No more typing reviews! Try our Samantha, our new voice AI agent.

SentinelOne Singularity Complete vs Trellix XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
109
Ranking in other categories
Endpoint Protection Platform (EPP) (5th), Endpoint Detection and Response (EDR) (7th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (2nd)
SentinelOne Singularity Com...
Ranking in Extended Detection and Response (XDR)
2nd
Average Rating
8.8
Reviews Sentiment
7.2
Number of Reviews
216
Ranking in other categories
Endpoint Protection Platform (EPP) (3rd), Anti-Malware Tools (2nd), Endpoint Detection and Response (EDR) (2nd), AI Observability (4th)
Trellix XDR
Ranking in Extended Detection and Response (XDR)
33rd
Average Rating
8.0
Reviews Sentiment
7.7
Number of Reviews
3
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of April 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.9%, down from 5.6% compared to the previous year. The mindshare of SentinelOne Singularity Complete is 5.8%, up from 5.3% compared to the previous year. The mindshare of Trellix XDR is 0.6%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
SentinelOne Singularity Complete5.8%
Cortex XDR by Palo Alto Networks4.9%
Trellix XDR0.6%
Other88.7%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Vaibhav Mahendra Kolhe - PeerSpot reviewer
Soc Analyst at Softcell Technologies Limited
Automation has reduced alerts and freed the soc team to focus on faster incident response
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.
PankajKumar24 - PeerSpot reviewer
IT Manager at Gigabit Technologies Pvt Ltd
Centralized security console has unified threat telemetry and automated investigation playbooks
The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization. This creates big challenges for us. The support experience is also concerning. When we require support from Trellix immediately with high priority, we receive multiple emails requesting logs of various types. After that, we have to escalate to Trellix higher management, and then their agent will come in for a remote session to resolve any issues. I would give them eight out of ten points because of the high CPU utilization and the delayed support we experience.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The tool is designed to scale for large enterprises and handle large volumes of data."
"The tool is easy to use."
"The user interface of the solution is sophisticated and straightforward."
"After installing this solution, it identified, blocked, and provided the complete attack chain, which was very helpful."
"The solution allows control over the user and his machine through Cortex XDR security policies."
"Palo Alto is the best security solution in the market."
"Palo Alto is constantly adding new features."
"The solution doesn't need a high level of technical training."
"We have a preference for their receptor. It's good at finding many EFC files. EFC files could have a virus."
"The most valuable feature is the automatic remediation."
"SentinelOne has provided amazing security; we were getting new cryptolocker variant infections several times per month and the month following our SentinelOne rollout, the numbers dropped to zero, and we have not had a single infection since."
"The alerting features are the most valuable. We know that when something goes wrong, we get alerted instantly. That gives us a leg up. Even before the user knows what's happening, we're being alerted to step in and stop anything catastrophic from happening."
"Singularity's rollback feature is one of the primary reasons we bought the product. If there's an attack on the machine, the system can automatically roll back the data and the hard drive of the machine that was attacked."
"The most valuable aspect, in any scenario, was the rollback feature."
"I am particularly interested in the new app vulnerability module that is included with the Singularity Complete edition."
"The AI solution makes it easy for customers to detect and manage policies, as well as documents that help customers manage their platform."
"The analytics assessment and flexibility of the platform are valuable."
"It contributes to our system's robust event detection and analysis, enabling us to respond effectively to incidents."
"Because Trellix gives us multiple types of modules, we are using a single ePO console for multiple solutions including application control, DLP, and XDR."
"Trellix XDR is an excellent solution that is continually improving."
 

Cons

"Dashboards do not allow everyone to see what's happening."
"It's more focused on network communication. If a customer wants to increase the level of protection and start working with documents, it's impossible to integrate these features into the system. It's more of a communication-oriented system than a content security-oriented system."
"Every 30 or 40 days, there's a new version and we need to go and make sure our customer's laptops are upgraded."
"Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth."
"It is a complex solution to implement."
"The dashboard could use some significant improvement, just making it more useful with more information."
"The MAC agent is not as robust feature-wise as the PC version."
"If you compare it to SentinelOne, which has more functionalities and detection capabilities on an open platform, the pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks."
"The solution can use up a lot of resources when scanning. It would be ideal if it was lighter."
"With respect to product patches, it should have the ability to patch directly from SentinelOne, rather than be presented with a list and have to do it separately."
"As a cloud-based product, there is a minimum number of licenses that need to be purchased, which is unfortunate."
"I would like to see the reports from SentinelOne more customizable, as there are very few options."
"They have tiers of support like most companies do... We are now one tier down from that. The SLA for us is no longer within an hour or two. It's within half a day or something like that."
"I would like to see a better control panel for the managed service side of it."
"SentinelOne's performance and the accuracy of its incident filtering could be improved."
"I would like to see something a little more sophisticated than simply being able to mark a false positive as safe or there's usually just one or two options in certain areas and they're a little rudimentary at this stage."
"Technical support is crucial, especially when facing critical issues. It's rated six out of ten. Improvements are needed in the support sector, with a focus on providing expert assistance during production periods."
"The CPU utilization is very high with Trellix XDR; we are getting multiple types of CPU utilization from the EPP solution, with the EPP agent reaching as high as 80 percent CPU utilization, which creates big challenges for us."
"The platform should enhance compatibility with all other SIEM solutions."
"The EdgeGear solution is an area that requires attention, specifically regarding AI solutions and intelligence features."
 

Pricing and Cost Advice

"I don't like that they have different types of licenses."
"Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis."
"This is an expensive solution."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"The price of the product is not very economical."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"The pricing is a little high. It is per user per year."
"It has a yearly renewal."
"Nothing good is cheap, and SentinelOne is no exception."
"SentinelOne Singularity Complete's price point is excessive compared to the functionality it provides."
"Its price can be lower because I'm seeing competition from another vendor who beats it on commercials."
"The one I use is $6 a month per device. Some are $4 and there are some that are more than that."
"SentinelOne Singularity Complete is reasonably priced."
"The cost of utilizing all the features of SentinelOne Singularity Complete is high."
"SentinelOne Singularity Complete is a fair price."
"SentinelOne Singularity Complete is expensive, but we must be willing to pay for it if we want a high level of protection."
Information not available
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
885,880 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
13%
Financial Services Firm
13%
Manufacturing Company
7%
Comms Service Provider
7%
Computer Software Company
11%
Manufacturing Company
8%
Financial Services Firm
7%
Government
6%
Computer Software Company
19%
Financial Services Firm
10%
Healthcare Company
9%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise20
Large Enterprise48
By reviewers
Company SizeCount
Small Business96
Midsize Enterprise49
Large Enterprise78
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for SentinelOne Singularity?
It is neither too costly, but definitely, it is one of the advantages that SentinelOne is quite adapted towards the p...
What is your experience regarding pricing and costs for Trellix XDR?
Since I'm a technical engineer, I don't deal with pricing or licensing. Our sales team handles those aspects.
What needs improvement with Trellix XDR?
The CPU utilization is very high with Trellix XDR. We are getting multiple types of CPU utilization from the EPP solu...
What is your primary use case for Trellix XDR?
We are selling Trellix XDR products including DLP and EPP solutions. We sell Trellix XDR for endpoint protection. We ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Sentinel Labs, SentinelOne Singularity
MVision XDR, MVision eXtended Detection and Response
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Information Not Available
Find out what your peers are saying about SentinelOne Singularity Complete vs. Trellix XDR and other solutions. Updated: February 2026.
885,880 professionals have used our research since 2012.