CyberIndexBeta

Cortex XDR

Palo Alto NetworksEnterprise Antimalware (primary)Compare with others in Enterprise Antimalware

Product

Palo Alto Networks' endpoint security and extended detection and response product, providing prevention, detection and response for security operations teams. Cortex XDR ® connects data from endpoint, network, cloud, identity, and email sources and applies AI to detect and prioritize cyberattacks, no matter where they come from. Cortex XDR features prevention modules tailored to stop every technique used in modern attacks, from zero-day exploits to fileless malware, hijacking legitimate processes — and whatever comes next. Expand XDR with industry-leading NG-SIEM, Endpoint Data Loss Prevention, Exposure Management, Email Security, and Cloud Security—all unified within a single analyst experience on the Cortex Platform. It runs on Android, iOS, Linux, macOS and Windows.

Current Version
9.4.0.454
Product Page
paloaltonetworks.com/…/cortex-xdr
Market
Enterprise
Licence
Paid
Price
Quote
Record Created
2026-08-20
Last Updated
2026-10-28

Vendor

Palo Alto Networks was founded in 2005 by Nir Zuk, who had written the first stateful inspection engine at Check Point, and built the next-generation firewall — an appliance that identifies the application in a flow rather than judging it by port number. That product made the company, and it is now one of the largest security firms in the world, listed on Nasdaq, with around 16,000 employees and over 70,000 customers. Its range is organised under three names: Strata for network security and the PA-Series firewalls, Prisma for cloud and SASE, and Cortex for security operations — Cortex XDR for detection and response, Cortex XSOAR for automation, Cortex Xpanse for attack-surface discovery and Cortex XSIAM as the platform it is steering customers toward. Unit 42 is its threat intelligence and incident response arm. What appears in this index is the endpoint and firewall end of that portfolio. Its endpoint agent is sold as part of a platform rather than on its own, which is worth knowing when comparing its price and its test results with a standalone product's. Vendor page →

Website
paloaltonetworks.com
Country
United States
Headquarters
Santa Clara, United States
Year Established
2005
Customers
70K organisations
Users
100M users
Revenue
$11.5B (2026)

Platforms

Androidnative
iOSnative
Linuxnative
macOSnative
Windowsnative

Target Market

Enterprise secondary

Capabilities

Malware Detectionkeynative
Ransomware Protectionkeynative
Behavioral Detectionkeynative
Web ProtectionkeyNot known
Email ProtectionNot known
Host Firewallnative
Sandbox AnalysisNot known
Cloud-Assisted Scanningnative
Heuristic Detectionnative
Device Controlnative
Vulnerability Shieldingnative
Central Management Consolenative

3 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 9.4.0.454Linux
  • 9.4.0.442Windows
  • 9.4.0macOS
  • 9.3.2iOSreleased 2026-09-27
  • 9.3Androidreleased 2026-08-17

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

At a glance — latest result per lab test

MITRE ATT&CK Evaluations (Enterprise)

2024-12-11lab report ↗

Each bar is one lab’s own figure on that lab’s own scale. Labs test different models at different times, so the figures are not combined into one score.

MITRE ATT&CK Evaluations (Enterprise)MITRE ATT&CK Evaluations — Enterprise 20242024-12-11
Technique-level detection: 100%Any detection: 100%Benign activity not alerted: 95%Attack sub-steps evaluated: 80

Certifications

FedRAMPHigh1 activeFR2317253567
OESIS Framework SupportSupported1 activeSupported
OPSWAT Certified Security ApplicationGold1 activeGold

Change History

This record was created 2026-08-20. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 9.3.2 (iOS)evidence
  • 2026-10-21New versionNew version: 9.4.0.454 (Linux)evidence
  • 2026-10-21New versionNew version: 9.4.0 (macOS)evidence
  • 2026-10-13New versionNew version: 9.4.0.442 (Windows)evidence
  • 2026-10-12Certification addedCertified: FedRAMP (High)evidence
  • 2026-10-07Test result addedNew MITRE ATT&CK Evaluations (Enterprise) resultevidence
  • 2026-09-23New versionNew version: 9.3.0.202 (Linux)evidence
  • 2026-09-23Capability addedCentral Management Console: built inevidence
  • 2026-09-23Capability addedHost Firewall: built inevidence
  • 2026-09-23Capability addedDevice Control: built inevidence
  • 2026-09-23Capability addedCloud-Assisted Scanning: built inevidence
  • 2026-09-23Capability addedVulnerability Shielding: built inevidence
  • 2026-09-23Capability addedHeuristic Detection: built inevidence
  • 2026-09-23Capability addedRansomware Protection: built inevidence
  • 2026-09-23Capability addedMalware Detection: built inevidence
  • 2026-09-22Product updatedListed in Enterprise Antimalwareevidence
  • 2026-09-22Product updatedListed in Home Antimalwareevidence
  • 2026-09-20New versionNew version: 9.3 (Linux)evidence
  • 2026-09-20New versionNew version: 9.3.1 (iOS)evidence
  • 2026-09-20New versionNew version: 9.3 (Android)evidence
  • 2026-09-19Platform addedRuns on iOSevidence
  • 2026-09-19Platform addedRuns on Androidevidence
  • 2026-09-19Platform addedRuns on Linuxevidence
  • 2026-09-19Product updatedNo longer sold to: Consumerevidence
  • 2026-09-19Pricing plan addedPrice: price on requestevidence
  • 2026-09-09New versionNew version: 9.3.0.209 (Windows)evidence
  • 2026-09-09New versionNew version: 9.3.0 (macOS)evidence
  • 2026-09-04Product updatedListed in Network Firewallevidence
  • 2026-08-20Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-08-20Capability addedBehavioral Detection: built inevidence
  • 2026-08-20Pricing plan addedPrice: paidevidence
  • 2026-08-20Product updatedAlso sold to: Enterpriseevidence
  • 2026-08-20Product updatedAlso sold to: Consumerevidence
  • 2026-08-20Platform addedRuns on macOSevidence
  • 2026-08-20Platform addedRuns on Windowsevidence
  • 2026-08-20Certification addedCertified: OPSWAT Certified Security Application (Gold)evidence
  • 2026-08-20New versionNew version: 9.3.0.209evidence
  • 2026-08-20Product createdNew product listedevidence
Something wrong? Suggest a correction →

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.