No more typing reviews! Try our Samantha, our new voice AI agent.

Lookout vs Microsoft Defender XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
7th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
109
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Extended Detection and Response (XDR) (6th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Lookout
Ranking in Endpoint Detection and Response (EDR)
51st
Average Rating
7.6
Reviews Sentiment
7.1
Number of Reviews
3
Ranking in other categories
Threat Intelligence Platforms (TIP) (27th), Mobile Threat Defense (3rd)
Microsoft Defender XDR
Ranking in Endpoint Detection and Response (EDR)
8th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
108
Ranking in other categories
Extended Detection and Response (XDR) (4th), Microsoft Security Suite (4th)
 

Mindshare comparison

As of April 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.4%, down from 4.0% compared to the previous year. The mindshare of Lookout is 0.7%, up from 0.4% compared to the previous year. The mindshare of Microsoft Defender XDR is 2.6%, down from 3.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.4%
Microsoft Defender XDR2.6%
Lookout0.7%
Other93.3%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
DB
IT Manager at NHS Trust
Enhanced mobile security with visibility into app and website usage, but installation challenges remain
We use Lookout for mobile devices, such as phones It has reduced our risk around mobile devices. I like the security features and being able to see what apps and websites people are using. There is nothing we have come across that we've desired. We have been using Lookout for one year. The…
KO
House security operator at Cypress Creek Renewables
Advanced threat hunting saves significant time in tracking and responding to incidents
Microsoft Defender XDR could be improved with a lower price. My main suggestion would essentially be what Copilot is providing, which is a single pane of glass, so I don't have to go to different windows. That's just a workflow consideration for me. It would be great to have all the information centralized into one particular data app. If I need to open up extra ones, I can, however, I would appreciate a future where everything I need is right there on one single pane of glass. Beyond that, there's really nothing else I see that I would want Microsoft to improve.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The user interface of the solution is sophisticated and straightforward."
"Traps has drastically reduced our endpoint attack surface via advanced detection capabilities, sandboxing of never before seen programs, and by drastically limiting where executables can launch in the first place."
"The level of security I get for my endpoints and servers is extremely valuable."
"I like that the product has behavior-based detection which offers many benefits over signature-based detection."
"The stability of this product is very good."
"Technical support is the best in class, in my opinion, because they have invested heavily in research and development."
"The product's most valuable features are massive user and feature intelligence exploit detection."
"Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context, collecting relevant indicators such as hashes, IP addresses, or domains efficiently and can detect and block malicious attacks with firewalls."
"We have not had any issues with bugs or breakdowns."
"The most valuable features are the antivirus as a whole, the anti-malware, and all of the protection features that scan our enterprise devices."
"The protection offered by the product is the most valuable feature. It detects vulnerabilities or traps on our users' phones and then prompts them to clean up their devices. Tools we used previously would only discover, which required us to gather information on the backend, so Lookout is a welcome upgrade."
"Setting up Microsoft 365 Defender is easy. It's a user-friendly solution that provides threat protection. It has good stability and scalability."
"The most valuable feature is the network security."
"Microsoft 365 Defender is a stable solution."
"The most valuable feature of all is the full integration with the rest of the software in the operating system and Office 365, as well as Microsoft SCCM."
"The unified view of the threat landscape on a central dashboard is the most valuable feature."
"In our company,we have faced multiple attacks over the last few months, but none of them have been successful, and I think Microsoft Defender XDR has played a major role in it."
"In Microsoft 365 vendor products, monitoring and connectivity across all Microsoft and third-party connectors enable viewing of all activity within those environments."
"I like Defender XDR's reports and alerts. They give you updates about the latest hotfixes and zero-day vulnerabilities, which gives me all the information I need to maintain my servers."
 

