, Palo Alto Networks, Netsurion and others in SOC as a Service. Updated: April 2025.
848,716 professionals have used our research since 2012.