Compete: Cortex Portfolio
Battle Cards

Where PAN Wins

• Native NGFW telemetry: PANW firewall customers get NGFW logs natively in XDR. CrowdStrike is endpoint-first — no network security story without a connector.
• True agentic AI vs. generative: AgentiX executes actions autonomously. Charlotte AI is conversational — it advises, but doesn't act without human initiation for each step.
• SOAR included: XSOAR has 1,000+ playbooks and native War Room. Falcon Fusion requires more manual configuration and has narrower integration breadth.
• Single-agent upgrade path: Prevent → Pro → MDR, same agent. CrowdStrike bundle changes require more licensing complexity at each upgrade tier.
• Platform pricing advantage at scale: XSIAM platform licensing vs. CrowdStrike's per-endpoint + usage-based NG SIEM. PANW claims 29% lower 5-year TCO in platform comparisons.

Where They're Strong

• IR brand recognition: CrowdStrike's IR pedigree and Falcon Complete MDR have strong boardroom credibility. 97.7% MITRE Managed Services detection, 4 min MTTD.
• Lightweight agent narrative: Falcon's single-agent architecture is genuinely lightweight. PANW has improved, but the perception gap remains in some accounts.
• Charlotte AI momentum: Increasing enterprise interest in Charlotte AI's natural language query capability. Generative AI is resonating even if not fully agentic.

Landmines to Set

• "Ask CrowdStrike to demo real-time correlation of a network-based attack with endpoint activity — without adding a separate SIEM or purchasing NG SIEM."
• "What does CrowdStrike NG SIEM cost per TB of non-Falcon data ingested? Get the pricing for firewall logs, cloud trails, and identity events specifically."
• "Walk me through how Falcon Fusion automates response across a non-CrowdStrike EDR, a PANW firewall, and a ServiceNow ticketing system — how many manual steps remain?"
• "Ask about the July 2024 outage — what architectural changes prevent a single content update from affecting endpoint stability at that scale again?"

Traps They Set

• "NG SIEM is included free with Falcon." Counter: The bundled tier is limited in retention and non-Falcon data volume. Real enterprise deployments at scale require paid NG SIEM tiers that price comparably with XSIAM — but without the unified data lake.
• "XSIAM has complex deployment." Counter: 740 XSIAM customers, >$600M ARR (up 100% year over year) and >17 PB/day ingested demonstrate real-world deployment at scale. Complexity is a managed services opportunity for Optiv.
• "Charlotte AI is already agentic." Counter: Charlotte AI generates answers and recommendations. AgentiX executes — contains endpoints, runs playbooks, creates tickets. Agentic means autonomous action, not just AI answers.

Key Objections

Where PAN Wins

• MITRE validation: SentinelOne withdrew from the most recent MITRE ATT&CK endpoint evaluation. PANW has participated and demonstrated top-tier prevention and detection results. Use this aggressively.
• Platform depth: PANW has native SOAR (XSOAR — still sold standalone, with AgentiX 1.4 positioned as its evolution), native MDR (Unit 42), native ASM (Xpanse Expander 2.14) and native SIEM (XSIAM 3.6). SentinelOne is primarily an EDR vendor with lighter adjacencies.
• NGFW integration: PANW firewall telemetry feeds XDR natively. SentinelOne has no equivalent network security integration pathway.
• Unit 42 IR heritage: Unit 42 Vigilance MDR is a newer service; Unit 42 is one of the world's most recognized incident response teams with active global IR engagements feeding intelligence into MDR.
• Agentic AI depth: AgentiX executes autonomous response actions. Purple AI is an investigative assistant — it helps analysts work faster but doesn't autonomously contain threats or run playbooks.

Where They're Strong

• Story Graph: SentinelOne's attack visualization is strong and praised by analysts — it's a competitive differentiator in demos.
• Purple AI momentum: Strong market interest in Purple AI for natural language investigation queries. Analysts respond well to the conversational interface in demos.
• Cloud workload coverage: Strong Kubernetes and container visibility; competitive for cloud-native environments.

Landmines to Set

• "SentinelOne withdrew from the most recent MITRE ATT&CK evaluation. Ask them directly why — and what that means for their detection efficacy claims vs. vendors who participated."
• "How does SentinelOne automate response across your Palo Alto NGFWs, your ServiceNow tickets, and your Active Directory — what does that playbook look like and how many steps are manual?"
• "What is SentinelOne's 5-year roadmap for a SIEM platform? If you're going to consolidate, does SentinelOne have a credible SIEM story, or are you still going to need a separate SIEM and SOAR?"

Key Objections

Where PAN Wins

• Non-Microsoft asset coverage: Defender XDR is M365-native. Linux workloads, Cisco network equipment, AWS-native services, and non-Azure cloud resources get significantly weaker detection and response in the Microsoft stack.
• SOAR depth: XSOAR has 1,000+ integrations and War Room. Sentinel's Logic Apps-based SOAR has ~350 connectors and no equivalent collaboration workspace for major incidents.
• Agentic AI: Copilot for Security is a paid add-on ($4/user/hour consumption-based). AgentiX 1.4 is licensed per user — Enterprise includes 4 users and 800 CU per year, Base includes 2 users and 400 CU per year — with FedRAMP Moderate and High authorization and a choice of frontier models.
• NGFW integration: Microsoft has no NGFW story outside Azure. PANW NGFW telemetry natively feeds XDR/XSIAM correlation — unique in mixed-vendor environments.
• MDR: Microsoft has no native MDR service; they rely on MXDR partners. Unit 42 is a single, named team with consistent IR intelligence and defined SLAs.

Where They're Strong

• M365 E5 bundling: Many organizations are already paying for Defender XDR as part of E5. "We already have it" is the strongest objection in Microsoft shops.
• Azure-native integration: For organizations running heavily on Azure, Sentinel's native integration with Azure services is a genuine advantage.
• Copilot for Security interest: Microsoft's AI narrative has strong executive appeal at the CISO level, even before customers have evaluated the actual capability depth.

Key Objections

Where XSOAR Wins

• Integration breadth: 1,000+ integrations vs Splunk SOAR's 300+. The gap is especially pronounced in security-specific, less-common integrations that enterprise SOCs need.
• War Room: XSOAR's War Room has no equivalent in Splunk SOAR, Swimlane, or Tines. For major incident management, this is a decisive differentiator.
• TIM native: Threat Intelligence Management is built into XSOAR; competitors rely on external SIEM or separate TI platforms for TIM capability.
• PANW native integration: Native, zero-latency integration with Cortex XDR 5.2, NGFW on PAN-OS 12.2, Xpanse Expander 2.14, Cortex Cloud and XSIAM 3.6. Competitors must use connectors for every PANW interaction.
• Security content depth: Marketplace playbooks purpose-built for security use cases. Swimlane and Tines are general-purpose automation tools with less security-specific content.

Landmines vs. Splunk SOAR

• "Cisco acquired Splunk — what's the roadmap for Splunk SOAR integration with Cisco products? Will XSOAR connectivity for Cisco devices be maintained or deprecated?"
• "How many of your playbooks run fully autonomously today vs. requiring manual analyst action at one or more steps? What's your actual automation rate on alert volume?"
• "When you have a major incident — P1 ransomware, confirmed breach — how do your analysts collaborate? Are they in Slack/Teams plus the SOAR console plus the SIEM, pivoting between three systems?"