No more typing reviews! Try our Samantha, our new voice AI agent.

Darktrace vs ExtraHop Reveal(x) 360 comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Darktrace
Ranking in Extended Detection and Response (XDR)
6th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
85
Ranking in other categories
Email Security (11th), Intrusion Detection and Prevention Software (IDPS) (1st), Network Traffic Analysis (NTA) (1st), Network Detection and Response (NDR) (1st), Cloud Security Posture Management (CSPM) (11th), Cloud-Native Application Protection Platforms (CNAPP) (11th), Attack Surface Management (ASM) (4th), AI-Powered Cybersecurity Platforms (4th), AI Observability (12th)
ExtraHop Reveal(x) 360
Ranking in Extended Detection and Response (XDR)
27th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
6
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (15th), Container Security (35th), Network Traffic Analysis (NTA) (10th)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Pasan Jayarathna - PeerSpot reviewer
Network Security Engineer at Cyberwell Solution
Monitoring has improved data loss detection and now spots abnormal internal file transfers quickly
In my understanding, the best feature Darktrace offers is the identification of copying files, which acts as a DLP, and it is a main concern for companies because users sometimes copy data outside without knowing, especially those without a technical background. When I mention the DLP-like feature and file copying detection, the alerts have been very timely, as we get an alert within a couple of minutes, which is excellent. Even if some developers are working after hours and copying files, our SOC team detects this, and most of the time they call us so we can identify the users. The alerts are quite accurate and proactive.
Umair Shahid - PeerSpot reviewer
Senior Network Consultant at a insurance company with 1,001-5,000 employees
Improved threat detection has transformed our investigation speed and network visibility
In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms. Second, some of the alert accuracy can be improved and simplified, since there are sometimes false positives. Lastly, dashboard customization could be more flexible, allowing engineers to create role-based dashboards rather than just application-based ones. I would say scalability is another area worth considering for ExtraHop Reveal(x) 360, particularly in large enterprise environments such as ours. As the network grows across data centers, cloud platforms, and distributed infrastructure, the platform needs to scale efficiently without compromising packet capture analytics or detection performance. I would also like to see simpler capacity planning and, if possible, more flexible hardware expansion and improved visibility into appliance resource utilization.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"But overall, when we speak about security and protection, they are one of the top providers."
"Stability is a primary factor, and then there's the ease of distribution and policy management; Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them."
"The tool is designed to scale for large enterprises and handle large volumes of data."
"The level of security I get for my endpoints and servers is extremely valuable."
"I have found the solution to be very easy in respect of the integration and configurable."
"We have found in our test Cortex XDR by Palo Alto Networks to be a very good tool."
"Traps has drastically reduced our endpoint attack surface via advanced detection capabilities, sandboxing of never before seen programs, and by drastically limiting where executables can launch in the first place."
"The Enterprise Immune System, Cyber Artificial Intelligence Analyst, and Antigena technology are all very useful aspects of the product."
"The solution is stable. We've never had any problems with it."
"I find it very good in the way that they show the past events, including the attack history, and you are able to visualize all of the attack paths and connectivity to see what's happened."
"I am a very happy user and a happy seller of Darktrace."
"It's a very stable product."
"The Dynamic Threat Dashboard is very nice, as it lists all of your threats and rates them, and then you can choose whether to investigate further."
"The main valuable feature is that we don't need a lot of analysts. With few analysts, we have all the network monitored, 24/7."
"Darktrace is very flexible."
"Overall, I would say it is very valuable for real-time network visibility, behavior, and threat detection."
"It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic. It is also easy to handle and easy to understand."
"ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments."
"Their technical support is more effective and of better quality than other competitors."
"ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform."
"It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management."
"It is scalable."
 

Cons

"Whenever the tool releases a new version when deploying the product across the organization, I feel like there are some disturbances in the CPU usage after upgrading the tool to the latest version."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"I am facing issues with customer support for Cortex XDR by Palo Alto Networks, so I am not satisfied with customer support."
"The tool needs to be improved in terms of integration and interface."
"The solution lacks real-time, on-demand antivirus."
"It'll help if customization was easier."
"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."
"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."
"Darktrace would tell you, for example, if there was a ransomware attack, but it wouldn't stop the attack."
"The product is considered expensive compared to others."
"Darktrace is a closed technology, meaning we know very little about how it works, including the architecture, which is significant. As a result, when we implement the system and find we're getting many false positives, we have minimal insight into why it's happening and what we can do to fix it. We don't know how the solution is configured, the criteria for threats to be determined, or the product's inner workings. We understand that they have to ensure privacy and their copyright, but we want to see some documentation or public research into the security Darktrace provides."
"The pricing is a bit high for the region."
"The one downside is the pricing, which is quite high."
"Darktrace could expand into EDR (endpoint detection and response) and combine it with its network detection."
"I would like to see more protection in the endpoint. Especially because we have a lot of people using VPNs. If they would improve end point security, it would give more control there."
"The solution could be easier to use."
"I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR."
"They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers."
"There needs to be more support."
"Their professional service can be improved."
"One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace."
"In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms."
"A drawback includes bucket storage limitations for payload data, necessitating timely extraction for thorough investigations."
 

Pricing and Cost Advice

"The cost depends on your chosen license type, like Pro or other licenses."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
"I don't recall what the cost was, but it wasn't really that expensive."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"The tool's price is moderate."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"The pricing is expensive. It costs over $100,000 a year."
"When it comes to large installations, it can be expensive, but for small accounts it's fine."
"The cost of the solution is expensive for smaller businesses. They will not be able to afford it or might not need this type of security solution."
"The product is expensive."
"There is an annual license to use Darktrace."
"We've budgeted about 50,000 Kuwaiti dinars for the solution. That is a yearly operating cost."
"It was $3,600 a month or $2,000 plus or so. I am not sure. Its licensing is pretty simple."
"The cost is moderate."
"When compared to other solutions, it aligns with the market average, indicating a competitive pricing level."
report
Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.
921,523 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
11%
Financial Services Firm
9%
Comms Service Provider
9%
Government
7%
Comms Service Provider
14%
Financial Services Firm
10%
Construction Company
8%
Outsourcing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise21
Large Enterprise29
No data available
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for Darktrace?
Concerning pricing for the product, I would say it is somewhat expensive.
What needs improvement with ExtraHop Reveal(x) 360?
One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. In...
What advice do you have for others considering ExtraHop Reveal(x) 360?
We have covered most of the features over the past three years and look forward to discovering more as we work closel...
What is your primary use case for ExtraHop Reveal(X) Cloud?
I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
ExtraHop Reveal(X) Cloud, Reveal(X) Cloud
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol, Allianz, KKR, AIRBUS, dpd, Billabong, Mclaren Group.
Wizards of the Coast
Find out what your peers are saying about Darktrace vs. ExtraHop Reveal(x) 360 and other solutions. Updated: October 2026.
921,523 professionals have used our research since 2012.