crowdstrike vs sentinelone vs cortex xdr

Cortex has a licensing requirement for sale. Much larger than Sentinel. Better to ask if you want S1 or Crowdstrike.

1 of 4

2 of 4

ease of us: s1. Probably don’t need any level of training to use deep visibility. If you have some sql nerds there is powerquery. performance: s1 generally tests well and barely notice much impact on the system. Usually under 200-300mb ram -integrations: for s1 it had around 70-75. Some useful ones like: virustotal, joes sandbox, AlienVault, proofpoint, netskope, AAD P2, etc Cost: not sure stacked against cortex but against crowdstrike I could bundle s1 complete + vigilance + netskope (SWG) and still come out cheaper than crowdstrike by itself I’m a big fan of s1 due to its simplicity. I believe s1 complete in the future will have a 10Gb XDR ingest so you could pass logs from anything and use it as a mini SIEM if you’re wanting to keep that sort of cost down. S1’s STAR queries are an excellent tool to help keep hackers with a lower time to execute activity if you dedicate some time into it. I’d probably say be careful with vigilance. Vigilance is basically a service to cleanup your dashboard of threats… if you want proper incident response I believe that is vigilance pro.

SentinelOne

sentinelone.com › vs › crowdstrike

SentinelOne vs CrowdStrike | Cybersecurity Comparisons

July 15, 2025 - SentinelOne offers longer EDR data retention than CrowdStrike by default. Choose autonomously correlated and contextualized alerts, created at machine speed.

Videos

15:40

YouTube

SentinelOne vs CrowdStrike | CRWD Stock vs S Stock - YouTube

CrowdStrike Vs SentinelOne - YouTube

February 6, 2023

07:31

YouTube

SentinelOne Vs Crowdstrike: MITRE ATT&CK Evaluation Results ...

October 5, 2021

View all

You need a masters degree to use their shitty UI. the data is good, the platform and their query language are both god-awful.

Palo is way too aggressive trying to sell things. You can be already paying them and simply asking support how to do something and they try to sell you five more products.

Find elsewhere

Google Bing Mojeek

PeerSpot

peerspot.com › home

Compare Cortex XDR by Palo Alto Networks vs SentinelOne Singularity ...

August 10, 2025 - Cortex XDR is perceived as expensive by some customers, yet offers dynamic pricing. ... Compared to competitors such as CrowdStrike and Sophos, the pricing of Cortex XDR by Palo Alto Networks is similar to CrowdStrike but more expensive than Sophos.

CrowdStrike

crowdstrike.com › compare › sentinelone

Compare the CrowdStrike Falcon® Platform vs. SentinelOne

2 weeks ago - MDR focuses on scripted responses and lacks surgical full remediation capabilities. SentinelOne’s detection coverage was at a substantially lower 88.4% with an MTTD of 47 minutes in the MITRE Engenuity ATT&CK® Evaluations: Managed Services.

reddit.com › r/sysadmin › av - crowdstrike vs. sentinelone vs. interceptx

r/sysadmin on Reddit: AV - Crowdstrike vs. SentinelOne vs. InterceptX

October 5, 2018 -

Hey all, I'm sure this topic has been beaten into the ground however I'm currently torn on which AV/ EDR solution to pursue, since I'm finally ready to retire SEP (thanks, Broadcom)

I've been wanting to make this move for awhile, and at first glance Crowdstrike really stands out, however I stumbled upon a video from The PC Security Channel (here) which shows less than stellar results, which is a little concerning.

SentinelOne seems to do much better by the same set of tests, but InterceptX seems to do the best. Sophos SEEMS to have more customers than the other two offerings (and thus, more support, which may be good or bad) however I have seen a lot of bad things about Sophos (in particular with their server software (reboots) ).

Gartner ranks Crowstrike pretty high (same with Sophos) however S1 seems to be lagging behind in that regard.

Has anyone POC these three products, and what was your final result?

Environment: 175 Windows workstations, 15 servers (mostly Windows)

For products like CrowdStrike, Cylance, etc you’ll have to ignore the results from The PC Security Channel. These products require a huge amount of configuration and it’s clear from some of the videos that’s not being done in his tests.

