Palo Alto Networks ยท Cortex

Cortex Peer Intelligence

What competitors are telling buyers in four Cortex markets, whether it's winning them deals, and what it means for Cortex. Every card in each tool links to its public source.

Security operations platform and SIEM (security information and event management)

Cortex XSIAM

Cortex XSIAM is level with its peers on most capabilities. Its gaps are retention, at 31 searchable days by default, and AI agents that still wait for an analyst or a playbook.

Against CrowdStrike, Google, Splunk, Microsoft

Evidence as of 27 Oct 2026 Extended detection and response (XDR) on the endpoint

Cortex XDR

On capability the four are close. The differences are in what each vendor owns, how it is licensed, and the proof behind it.

Against CrowdStrike, Microsoft, SentinelOne

Evidence as of 21 Oct 2026 Security orchestration, automation and response (SOAR)

Cortex XSOAR

Cortex XSOAR is the broadest automation engine of the five. Its exposure is AI: agents come with a second product that runs only in the cloud.

Against Microsoft, CrowdStrike, Wiz, Mandiant

Evidence as of 27 Oct 2026 Agentic endpoint security for AI agents and browsers

Cortex AES

Cortex AES covers six of eight rows natively. Only Island claims more, and none of its endpoint features carries a GA label.

Against CrowdStrike, Microsoft, SentinelOne, Wiz, Island, Browser security specialists

Evidence as of 21 Oct 2026