No more typing reviews! Try our Samantha, our new voice AI agent.

Mandiant Advantage vs Recorded Future comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Extended Detection and Response (XDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Mandiant Advantage
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
7
Ranking in other categories
Extended Detection and Response (XDR) (28th), Attack Surface Management (ASM) (8th)
Recorded Future
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
14
Ranking in other categories
Threat Intelligence Platforms (TIP) (2nd), Digital Risk Protection (2nd)
 

Mindshare comparison

Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
Mandiant Advantage1.3%
CrowdStrike Falcon9.4%
SentinelOne Singularity Endpoint5.9%
Other83.4%
Extended Detection and Response (XDR)
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
Recorded Future7.1%
CrowdStrike Falcon4.8%
ThreatConnect Threat Intelligence Platform (TIP)3.9%
Other84.2%
Threat Intelligence Platforms (TIP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
LF
Head Of Cyber Threat Intelligence at Discount Bank
Brand threats have been monitored proactively and intelligence now drives daily security decisions
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the price they charge is just too high. It's not that they're not supplying what they're selling; it's simply that the price is high, and putting a tag on that cost is somewhat problematic. I would rate Mandiant Advantage an 8 out of 10. I do not consider Mandiant Advantage an affordable solution at all. The prices are very high and very expensive. The price of Mandiant Advantage is not justified. It's really expensive, and it's so expensive that I'm not sure I will continue next year with their service.
Derek  Lewis - PeerSpot reviewer
Account Manager at Chevron
Continuous threat intelligence has improved brand monitoring and protects against leaked credentials
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Sometimes alerts pop up for articles that have been published years ago but were just recently discovered by Recorded Future. For the browser extension, since the main purpose is to present information regarding IPs, I think it would be best to provide us with an idea of where the IP originates or some additional information about the organization it belongs to. API capabilities in Recorded Future are improving, but there are still some features that are missing and some errors that are hard to handle and understand. The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very effective and relatively competitive for large organizations.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Stability is a primary factor, and then there's the ease of distribution and policy management; Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them."
"The best feature of Cortex XDR by Palo Alto Networks is that it collects logs from different sections such as the endpoint, the network, and the cloud, making it easy to investigate alerts, collect some of the investigation packages related to the infected machines, and provide live response."
"The most valuable features of this product are the management capabilities, which allow an IT organization to get quite a good picture of attempted cyber attacks, and its out-of-the-box investigation capabilities."
"Based on my experience, I would recommend Cortex XDR by Palo Alto Networks to other people."
"It's very stable. I've never experienced downtime for the ASM console or ASM core."
"The protection offered by this product is good, as is the endpoint reporting."
"There are a lot of lead solutions in this space, however, Palo Alto is number one."
"Cortex XDR by Palo Alto Networks has helped lighten the load of our security analysts because it was the major tool that we were using and the one we utilized most."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"Mandiant Advantage has helped me enhance operational efficiency overall because it enriched our SIEM, which is Splunk, and the YARA rules I wrote within the platform help me understand better what my threat landscape is."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"The live IOC feed identifies the type, technique, and tactics used."
"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"I have never faced stability issues."
"Recorded Future has positively impacted our organization as we are able to cover a lot of sources with only this intelligence provider, not having to have specific tools for clear web or social media monitoring."
"Recorded Future allows me to maintain very accurate alerts."
"The most valuable features of Recorded Future are the useful alerts it provides. If we are monitoring a domain, the solution will provide us with an alert in a prompt manner. It is simple for clients to receive alerts. The advanced search is useful for more accurate filter results."
"Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry."
"The most valuable feature of Recorded Future is how it detects everything regarding our domain."
"The solution is diverse and provides me with a lot of different mechanisms for evaluation."
"It can collect data from various sources, including social media and the dark web."
"Has the ability to conduct and build any query without limitations."
 