With any of the enterprise NGAV products, particularly if you’re looking to add an EDR component, the question is largely how much time you’re willing to dedicate to configuring them. Also the vendor or VAR’s ability to assist with that will play a large role.

We went with Cylance because their professional services blew me away and gave me the comfort to feel like we could effectively manage the product.

capterra.com › home › endpoint protection software › crowdstrike vs cortex xdr

SentinelOne has saved our ass time and time again

It has also broken more shit than the malware probably would have

Their support has been way better than any other AV vendor I've worked with, but we have had to use them a decent amount

Capterra

Compare CrowdStrike vs Cortex XDR 2025 | Capterra

Crowdstrike falcon sensor update is frequent and bandwidth utilization is a bit high since each and every node needs updates. When you are in a limited bandwidth with a higher number of PC’s this will cause too high bandwidth utilization and can interrupt your operation.

reddit.com › r/sysadmin › crowdstrike, carbon black, sentinelone

r/sysadmin on Reddit: Crowdstrike, Carbon Black, SentinelOne

October 1, 2020 -

We are currently evaluating the above products. Anyone have any good insight or things that I should look closely at before purchasing? I would appreciate any input you may provide.

Make sure they know its a 3 way bakeoff. All three are great but I will say you should expect to throw your first quote from Crowdstrike in the garbage and tell them you can't even consider it based on cost. Magically they will come down 30-50% especially if they know that is where SentinalOne already started.

I went with Crowdstrike because they were the only ones who offered a non-profit package my business could afford. I absolutely love it, it has been miles ahead of Kaspersky that I had before.

reddit.com › r/msp › crowdstrike vs sentinelone

r/msp on Reddit: Crowdstrike vs SentinelOne

March 6, 2023 -

Hey guys, we are an MSP with 1000 endpoints currently using webroot. We understand it isn't good enough and nearing the end of our POC evaluation for both sentinelone and crowdstrike. I can say I've had pretty good experiences with both so far but I have seen Crowdstrike be able to detect more things (fileless attacks), seen less false positives and also be a lighter agent on the machines we've tested. Also Crowdstrike's sales engineer went above and beyond with helping setup best practices etc.

I've done my research and it appears Crowdstrike much more often than not test better in independent evaluations like MITRE and be rated better (gartner). Sentinelone seems still to be mentioned 5/6 times more in these threads. I'd like to do my due diligence in questioning CS to make sure I make a good decision. Are most people's decision to not go Crowdstrike due to:

barrier to entry (minimums)
Slightly higher pricing?
Easy consumption model (pax8)?

I'd love to understand anyone else's viewpoint for other reasons!

If you go CS Falcon Complete, you will find you have more time in your day and sleep sounder each night. The only caveats are that CS does not 'sync monthly' I believe you have to do an annual and you should probably buy more licenses than you currently need in case you take on more endpoints.

We put them head to head and CS gets the edge. S1 is going to be better than most every legacy solution but if you're ok with paying a little premium, CS is currently the best you can get.

Cloud4C

cloud4c.com › blogs › sentinelone-vs-crowdstrike-which-one-is-right-for-cybersecurity-assessments

SentinelOne vs CrowdStrike:Choose Right EDR/XDR Solution

One is focused on real-time intelligence and finding threats around the world, while the other can fix threats on its own at machine speed. This blog compares SentinelOne vs CrowdStrike in depth to see how well each one works as a tool for making ...

Ithq

ithq.pro › insights › sentinelone-vs-crowdstrike-features-pricing-and-independent-testing-insights

SentinelOne vs. CrowdStrike: Features, Pricing, and ...

In the latest evaluations, CrowdStrike showcased its prowess by obtaining the highest scores across all tested vendors in both open-book and closed-book tests, indicating its robust detection and response capabilities. SentinelOne, while also performing strongly, focused on showcasing its extended data retention and rapid contextualization of alerts, which are critical factors in handling sustained and sophisticated cyber threats.

TechRepublic

techrepublic.com › home › sentinelone vs palo alto: compare edr software

SentinelOne vs Palo Alto Cortex XDR (2024): Which Tool is Best?

