Try our new research platform with insights from 80,000+ expert users

Microsoft Defender XDR vs Secureworks Taegis XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
106
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Endpoint Detection and Response (EDR) (7th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
Microsoft Defender XDR
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
106
Ranking in other categories
Endpoint Detection and Response (EDR) (8th), Microsoft Security Suite (4th)
Secureworks Taegis XDR
Ranking in Extended Detection and Response (XDR)
21st
Average Rating
7.6
Reviews Sentiment
7.2
Number of Reviews
3
Ranking in other categories
Network Detection and Response (NDR) (14th)
 

Mindshare comparison

As of March 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.9%, down from 5.6% compared to the previous year. The mindshare of Microsoft Defender XDR is 4.9%, down from 6.7% compared to the previous year. The mindshare of Secureworks Taegis XDR is 1.5%, up from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender XDR4.9%
Cortex XDR by Palo Alto Networks4.9%
Secureworks Taegis XDR1.5%
Other88.7%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
KO
House security operator at Cypress Creek Renewables
Advanced threat hunting saves significant time in tracking and responding to incidents
Microsoft Defender XDR could be improved with a lower price. My main suggestion would essentially be what Copilot is providing, which is a single pane of glass, so I don't have to go to different windows. That's just a workflow consideration for me. It would be great to have all the information centralized into one particular data app. If I need to open up extra ones, I can, however, I would appreciate a future where everything I need is right there on one single pane of glass. Beyond that, there's really nothing else I see that I would want Microsoft to improve.
Mohammad Talha Talkin Alam - PeerSpot reviewer
Assistant Manager IT at PDS Multinational
Improved network protection has secured our servers and monitors web and application traffic
Till now, I have not seen any weak point that needs to be improved in Secureworks Taegis XDR. I think that since the technology is becoming upgraded, it will be good for Sophos to include more features in future updates of this solution. Secureworks Taegis XDR is a good product, but it should include AI technology.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The positive impacts I see from Cortex XDR by Palo Alto Networks include a complete 360-degree view of our security posture altogether, being a uniform platform where we are ingesting logs from multiple resources."
"On a scale from one to ten, I would rate Cortex XDR by Palo Alto Networks a nine."
"It has pretty much everything we need and works well within the Palo Alto ecosystem."
"The most valuable features are incident creation, policy-based protection, IP whitelisting, and device encryption. These are beneficial for endpoint and server security."
"Monitoring is most valuable."
"The solution allows control over the user and his machine through Cortex XDR security policies."
"The solution's most valuable feature is its ability to rapidly detect certain hardware files."
"Cortex XDR by Palo Alto Networks is easy to use and does not consume a lot of hardware resources."
"Based on my experience, I rate Microsoft Defender XDR as nine out of ten."
"Microsoft Defender XDR is scalable."
"Its most significant advantage lies in its affordability."
"The EDR features are valuable. By getting the EDR features, we have more control over the device. We have information about events in real-time and more protection against zero-day threats and zero-day vulnerabilities. We can monitor every event or action that a device is going through. We can get an idea if it is something malicious or if we have to take any actions."
"Microsoft Defender XDR has significantly improved our operational security."
"It has been great for us. Previously, we didn't have a solution to protect us, especially from malware, whereas now, we are getting protection up front, especially from the malware attacks coming through emails or endpoints."
"We are connected to Microsoft and have every laptop enrolled. This acts as an endpoint. The tool helps me check security and compliance. I can also check what a device is doing."
"The ability to hunt that IM data set or the identity data set at the same time is valuable. As incident response professionals, we are very used to EDRs and having device process registry telemetry, but a lot of times, we do not have that identity data right there with us, so we have to go search for it in some other silo. Being able to cross-correlate via both datasets at the same time is something that we can only do in Def"
"Definitely, Secureworks Taegis XDR is cost effective for the long run since the product is at a lower cost rather than other brands."
"The initial setup was straightforward."
"It's a complete solution package."
 

