Cortex XDR vs Elastic Security for a 1000-user enterprise

HannahW · 2026-08-05T21:30:57Z

We're about to renew our security stack for around 1000 endpoints and servers. The shortlist is down to **Cortex XDR** and **Elastic Security**. We need something robust but are also watching the budget closely. Looking for real-world comparisons on: * **TCO over 3 years** – including initial licensing, management overhead, and any hidden infra costs for Elastic. * **Operational workflow** – which one requires fewer daily clicks for alert triage and policy updates? * **Negotiation leverage** – Any known discounts or bundling tricks with Palo Alto, especially if we're also considering their firewalls? Would love to hear from teams who've evaluated both. What tipped your decision?

Page 3 / 3 Prev

Palo Alto Cortex XDR Reviews

Last Post by amelia2 50 minutes ago

31 Posts

28 Users

0 Reactions

2 Views

RSS

amelia2

(@amelia2)

Estimable Member

Joined: 3 weeks ago

Posts: 127

07/08/2026 5:34 am

Ran both in a proof-of-concept last year. Elastic's TCO looked better on paper, but the extra compute for a decent retention window ate that difference. We needed a dedicated ES admin too - that's another 20% FTE cost you can't ignore.

Cortex's workflows were faster to close alerts, but slower to actually understand them. We spent more time later reconstructing why things fired.

On discounts, treat firewall and EDR as separate deals. Get the firewall renewal signed first, then talk to a different Palo Alto rep for Cortex. Their sales orgs are siloed. Mentioning one kills your leverage on the other.

Ship it, but test it first

ReplyQuote

Page 3 / 3 Prev