May 27, 2024 - SEE: SentinelOne vs CrowdStrike: ... comparison, Cortex XDR aims to reduce the alert fatigue often associated with data analysis by letting people only receive notifications about the events that matter most to them....

Gartner

gartner.com › reviews › market › endpoint-protection-platforms › compare › product › cortex-xdr-vs-crowdstrike-falcon

Cortex XDR vs CrowdStrike Falcon 2025 | Gartner Peer Insights

Crowdstrikes cloud-based telemetry analysis enables rapid innovationnew tactics and techniques discovered in the wild are quickly addressed, often within hours. This is a major advantage over legacy ... ... ... The most The support it is hard to get anything from them it could have been better, they will be able to support integrations but for troubleshooting with them would be a pain.... ... Cortex XDR and CrowdStrike Falcon have reviews in the Mobile Threat Defense, Extended Detection and Response and Endpoint Protection Platforms markets

reddit.com › r/sysadmin › if not crowdstrike, what your other option?

r/sysadmin on Reddit: if not crowdstrike, what your other option?

July 20, 2024 -

So… the dust has almost settled.

my question is, what’s your alternative to crowdstrike if you want out?

the whole situation was kinda funny for me at least since we were heavily looking at getting crowdstrike or sentinel 1 over sophos but money issues prevented it from happening. I think this will now get factored in if we want to move out of sophos.

reddit.com › r/sysadmin › paloalto cortex xdr -vs- crowdstrike falcon

r/sysadmin on Reddit: PaloAlto Cortex XDR -vs- Crowdstrike Falcon

May 14, 2021 -

Doing a POC of both for endpoint security, but for those of you have used them - what's your take? We currently use Cisco for our physical network stack, but will likely be moving to PA for firewalls so XDR would play nice with them...and XDR seems legit.

But, word on the street is Crowdstrike blows everything else out of the water...

I realize there is a huge variation of offerings depending on the tier of license you buy with either product - what's been your experience? False positives? Remediation functions? Any and all opinions/info are appreciated.

