No more typing reviews! Try our Samantha, our new voice AI agent.

CylancePROTECT vs Intercept X Endpoint (Sophos) comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
120
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
BlackBerry Cylance Cybersec...
Ranking in Endpoint Protection Platform (EPP)
36th
Average Rating
8.0
Reviews Sentiment
4.6
Number of Reviews
44
Ranking in other categories
No ranking in other categories
Intercept X Endpoint
Ranking in Endpoint Protection Platform (EPP)
14th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
110
Ranking in other categories
Endpoint Detection and Response (EDR) (13th), ZTNA (13th), Managed Detection and Response (MDR) (11th), Extended Detection and Response (XDR) (15th), Ransomware Protection (3rd)
 

Mindshare comparison

As of October 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, up from 3.7% compared to the previous year. The mindshare of BlackBerry Cylance Cybersecurity is 1.7%, up from 1.1% compared to the previous year. The mindshare of Intercept X Endpoint is 1.8%, up from 1.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
Intercept X Endpoint1.8%
BlackBerry Cylance Cybersecurity1.7%
Other92.7%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Sooraj Makkancherrry - PeerSpot reviewer
Security Operations Manager at Philips
Doesn't have daily updates, which is important for healthcare IT
I face challenges with the exclusion policy - it still scans folders we told it not to, causing issues. When we contact support, they tell us to update the latest agent, but we can't do that immediately due to medical device protocols and validation testing. I wish support would try to understand our issues better instead of giving this standard response. The machine learning feature they use often tells us to upgrade the agent or add things to the exclusion list, which isn't unacceptable. It's a very good and new technology as a tool and antivirus. But sometimes, it doesn't work properly with our medical devices and products, quarantining files it shouldn't even after we add them to exclusions. This is tricky for us.
Ashutosh Jha - PeerSpot reviewer
Project engineer at IT Solution india private limited
Endpoint protection has prevented attacks and keeps our daily work productive and secure
I rate Intercept X Endpoint a 10 out of 10 because it is working very fine for my environment and has prevented loss of productivity. I choose 10 out of 10 because Intercept X Endpoint protects my environment well, featuring web control, peripheral control, Threat Analysis Center, application control, and DLP alongside being accessible from cloud services. I advise others looking into using Intercept X Endpoint to choose Sophos for a cloud solution due to its AI and behavior-based detection capabilities. I believe Intercept X Endpoint is the best EDR solution, and I would always recommend it to customers because it is very effective. My overall review rating for Intercept X Endpoint is 10 out of 10.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is easy to use."
"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"The solution is a new generation XDR that has a lot of artificial intelligence modules."
"It detected stuff that other things wouldn't detect."
"The most valuable feature is that you can select remote access of any machine for sandboxing."
"The live terminal is probably the best thing ever. It gives you the access to get straight onto any machine."
"It has pretty much everything we need and works well within the Palo Alto ecosystem."
"I don't have to do much monitoring with it; I don't have to have anybody manually looking at this, it gives us reports, and it lets us know if something needs to be addressed, and we can easily address it."
"You can manage all the threats and everything from a centralized dashboard."
"The initial endpoint cost may seem a little high (~$55/device/year), but when you look at the total peace of mind that the solution of Cylance endpoint protection provides, with no reboots for updates, and negligible performance impact, it is well worth it."
"It does a good job of protecting us."
"It handles situations that the other threat management tools wouldn't find. It has worked well covering the weaker sides of the other products that we're integrating."
"The solution is easy to deploy."
"Endpoints are protected in real-time without the need of a centralized server, whitelist, or the ability to connect to a central host in the cloud."
"Does malware analysis. Blocks WannaCry and other attacks that have come out."
"It secures different entry points into the network."
"One of the best features of Sophos Intercept is that it repairs without slowing down the system."
"Technical support from Sophos is rated as nine out of ten, which represents high quality."
"The most valuable features of Sophos Intercept X are the minimal configuration needed for the end user and the central view of all the endpoints. There are plenty of tools to control and manage the endpoints. Additionally, there is the capability of connecting the endpoint to the CLI."
"We find all features valuable."
"It is an intelligent tool."
"The most valuable features are ease of use and the GUI."
"We use Intercept X Advanced along with Sophos EDR (Enhanced Data Detection and Response) for our servers and clients as advanced protection, and it is not just a simple virus scanning product."
"Once we started using CrowdStrike, it was so lightweight; the servers have hardly any lag unlike when we used to use Intercept X Endpoint for servers, so it's actually very good."
 

