No more typing reviews! Try our Samantha, our new voice AI agent.

ExtraHop Reveal(x) 360 vs SentinelOne Singularity Endpoint comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
ExtraHop Reveal(x) 360
Ranking in Extended Detection and Response (XDR)
27th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
6
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (15th), Container Security (35th), Network Traffic Analysis (NTA) (10th)
SentinelOne Singularity End...
Ranking in Extended Detection and Response (XDR)
1st
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
289
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Anti-Malware Tools (2nd), Endpoint Detection and Response (EDR) (2nd), AI-Powered Cybersecurity Platforms (3rd), AI Observability (2nd)
 

Mindshare comparison

As of November 2026, in the Extended Detection and Response (XDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 4.7%, down from 5.8% compared to the previous year. The mindshare of ExtraHop Reveal(x) 360 is 1.2%, up from 0.7% compared to the previous year. The mindshare of SentinelOne Singularity Endpoint is 6.3%, down from 6.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR) Mindshare Distribution
ProductMindshare (%)
SentinelOne Singularity Endpoint6.3%
Cortex XDR by Palo Alto Networks4.7%
ExtraHop Reveal(x) 3601.2%
Other87.8%
Extended Detection and Response (XDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Umair Shahid - PeerSpot reviewer
Senior Network Consultant at a insurance company with 1,001-5,000 employees
Improved threat detection has transformed our investigation speed and network visibility
In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms. Second, some of the alert accuracy can be improved and simplified, since there are sometimes false positives. Lastly, dashboard customization could be more flexible, allowing engineers to create role-based dashboards rather than just application-based ones. I would say scalability is another area worth considering for ExtraHop Reveal(x) 360, particularly in large enterprise environments such as ours. As the network grows across data centers, cloud platforms, and distributed infrastructure, the platform needs to scale efficiently without compromising packet capture analytics or detection performance. I would also like to see simpler capacity planning and, if possible, more flexible hardware expansion and improved visibility into appliance resource utilization.
Vaibhav Mahendra Kolhe - PeerSpot reviewer
Soc Analyst at Softcell Technologies Limited
Automation has reduced alerts and freed the soc team to focus on faster incident response
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Has great threat detection capabilities."
"The scalability of Cortex XDR by Palo Alto Networks is very good."
"We switched because there were a lot of added features with Palo Alto that Check Point didn't have, and it was an upgrade for us."
"Cortex XDR lets us manage several clients from the same console, and its endpoint defense is more advanced than traditional antivirus."
"Since using Cortex XDR by Palo Alto Networks, our MTTR has reduced, which means the mean time to resolve any ticket has been reduced."
"Cortex XDR by Palo Alto Networks saves time in various ways, although the user interface is fairly standard."
"Palo Alto is the best security solution in the market."
"The solution is a new generation XDR that has a lot of artificial intelligence modules."
"ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform."
"It is scalable."
"It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management."
"ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments."
"Their technical support is more effective and of better quality than other competitors."
"Overall, I would say it is very valuable for real-time network visibility, behavior, and threat detection."
"It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic. It is also easy to handle and easy to understand."
"SentinelOne Singularity Endpoint is definitely reliable; we have never been able to take it down, even when we tried."
"The solution can search for hidden and dormant threats on encrypted traffic in your environment."
"I believe Singularity Platform is perfectly fine overall."
"We saw a return of investment within the first month."
"The most valuable feature of SentinelOne Singularity Complete is the STAR Rules."
"The ability to quickly and easily identify threats on our machines is valuable. The fact that it protects the environment as a whole is also valuable. They have the ability to identify network nodes, and they have Ranger as a component of the solution that allows us to see the whole picture. We can see on what we have SentinelOne and on what we do not."
"It has a one-click button that we can use to reverse all those dodgy changes made by the virus program and bring the system quickly back to what it was. That's one of the most important features."
"Offers good protection against ransomware."
 