Cons

"In terms of areas of improvement, we have not completed our review of the product. We're also looking at other products. So, it's a little bit hard to tell what could be different because we have not completed the review of this product, but based on our experience so far, its implementation is quite complex."
"I don't like that they have different types of licenses. For example, if users select a license, they think they will have all the platforms they need to improve their network or security. But after some time, Palo Alto Networks changed their licensing, and some of the features that, for example, were free at the beginning now have a cost. I think the integration can be improved. For example, a lot of tools are just integrated through APIs."
"The complexity and confusion regarding product variants, such as XDR, Forexiant, and Forexon, must be addressed."
"It would be better if they could educate the customers more. Some sort of seminars and roadshows will help educate the customers and show what the product can do. The price could be better. It would also help if they had a team for deployment and support."
"Cortex XDR is trickier to configure than other Palo Alto products. This is one area where we are not so satisfied."
"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."
"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."
"The price could be a little lower."
"What could be improved in Microsoft 365 Defender is its licensing, e.g. it should be more consolidated and would be good if it has some optimizations. Improving the alerts and notifications, in terms of adding more details, would also be good for this solution."
"I haven't really come across the incident Q assistant helping improve the efficiency of my SOC workflow."
"Correctly updated records are the most significant area for improvement. There have been times when we were notified of a required fix; we would carry out the fix and confirm it but still get the same notification a week later. This seems to be a delay in records being updated and leads to false reporting, which is something that needs to be fixed."
"There should be better information for experts on features in the solution. What I see when reading about features in Microsoft 365 Defender is that it is always general information. If Microsoft could go deeper into details for the experts about how to use the tools, usage of it would be more familiar and it would be easier to use."
"The logs could be better."
"Microsoft Defender is slow to adapt to evolving threats."
"The abundance of sub-dashboards and sub-areas within the main dashboard can be confusing, even if it all technically makes sense."
"When we do investigations, it would be better if Microsoft could populate the host dashboard more. When we open any host for investigation, we want the entire timeline of what is happening on the host, including all the users logging in, their hardware, Windows version, etc."
"We found limitations in the XDR's detections, lacking the ability to create customized detection and log parsing rules."
"Secureworks Taegis XDR is a good product, but it should include AI technology."
"The pricing could be improved."
 

Pricing and Cost Advice

"I don't recall what the cost was, but it wasn't really that expensive."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"Compared to CrowdStrike, Cortex XDR is an expensive solution."
"The price is on the higher side, but it's okay."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"Cortex XDR’s pricing is very reasonable."
"Our license will require renewal in August, after which the maintenance will continue as usual."
"The pricing is a little bit on the expensive side."
"It is fairly priced because we get complete integrated services with the E5 license."
"Microsoft Defender XDR is already included in our Office 365 licensing. It is better because we're saving money by using it."
"We have a lot of problems in Latin America regarding the price of Microsoft 365 Defender, because the relationship between dollars and the money of the different countries, it's is a lot. Many customers that have small businesses say that they would like the solution but it is too expensive. However, large companies do not find the cost an issue."
"While Microsoft Defender XDR carries a higher cost, its ease of use compared to Defender may justify the investment."
"There are no issues with pricing, but sometimes, the clarity in licensing is a concern."
"It is 15 dollars per server per month. It is worth it, but it can be costly. It depends on the company's size."
"Purchasing Microsoft Defender XDR as part of a Microsoft 365 bundle can be cost-effective, but acquiring it as a standalone product may be more expensive."
"Licensing is somewhat confusing, particularly when presenting our pitch decks to stakeholders and leveraging key features in premium SKUs, but we managed with some assistance from Microsoft."
"The pricing is six out of ten."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
883,546 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
10%
Financial Services Firm
9%
Manufacturing Company
9%
Government
7%
Computer Software Company
12%
Financial Services Firm
8%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
16%
Manufacturing Company
13%
Financial Services Firm
11%
University
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise47
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise26
Large Enterprise38
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with pricing, setup, costs, and licensing of Microsoft Defender XDR is tied to our E5 subscription, whi...
What needs improvement with Microsoft 365 Defender?
I am not aware of a mobile app that would be available for my team. With a single analyst, if she is ever away, it wo...
What is your primary use case for Secureworks Taegis XDR?
More from the perspective of SOC to ensure that every endpoint is taken care of from a cybersecurity perspective. It'...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
Secureworks Taegis NDR
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Information Not Available
Find out what your peers are saying about Microsoft Defender XDR vs. Secureworks Taegis XDR and other solutions. Updated: February 2026.
883,546 professionals have used our research since 2012.