Cons

"The solution needs better reports. I think they should let the customer go in and customize the reports."
"As an improvement, I would like to see enhanced connection speeds."
"The solution could improve by providing better integration with their own products and others."
"There are some false positives."
"For working with the solution, you only really need a web browser, however, we've found that working on Chrome, for example, is horrible."
"I have faced some issues with Cortex XDR by Palo Alto Networks; there is room for improvement in the sense that certain options prevent us from seeing and segregating data."
"I would like to see some additional features related to email protection included."
"Limited remote connection."
"The problem is, for me, sometimes it creeps into the computers and into the servers that we want to get running."
"The process of whitelisting a script that you want to be able to run can be a little bit difficult, or awkward."
"The security scripting needs improvement. It needs deeper security for scripting."
"I would like to see them fix the alerting system so that the endpoint reporting is a bit more streamlined."
"If they can improve the technical support SLA, that aspect of the product will be much appreciated."
"The OPTICS component could be made more user-friendly with respect to giving people more information."
"It was not effective. There were a lot of false positives, even when we use Adobe, and everybody uses Adobe, which is not a threat."
"There are a lot of false positives and it takes up a lot of time."
"It's a big issue that there isn't a way to do remote deployment. It's actually difficult because you have to depend on a third party to make sure it actually works."
"Sophos Intercept X doesn't have its own firewall that utilizes the Windows Firewall or intrusion prevention."
"Intercept X could enhance its support services, particularly in terms of response time and resource allocation."
"The initial setup is a lot harder than, for example, Carbon Black. It's more difficult and complex."
"The ADR functionalities feel like they aren't mature enough."
"The one thing that I think probably needs the most attention with this product is the technical support."
"Installing Sophos Intercept X was not as straightforward, as we had to ask support and had to work with an integrator, though the process didn't take much time, e.g. it was completed within one hour."
"It consumes a lot of resources, and something needs to be done for that."
 

Pricing and Cost Advice

"The pricing is okay, although direct support can be expensive."
"This is an expensive solution."
"Cortex XDR by Palo Alto Networks is an expensive solution."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"The pricing is a little bit on the expensive side."
"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"I am using the Community edition."
"It's the most expensive solution, but features-wise, it's quite strong. It's very good for protection, so the results are very good in the case of protection. I would rate it a two out of ten in terms of pricing."
"It is expensive, but not unreasonable."
"It's not so heavily priced; rather, it's average and decent."
"CylancePROTECT is an affordable solution."
"We pay our license on a yearly basis and have just renewed for two years."
"On a scale from one to ten, where one is cheap and ten is expensive, I rate the solution's pricing a seven out of ten."
"The solution's pricing is around the same as most EDRs but slightly behind some of the major ones."
"​Shop around for sure and be assured the price you pay will be close to other solutions available, but even at a slight mark-up from the other solutions, you are getting real endpoint protection versus nothing more than a cheap security blanket that might keep you warm at night."
"The license price for this solution could be better. It's on the expensive side."
"We have an annual subscription."
"Licensing is based on the number of users. They give a discount for editors who are considered as important members. From what I know, Sophos products are not expensive. If you have a license extension, you just need to contact the editor or partner to change the mode of licensing or extend the license to cover more people."
"The pricing is quite expensive compared to the rest. I would rate the pricing a four out of ten; one is expensive, and ten is cheap."
"The price of Sophos Intercept X is expensive. The license is paid on an annual basis. There are extra features that can be added depending on the endpoints. The solution is priced twice as much as the Comodo solution."
"I am not sure about the cost. I would guess it to be between $50 to $60 per license. This would be the cost of the overall subscription. There is no additional fee."
"I find the pricing to be a little bit expensive, although it is acceptable, for now."
"The pricing is actually quite reasonable."
"When you start going to the EDR technologies and the MTR, it is a little bit expensive. It's a very good technology, and obviously, you're going to pay for it, but the pricing could do a little bit of work."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
13%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Construction Company
12%
Outsourcing Company
11%
Financial Services Firm
7%
Manufacturing Company
7%
Outsourcing Company
12%
Construction Company
10%
Comms Service Provider
9%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business48
Midsize Enterprise21
Large Enterprise56
By reviewers
Company SizeCount
Small Business33
Midsize Enterprise5
Large Enterprise14
By reviewers
Company SizeCount
Small Business76
Midsize Enterprise21
Large Enterprise22
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Ask a question
Earn 20 points
How does Crodwstrike Falcon compare with Sophos Intercept X?
I like that Crowdstrike Falcon allows me to easily correlate data between my firewalls. Its detection and machine lea...
What is your experience regarding pricing and costs for Sophos Intercept X?
Intercept X Endpoint has some impact on the budget. It is quite costly when measuring Intercept X Endpoint's protecti...
What needs improvement with Sophos Intercept X?
Intercept X Endpoint can be improved in several ways. Currently, it is only available on the cloud, and having it ava...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Blackberry Protect
Sophos Intercept X
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Panasonic, Noble Energy, Apria Healthcare Group Inc., Charles River Laboratories, Rovi Corporation, Toyota, Kiewit
Flexible Systems
Find out what your peers are saying about BlackBerry Cylance Cybersecurity vs. Intercept X Endpoint and other solutions. Updated: September 2026.
917,433 professionals have used our research since 2012.