Cons

"For Cortex XDR by Palo Alto Networks, if I had to point out improvements, I would say the UI is still somewhat difficult for beginners."
"I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities."
"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."
"Currently, if you use Palo Alto endpoint protection as the only solution it's very complicated to remove pre-existing threats."
"There are some false positives. What our guys would have liked is that it would have been easier to manipulate as soon as they found a false positive that they knew was a false positive. How to do so was not obvious. Some people complained about it. The interface, the ESM, is not user-friendly."
"Fine-tuning the detection policy requires experience because the policy is very complex in Cortex XDR by Palo Alto Networks, and we get high false positive alerts."
"The GUI could be improved. It's a little bit cumbersome. It could be more user-friendly."
"The installation should be easier and the Palo Alto pre-sales and sales teams should have more information on the product because they don't know what they are selling."
"Their professional service can be improved."
"A drawback includes bucket storage limitations for payload data, necessitating timely extraction for thorough investigations."
"There needs to be more support."
"I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR."
"One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace."
"In terms of improvement for ExtraHop Reveal(x) 360, I highly suggest, first, that the integration capabilities be further enhanced, perhaps with SIEM and SOAR solutions and firewall management platforms."
"They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers."
"The areas that have room for improvement in Singularity Platform include the fact that I am really not happy with the vulnerability management."
"I have to go in and build new exclusions daily, so it can be a headache for certain users and programs."
"I've had some issues with the specific agents, however, we are moving off of that particular OS that we were having issues with. Other than that, it's been a pretty solid tool."
"They need to improve how we install the software."
"Some features could be more user-friendly; for instance, setting restrictions in the explorer for what level one must be to use it is not user-friendly and it is difficult to find what we're searching for."
"Initially, I felt that it produced very high false positive alerts, which led to a resource consumption issue being a major setback for us, such as high CPU and disk utilization."
"Every site has its own key. I'm not sure how I can implement the key for the setup package, therefore with every installation I need to do it manually and put on the site keys."
"One area that has room for improvement in SentinelOne Singularity Endpoint is the inability to create a custom dashboard."
 

Pricing and Cost Advice

"Cortex XDR by Palo Alto Networks is an expensive solution."
"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."
"The price was fine."
"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."
"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."
"I don't like that they have different types of licenses."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"The cost of Cortex XDR by Palo Alto Networks is $55 to $90 USD per endpoint per month."
"When compared to other solutions, it aligns with the market average, indicating a competitive pricing level."
"SentinelOne Singularity Complete is a fair price."
"The pricing is on the higher end, making it less suitable for small or medium-sized businesses and perhaps not the ideal fit for the public sector where budget constraints may be more pronounced."
"The license is paid annually and is competitive."
"There are cheaper options out there that I know are not as effective. I have administered several of them, not for this organization but for others. The thing I like about SentinelOne is that I know that if it raises an alert, it is worth looking at, so we are not dealing with a lot of false positives. It is rare."
"I rate Singularity Complete four out of 10 for affordability. SentinelOne costs more than traditional antivirus solutions, but we get more out of it. It hasn't saved us any money, but it's an EDR solution, so we get a lot of value from it."
"Its cost is similar to Trend Micro, but the protection is much better."
"I don't know about the licensing model. It seems easy, but it's not my area of expertise. I don't have information on how it compares to its competitors, but the pricing is per device."
"My understanding is that we did a pretty good deal on SentinelOne. A part of that is because we were their customers very early on, and we also use their products a lot. We are interested in the new products that come out. We go to their demos, and we go to their events. We do save a lot of money. It is not cheap, but it is worth it. We spend a lot of money on a lot of things, and most of them do not do as much as SentinelOne."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
921,523 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Comms Service Provider
14%
Financial Services Firm
10%
Construction Company
8%
Outsourcing Company
8%
Outsourcing Company
12%
Manufacturing Company
10%
Computer Software Company
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
No data available
By reviewers
Company SizeCount
Small Business139
Midsize Enterprise74
Large Enterprise99
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with ExtraHop Reveal(x) 360?
One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. In...
What advice do you have for others considering ExtraHop Reveal(x) 360?
We have covered most of the features over the past three years and look forward to discovering more as we work closel...
What is your primary use case for ExtraHop Reveal(X) Cloud?
I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time ...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What is your experience regarding pricing and costs for SentinelOne Singularity?
It is neither too costly, but definitely, it is one of the advantages that SentinelOne is quite adapted towards the p...
What needs improvement with SentinelOne Singularity?
I have encountered an issue related to the alerting mechanism in SentinelOne Singularity Complete. Sometimes I need t...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
ExtraHop Reveal(X) Cloud, Reveal(X) Cloud
Sentinel Labs, SentinelOne Singularity, Singularity Platform
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Wizards of the Coast
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Find out what your peers are saying about ExtraHop Reveal(x) 360 vs. SentinelOne Singularity Endpoint and other solutions. Updated: October 2026.
921,523 professionals have used our research since 2012.