Skip to content
Z Zendikt
C
SOAR Software · Rank #2 of 10

Cortex XSOAR review and pricing

War-chest playbook marketplace, with XSIAM convergence ahead.

By Palo Alto Networks · Founded 2015 · Santa Clara, CA · public

Cortex XSOAR (formerly Demisto, acquired by Palo Alto Networks in 2019 for $560M) is the SOAR platform with the largest pre-built playbook marketplace (the Cortex Marketplace ships 1,000+ content packs). The product excels for Palo Alto-anchored SOCs running Cortex XDR. The defining 2026 question: Palo Alto launched XSIAM in late 2022 explicitly to converge SIEM, XDR, and SOAR into one platform, and XSIAM is now the strategic priority. Standalone XSOAR continues to ship, but every Palo Alto analyst day reinforces XSIAM as the destination. Trade-offs: licensing complexity, multi-year contracts standard, and the open question of whether XSOAR is being quietly sunset into XSIAM.

Visit Cortex XSOAR Compare to Splunk SOAR
Best for

Palo Alto Networks-anchored SOCs running Cortex XDR or XSIAM that need the deepest playbook marketplace and are willing to commit to the Palo Alto ecosystem for the next 5 years.

Worst for

Non-Palo Alto SOCs (XSOAR list price not justified outside the stack), engineering-led teams (Tines, Torq win), or buyers nervous about XSIAM cannibalization.

Vendor Trust Score

Is Cortex XSOAR a trustworthy vendor?

6.4/10
Mixed
Pricing transparency
Published rates; no hidden fees
4.0
Contract fairness
Reasonable terms; no auto-renew traps
5.5
Incident response
How they handle outages and breaches
8.5
Post-acquisition behavior
Customer treatment after M&A or PE
7.0
Executive stability
Leadership churn over 24 months
7.5
Roadmap honesty
Public commitments held
6.0
Trust signal log
  • 2019-03-28
    Palo Alto Networks acquired Demisto for $560M
  • 2022-10-04
    XSIAM launched, raising standalone XSOAR longevity questions
    Palo Alto positioned XSIAM as the future SecOps platform, with SIEM, XDR, and SOAR converged.
  • 2025-02-12
    Cortex XSOAR 8.5 release continues independent product line, despite XSIAM emphasis
Vendor Trust is scored independently of product quality. A great product from an unfair vendor still earns a low trust score.
Review Intelligence

What 410 reviews actually say

Synthesized from G2, Capterra, Reddit, Trustpilot. Patterns >15% prevalence shown.

Last synthesized
2026-04-29

Praise patterns

  • Largest pre-built playbook marketplace
    87% →
  • Native Cortex XDR integration
    78% →
  • Mature case management and war room
    64% →
  • Active developer community via Marketplace
    51% →

Complaint patterns

  • XSIAM convergence raises future of standalone XSOAR
    64% ↑
  • Licensing complexity across XSOAR + XDR + XSIAM
    71% ↑
  • Pricing among highest in category
    51% →
  • Multi-year contracts standard
    41% →
Sentiment trend (6 months)
81/100 0 pts
12
01
02
03
04
05
Patterns are extracted from review corpus and human-verified. We surface trends, not anecdotes.
Verified Pricing

What buyers actually pay

71 anonymized deal disclosures · last updated 2026-05-01

Contribute your deal price
Company size Median annual
500-2,000 employees $180,000
2,000-10,000 employees $480,000
Verified pricing is crowdsourced from buyers under anonymity guarantees. Vendor-listed prices are validated against actual deals quarterly.
Compliance & Security

Auto-verified certifications

Verified 2026-05-01
SOC 2 Type II
ISO 27001
HIPAA
GDPR
CCPA
PCI DSS
FedRAMP Authorized

Editorial: Strengths

  • Largest pre-built playbook marketplace (1,000+ content packs)
  • Native Cortex XDR and XSIAM integration
  • Mature case management and war room collaboration
  • Threat intel management built in (formerly Demisto TIM)
  • Strong MSSP multi-tenancy
  • Active developer community via Marketplace

Editorial: Weaknesses

  • XSIAM convergence path raises whether standalone XSOAR has long-term future
  • Licensing complexity (XSOAR + XDR + XSIAM SKU overlap)
  • Pricing among the highest in category
  • Multi-year contracts standard
  • Best-fit narrowed to Palo Alto-anchored stacks
  • Founder team (Demisto founders Slavik Markovich and Rishi Bhargava) largely departed post-acquisition

Key features & integrations

  • +1,000+ pre-built content packs (Cortex Marketplace)
  • +Native Cortex XDR / XSIAM integration
  • +Visual playbook editor
  • +War Room collaboration
  • +Threat Intel Management
  • +Case management
  • +Multi-tenancy for MSSP
  • +Python and JavaScript scripting
800+ integrations
Cortex XDRCortex XSIAMPalo Alto PrismaSplunkCrowdStrikeMicrosoft SentinelServiceNow
Geography supported
Global
Best fit
1,000-100,000+ employees · Palo Alto-anchored enterprise SOC
Editorial deep-dive

Read our full ranking of SOAR Software

Cortex XSOAR ranks #2 in our editorial review of 10 soar software platforms. The deep-dive covers methodology, comparison tables, decision matrix, migration scoring, and FAQs.

Read the full ranking

Closest alternatives in SOAR Software

#1
Splunk SOAR
Deepest playbook engine for Splunk-anchored SOCs.
★ 4.3 opaque
#3
Tines
No-code automation, security-born, now expanding into IT and engineering.
★ 4.8 partial
#4
Torq
Hyperautomation positioning, founded by the original Demisto team.
★ 4.7 opaque
Help the next buyer

Contribute your verified deal price

Pricing in B2B software is opaque because vendors want it that way. Verified buyer prices fix that, anonymously. Share what you actually paid for Cortex XSOAR; we’ll add it to the verified pricing dataset on this page (with company size band only, no identifying details).

Submit anonymously