Try our new research platform with insights from 80,000+ expert users

Microsoft Defender XDR vs Secureworks Taegis XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
7th
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
105
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Endpoint Detection and Response (EDR) (8th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Microsoft Defender XDR
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
106
Ranking in other categories
Endpoint Detection and Response (EDR) (7th), Microsoft Security Suite (5th)
Secureworks Taegis XDR
Ranking in Extended Detection and Response (XDR)
35th
Average Rating
7.6
Reviews Sentiment
7.2
Number of Reviews
3
Ranking in other categories
Network Detection and Response (NDR) (24th)
 

Mindshare comparison

As of February 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.8%, down from 5.7% compared to the previous year. The mindshare of Microsoft Defender XDR is 4.8%, down from 6.8% compared to the previous year. The mindshare of Secureworks Taegis XDR is 1.5%, up from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender XDR4.8%
Cortex XDR by Palo Alto Networks4.8%
Secureworks Taegis XDR1.5%
Other88.9%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
KO
House security operator at Cypress Creek Renewables
Advanced threat hunting saves significant time in tracking and responding to incidents
Microsoft Defender XDR could be improved with a lower price. My main suggestion would essentially be what Copilot is providing, which is a single pane of glass, so I don't have to go to different windows. That's just a workflow consideration for me. It would be great to have all the information centralized into one particular data app. If I need to open up extra ones, I can, however, I would appreciate a future where everything I need is right there on one single pane of glass. Beyond that, there's really nothing else I see that I would want Microsoft to improve.
Mohammad Talha Talkin Alam - PeerSpot reviewer
Assistant Manager IT at PDS Multinational
Improved network protection has secured our servers and monitors web and application traffic
Till now, I have not seen any weak point that needs to be improved in Secureworks Taegis XDR. I think that since the technology is becoming upgraded, it will be good for Sophos to include more features in future updates of this solution. Secureworks Taegis XDR is a good product, but it should include AI technology.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We have a complete overview of all our PCs and it's very easy to handle and to use the interface. It has a lot of benefits for us."
"The most valuable features are incident creation, policy-based protection, IP whitelisting, and device encryption. These are beneficial for endpoint and server security."
"Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
"The live terminal is probably the best thing ever. It gives you the access to get straight onto any machine."
"Its interface and pricing are most valuable. It is better than other vendors in terms of security."
"The interface is easy to use and it is more up to date than our previous solution."
"Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context, collecting relevant indicators such as hashes, IP addresses, or domains efficiently and can detect and block malicious attacks with firewalls."
"When the pandemic started, Palo Alto came up with many solutions, which helped with the quick shift from on-premises to the cloud."
"All of the security components are valuable including, antiphishing, antispam, and stage three antivirus."
"The threat intelligence is excellent."
"The most valuable feature depends on the scenario. For compliance, I like Microsoft Purview Information Protection and Data Loss Prevention. Sentinel is the most helpful feature for security. 365 Defender helps us prioritize threats across an enterprise. It's a crucial feature for the managed services team."
"I rate Microsoft Defender XDR 10 out of 10."
"The proactive remediation aspects and the surfacing of suspicious activity for investigation and escalation are the key aspects we appreciate most."
"The biggest return on investment when using Microsoft Defender XDR for me is saving time for the most part."
"Advanced hunting is good. I like that. We can drill down to lots of details."
"The ability to isolate and address viruses is the most valuable feature of Microsoft Defender XDR."
"It's a complete solution package."
"Definitely, Secureworks Taegis XDR is cost effective for the long run since the product is at a lower cost rather than other brands."
"The initial setup was straightforward."
 

Cons

"The tool needs to be improved in terms of integration and interface."
"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."
"The playbooks could be improved to include more functionalities or actions."
"If Palo Alto reduces the pricing slightly for their products, it would make them more scalable in markets such as India and globally for cybersecurity."
"There are some default policies which sometimes affect our applications and cause them to run around. In the hotel industry, we use a different type of data versus Oracle and SQL. By default, there are some policies which stop us from running properly. Because of this, the support level is also not that strong. We have to wait to get a results."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"The GUI could be improved."
"Whenever the tool releases a new version when deploying the product across the organization, I feel like there are some disturbances in the CPU usage after upgrading the tool to the latest version."
"Every now and then, Microsoft Defender XDR seems to go through and aggregates almost a week's worth of incidents and wraps them up, indicating a huge problem."
"I haven't really come across the incident Q assistant helping improve the efficiency of my SOC workflow."
"There are other SIEM solutions that are easier to use, mainly based on the creation of rules, use cases, and groups."
"For Microsoft Defender XDR, there is currently no ability to reset passwords for on-premises accounts, which is a key challenge."
"The design of the user interface could use some work. Sometimes it's hard to find the exact information you need."
"The price could be better. It'll also help if they can continuously update and upgrade the solution. Every day there's a new virus uploaded into the network, and we have to keep updating it to identify all these things."
"The dashboard should be easier to use. There is also improvement needed in the reporting when it comes to exporting or scheduling reports."
"The tool gives inconsistent answers and crashes a lot."
"Secureworks Taegis XDR is a good product, but it should include AI technology."
"We found limitations in the XDR's detections, lacking the ability to create customized detection and log parsing rules."
"The pricing could be improved."
 

Pricing and Cost Advice

"I don't like that they have different types of licenses."
"This is an expensive solution."
"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."
"This is an expensive solution."
"Cortex XDR is a costly solution."
"I don't have any issues with the pricing. We are satisfied with the price."
"Cortex XDR's pricing is ok."
"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."
"All I can say again is the E5 gives you all the capabilities that it offers. It also gives Office 365 and one terabyte of storage. All in all, the E5 license model makes sense. There are some people who say it's quite costly, but rather than paying different vendors, it makes sense to go all in with Microsoft if you've got that licensing. From that perspective, it's cost-effective, but I can't comment much on that."
"The licensing fee for Microsoft 365 Defender is fair."
"Microsoft 365 Defender offers competitive pricing."
"Its licensing and pricing are handled by someone else. My role is limited to incidents or issues with the portal, but you get what you pay for. It is worth the cost."
"The price of the solution is high compared to others and we have lost some customers because of it."
"Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
"Microsoft Defender XDR is priced high."
"Microsoft Defender XDR is included in our license."
"The pricing is six out of ten."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
882,813 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
10%
Financial Services Firm
10%
Manufacturing Company
8%
Comms Service Provider
6%
Computer Software Company
12%
Financial Services Firm
8%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
17%
Manufacturing Company
12%
Financial Services Firm
11%
Performing Arts
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business42
Midsize Enterprise21
Large Enterprise47
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise26
Large Enterprise38
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with pricing, setup, costs, and licensing of Microsoft Defender XDR is tied to our E5 subscription, whi...
What needs improvement with Microsoft 365 Defender?
I am not aware of a mobile app that would be available for my team. With a single analyst, if she is ever away, it wo...
What is your primary use case for Secureworks Taegis XDR?
More from the perspective of SOC to ensure that every endpoint is taken care of from a cybersecurity perspective. It'...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
Secureworks Taegis NDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Information Not Available
Find out what your peers are saying about Microsoft Defender XDR vs. Secureworks Taegis XDR and other solutions. Updated: February 2026.
882,813 professionals have used our research since 2012.