Hey there, In the last two years I have worked in the InfoSec departments at both a Crowdstrike org and a Cortex XDR org. Up front I will say that I think they are both excellent products in their own right and at a high level, they will both serve you well in stopping malicious programs. But I will try to give some further insights. Wall of text to follow, but I hope you find it helpful... Crowdstrike is a great product that is super easy to setup and maintain. The company I worked for that ran it was... well.. freaking awful from a security perspective to the point that I was genuinely surprised every single day when I walked into the office and didn't see ransomware messages on all the screens. To be clear, Crowdstrike wasn't the reason why this wasn't the case (it was pure luck), but Crowdstrike certainly stopped/alerted on plenty of other crap. Crowdstrike's backend dashboard is done in Splunk which is a mixed bag. On one hand hand it gives some really excellent visibility and logging, on the other hand it constantly felt like we were running up against missing features that just felt like it was some sort of licensing compromise between Crowdstrike and Splunk. You'd see all of this great data, but there was just no good way to do any sort of alerting on any of it. It was incredibly frustrating. It would be unfair of me to call Crowdstrike a one trick pony, but from a feature standpoint I'd say Crowdstrike is a bit limited. That could be fine, because the features it does have are really excellent and I'd much prefer a product that does a few things really well instead of a product that checks a gazillion feature boxes but does them all half assed (looking at you Sophos). I was also pretty disappointed in the granularity of controls/policies in Crowdstrike. They have improved in this regard over the years, but there were several times where I found myself having to make changes at a global level when really only wanting to target a specific system/binary/user/whatever. For whatever it is worth, I will say that we paid for the Falcon managed threat hunting component for a year and it was completely pointless. Never heard a damn thing from them including during pen tests where we saw suspicious activity all over the Crowdstrike logs. Just a complete waste of money. (I haven't tried the Palo equivalent, but sight unseen, I'd expect it to be equally useless) Lastly, I will say that Crowdstrike is a very, very popular product - as it should be. It's very good. But, and this may be a controversial take, I find running a security product that is extremely common in the enterprise to have a bit of a downside as it is expected. As an example, during the last Pentest we had conducted at this employer the pentester asked what endpoint protection software we utilized and when we said Crowdstrike he replied with "cool, that won't be a problem".. And it really wasn't. I am not at all saying that Cortex would have performed better there, but the penetration tests I have performed with Cortex (and previously Traps) shops the response from the pen testers have basically been "Huh, Haven't encountered that one before. This could be interesting..." I feel that is a good thing. So Cortex XDR... Again, it is a great product in my opinion. However, where Crowdstrike is pretty simple and easy to deploy with limited options and configurability, Cortex XDR is the exact opposite. Yes, you can deploy Cortex as a simple malware tool and just focus on enabling the malware protection policies. That's simple and totally workable, but if you only focus on that you are missing a lot of useful levers that you could be pulling. Cortex features application whitelisting/blacklisting capabilities, sandboxing, local firewall and workstation encryption controls, removable media controls, integration with firewall logs and behavior analytics across all of it, etc... (Note that Crowdstrike does overlap on some of these features, but I think Cortex does them all much better). As an example, our deployment of Cortex strictly blocks the execution of programs and scripts from any location that a standard user can write to: %UserProfile%, Network shares, and removable media. This control alone increases our security footprint by a huge amount well before the cortex malware controls get involved. Similarly, we use Cortex to enforce a local firewall policy on all endpoints that prevent lateral communication in our workstation subnets and that set very strict firewall policies for systems when they are off our network. These things can of course be done outside of Cortex with local firewall policies (indeed Cortex is just managing the windows firewall under the cover) and applocker, but Cortex makes the implementation and management of them MUCH easier. All that said, the malware protection systems are indeed excellent and I have seen it catch things that other products missed. I saw that the product manager for Cortex responded in this thread saying that they caught the Solarwinds breach malware. I do not believe that is blowing smoke. The product is pretty fantastic. On the downside, Palo's licensing for Cortex can get insane and really frustrating. The "Prevent" licensing level is in my opinion really reasonably priced and an excellent product. I think it is a sweet spot. As soon as you become interested in the Pro line which adds the behavioral analytics stuff the pricing starts to get dumb. And if you take the next step to the Pro+Network licensing which will combine the firewall logs with the cortex ones, well, Palo is fucking smoking crack in my opinion. For these products you have to ingest the logs into Palo's cloud based data lake "Cortex Data Lake" and they charge a stupid amount for it. It is really quite asinine. Data lake is effectively a (very) lite SIEM solution that is priced per TB. From a licensing standpoint it looks very Splunk like, but that is about the only similarity as it is very, very limited in features. Hell you can't even see the Cortex XDR logs in the data lake directly. And of course since it is per TB based it forces customers to strictly control the log ingestion from the Palo firewalls which means you're constantly making compromises between cost and security. And anyone who has ever managed Palo firewalls knows their logs are INSANELY large. The value prop is that Palo has backend voodoo going on for doing the behavioral analytics for their own products which is swell for generating the alerts, but from an end user perspective the data lake is just shit and I'd much, much, much rather have an on-prem logging engine and the easy ability of ingesting all of this into my own SIEM. At my current gig we are running Cortex XDR Pro (not network). We wanted the +Network side, but the price point was just ludicrous. All that said XDR Pro is really excellent and the behavioral call outs are routinely great (after a good deal of tuning). They have also started the weird add-on game. They added a "Host Insights" module that is vulnerability management lite. Gives you some visibility of what is installed on your endpoints and what known vulnerabilities exist, but at least currently Cortex does nothing with that data. It's just an odd add-on that has no real direct benefit for most companies that already have a solution in this space, and it is still pretty expensive for what it is. Just seems like a really odd area for Palo to be burning developer cycles on. So that's my take. The bottom line is that I think both Crowdstrike and Cortex are really great. The only other solution that I have looked at that holds a candle to them is Sentinel One. But, given my choice, I go with Cortex XDR because I pull every single lever and I think when treated as an entire security suite it is a far superior solution. If you are strictly concerned with just malware protection, I say it is a toss up and go with who gives you the better price. I wrote this while nursing a migraine and sitting through meetings that only partially involve me. Sorry if the above diatribe is exploding with typos and misspellings.