Cons

"The solution needs better reports. I think they should let the customer go in and customize the reports."
"I would like to see them include NDR (Network Detection Response). Then it would work well with SIEM Response."
"The solution should offer more dashboards and they should be better customized."
"Based on our experience so far, its implementation is quite complex."
"They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone. They don't know what they are talking about when you get them on the phone. They don't like to respond to messages when you send them to them. They like to "research problems" for weeks on end, then pass you off to somebody else."
"Basically, they don't provide customer support tools just to investigate the logs."
"The solution can never really be an on-premises solution based simply on the way it is set up. It needs metadata to run and improve. Having an on-premises solution would cut it off from making improvements."
"I have seen lagging with Cortex XDR by Palo Alto Networks. There was one time when we faced a threat actor trying to gain access to our system. When our team utilized the tool, we were all on the same dashboard and we faced a lag issue at that time of around five minutes, which was quite significant."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"Mandiant Advantage's platform itself is not good yet. They have many bugs because they changed the platform, so from time to time it's simply not working at all."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate."
"When you add one website to Recorded Future, it should automatically call all other websites and social media platforms."
"At present, my clients need to be trained by me or another organization on how to use Recorded Future and how to get the best out of it as an analyst, engineer, and administrator. It would be better if clients could directly learn these things without having to go through me or other organizations."
"There is a semantic oncology dynamic relationship between how the MIGR Tech framework needs more data infusion enrichment capabilities."
"The tool can be pricey, especially for smaller companies."
"We can get the data of different malware active throughout the globe, but it would be good if we can do sandboxing of a file. For example, on Any Run, we can perform sandboxing of malware along with their intel about a particular file or hash. It would be great if they have a feature like that."
"Recorded Future is a very expensive solution, and its pricing could be improved."
"The solution would benefit from introducing automation."
 

Pricing and Cost Advice

"It is cost-effective compared to similar solutions. It fits for the small businesses through to the big businesses."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"I don't have any issues with the pricing. We are satisfied with the price."
"The pricing is a little high. It is per user per year."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"The cost depends on your chosen license type, like Pro or other licenses."
Information not available
"There appear to be up to five different levels, with the most expensive version costing around $95,000 to $105,000 a year for subscription services."
"The biggest disadvantage of Recorded Future is the cost here in Eastern Europe. The solution is correctly priced for big companies who have the money to invest in such solutions. Also, the solution is useless on its own, which means that you have to invest in other solutions with which Recorded Future can be integrated. At present, Recorded Future can cost 60,000 euros per year. I am able to offer my clients a 5% to 10% discount, but in this region, the cost is still prohibitive even with the discount. If Recorded Future were more flexible in terms of price, there would be better sales opportunities in Europe and Eastern Europe, in particular, because we have more small- and medium-sized companies here."
"I would rate the solution’s pricing a seven out of ten."
"The price of the solution is worth it. The overall performance of the solution outweighs the cost."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
892,943 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Construction Company
12%
Comms Service Provider
8%
Manufacturing Company
8%
Financial Services Firm
16%
Computer Software Company
9%
Manufacturing Company
6%
Construction Company
6%
Financial Services Firm
16%
Computer Software Company
11%
Manufacturing Company
6%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise21
Large Enterprise48
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise2
Large Enterprise2
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise11
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Mandiant Advantage?
I think Mandiant Advantage could be improved regarding their intelligence on fraud and cybercrime. Additionally, thei...
What is your primary use case for Mandiant Advantage?
I'm using Mandiant Advantage for digital monitoring of our brand protection and our digital entities, in addition to ...
What advice do you have for others considering Mandiant Advantage?
I am an end user of Mandiant Advantage. Mandiant Advantage's intelligence is good, and their service is good, but the...
What is your experience regarding pricing and costs for Recorded Future?
The price of Recorded Future is a bit high, especially for smaller teams working on a tight budget, but it is very ef...
What needs improvement with Recorded Future?
Some of the areas that need improvement in Recorded Future include email reports that can show unrelated content. Som...
What is your primary use case for Recorded Future?
Our main use case for Recorded Future is brand monitoring, reputation, and risk assessment, as it is one of the best ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Mandiant Threat Intelligence
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Fujitsu, Regions, SITA, St. Jude Medical, Accenture, T-Mobile, TIAA, Intel Security, Armor, Alert Logic, NTT, Splunk
Find out what your peers are saying about CrowdStrike, SentinelOne, TrendAI and others in Extended Detection and Response (XDR). Updated: April 2026.
892,943 professionals have used our research since 2012.