Cons

"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"Based on our experience so far, its implementation is quite complex."
"Cortex XDR by Palo Alto Networks can improve mobile integration to allow access to the console."
"The solution should enhance the ADR and reporting."
"The deployment is pretty hard."
"The solution could improve by providing better integration with their own products and others."
"I feel that it should not be a licensed activity because a feature should allow us to see applications running on end devices."
"The solution lacks real-time, on-demand antivirus."
"We just submitted an enhancement request reflecting the main area we want to see improvement in; the APIs. Currently, we're able to build dashboards, but it's somewhat backward because we use our MDM API to create them. Lookout should provide API to customers so we can query our data and use it in our cloud, and this is the only outstanding area for improvement with the product right now."
"From the analysis that we've done, they do seem to be maybe a step behind in trying to enter the market with a new solution. But when they do pick up, they do come out with some good products."
"The initial setup requires a little bit of experience with configuration."
"Correctly updated records are the most significant area for improvement. There have been times when we were notified of a required fix; we would carry out the fix and confirm it but still get the same notification a week later. This seems to be a delay in records being updated and leads to false reporting, which is something that needs to be fixed."
"Since all of our databases are updated and located in the cloud, I would like additional support for this."
"The tool gives inconsistent answers and crashes a lot."
"There's still some more work to be done there. Additionally, the limited terminal live access an analyst has is very restricted."
"The solution could improve by having better machine learning and AI. Additionally, the interface, documentation, and integration could be better."
"It would be beneficial to have a more seamless experience with everything consolidated in one place, particularly when dealing with aspects related to the Exchange console."
"I do think that maybe having a feature within my organization where there are three different domains within which we have to operate would be helpful, as there is currently no unified view within the domains."
"The licensing process needs improvement and clarification, as it is currently difficult to understand which features are licensed to which users."
 

Pricing and Cost Advice

"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
"I am using the Community edition."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"I don't have any issues with the pricing. We are satisfied with the price."
"The pricing is okay, although direct support can be expensive."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"The pricing is a little high. It is per user per year."
"This is an expensive solution."
"The pricing is fair; it's comparable to our previous solution, and we carried out multiple POCs and POVs (proof of value). The product is worth the money we pay for it."
"Lookout is definitely on the lower end when it comes to price point and that seems to be the only differentiator. The technology is in place in this space and it's really about who is coming in at the better price point now."
"Defender plan 1 is tenant-wise, and Defender plan 2 is per-user, which makes it more expensive. To have certain features, you would need to purchase the E5 license. For all of the capabilities that the tool provides, the price, though it can be high, is fair."
"Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
"I believe the pricing is fair and acceptable. I consider it to be reasonable and satisfactory."
"I believe that the pricing of the licensing is fair."
"Microsoft should provide lower-level licensing options. They should do it in such a way that even an individual could purchase a license, and it should be entirely flexible."
"On average, we pay around 55 euros per user for the services and features we receive."
"Microsoft purposely makes its license combinations complex and includes combinations like Microsoft 365 E3 and Microsoft 365 E5, Office 365 E3, Office 365 E5, and Office 365 E1, so you get confused. Microsoft tries to sell you a bundle of a lot of things together."
"The pricing of Microsoft 365 Defender is definitely on the costly side, but with the features and services that Microsoft provides, such as the seamless integration of all the Defender tools, while the price is on the higher side, there is no alternative."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
885,789 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
14%
Financial Services Firm
12%
Comms Service Provider
7%
Manufacturing Company
7%
Computer Software Company
14%
Manufacturing Company
10%
Financial Services Firm
9%
Government
7%
Computer Software Company
11%
Financial Services Firm
8%
Manufacturing Company
7%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise48
By reviewers
Company SizeCount
Small Business2
Large Enterprise5
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise26
Large Enterprise40
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Lookout?
The pricing is a little expensive. We are currently looking at comparisons with other solutions, including Umbrella.
What needs improvement with Lookout?
There is nothing we have come across that we've desired.
What is your primary use case for Lookout?
We use Lookout for mobile devices, such as phones.
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with pricing, setup, costs, and licensing of Microsoft Defender XDR is tied to our E5 subscription, whi...
What needs improvement with Microsoft 365 Defender?
I am not aware of a mobile app that would be available for my team. With a single analyst, if she is ever away, it wo...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
CipherCloud
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Find out what your peers are saying about Lookout vs. Microsoft Defender XDR and other solutions. Updated: March 2026.
885,789 professionals have used our research since 2012.