Palo Alto Cortex
AI-native SecOps suite — XSIAM, XDR and XSOAR under one platform
Overview
Cortex is Palo Alto Networks' security operations platform: Cortex XSIAM combines SIEM, XDR and SOAR with AI-driven detection and automated response, alongside standalone Cortex XDR and Cortex XSOAR. XSIAM had roughly 470 customers as of December 2025, averaging over $1M ARR each.
Use cases
What you can produce with Palo Alto Cortex
- AI-driven SIEM + XDR + SOAR in one data platform
- Automated alert triage and noise reduction
- Cross-telemetry correlation (endpoint, network, cloud, identity)
- Native integration with Palo Alto NGFW and Prisma telemetry
- Automated incident response playbooks (XSOAR heritage)
- Attack surface management module
- "Bring your own AI" model integration option
ASEAN Perspective
Palo Alto Cortex in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
XSIAM is Palo Alto's bet that a single AI-driven data platform beats stitching together a SIEM, an XDR and a SOAR tool from different vendors, and on G2 it backs that up: 4.4 stars across 73 XSIAM-specific reviews (71% five-star), with reviewers repeatedly praising the alert-noise reduction and automated triage. That consistency comes at real cost — XSIAM customers average north of $1M in annual spend, per Palo Alto's own December 2025 customer count, and the company still won't publish per-GB ingestion rates, so every deal is a negotiation. Setup and tuning take real time; several reviewers describe a rough first few months before the automation starts paying off. Good fit for large security teams ready to consolidate onto one Palo Alto-centric stack. Not a starter SIEM, and not cheap enough to try casually.
What people say
Palo Alto announced Cortex XSIAM in February 2022 and took it to general availability that October, positioning it as an "autonomous security platform" that fuses SIEM-style data ingestion with XDR detection and XSOAR-style automated response rather than selling those as separate products glued together after the fact. By December 2025, Palo Alto reported roughly 470 XSIAM customers, with average annual recurring revenue north of $1 million per customer — a figure that says more about who buys this than any feature list does.
Review numbers back the product story: G2 shows Cortex XSIAM at 4.4 out of 5 stars across 73 reviews (71% five-star, 21% four-star, 6% three-star, none below three stars), and Gartner Peer Insights runs a separate, similarly favorable set of enterprise reviews. Recurring praise centers on alert-noise reduction — reviewers specifically call out that XSIAM surfaces the incidents that matter instead of burying analysts in raw telemetry — and on how much manual investigation work the automation removes once tuned. The recurring complaint mirrors that benefit: getting to "tuned" takes real onboarding time, and initial setup complexity comes up often enough in reviews to be a pattern, not an outlier.
Pricing draws the most consistent frustration. Palo Alto has no public pricing page for XSIAM, no per-GB ingestion rate sheet, and no AWS Marketplace price listing — buyers describe cost as a case-by-case negotiation blending a per-endpoint base with ingested-data volume, similar in structure to Splunk's model. Peer reviews on pricing are genuinely split: some call it expensive relative to Splunk or Microsoft Sentinel, others say it landed competitively once negotiated. Both can be true simultaneously given how opaque list pricing is.
Bottom line for a directory entry: this isn't a tool you self-serve into. It's an enterprise SIEM/XDR replacement decision, sold through Palo Alto's sales org, aimed at security teams with the headcount and budget to run a consolidated SOC platform.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including Palo Alto Cortex's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Palo Alto Cortex unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Palo Alto Cortex directly →
Spotted something out of date? Suggest an update →
More in Security & Safety
