# Cortex XSOAR: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 62 judge labels across 3 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/cortex-xsoar

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [SOAR platforms](https://www.gane.ai/index/it/security/soar-platforms/index.md) | 8% | 4 | 45% | 60 |
| [AI SOC agents](https://www.gane.ai/index/it/security/ai-soc-agents/index.md) | 0% | 70 | 0% | 1 |
| [Incident management and on-call](https://www.gane.ai/index/it/operations/incident-management-and-on-call/index.md) | 0% | 41 | 0% | 1 |

## What the models said for it

- "Choose Cortex XSOAR if you have a complex enterprise environment, want native threat intelligence management, and need an expansive marketplace of out-of-the-box integrations." (Gemini 3.5 Flash, SOAR)
- "Currently widely considered the market leader... Choose Palo Alto Cortex XSOAR if you are an enterprise organization looking for the industry-standard, "do-it-all" powerhouse." (Qwen 3.7 Flash, SOAR)
- "For maximum flexibility and ecosystem depth: Choose Cortex XSOAR if you have a dedicated security team and can allocate a higher budget." (GLM 4.7 FlashX, SOAR)
- "Choose Cortex XSOAR if: You have a complex security tool stack, need extensive integrations, and have dedicated SOAR engineers." (GLM 4.7 FlashX, SOAR)

## And against it

- "Avoid for tight budgets: Enterprise-heavy tools like Palo Alto Cortex XSOAR, Splunk SOAR, or FortiSOAR" (Grok 4.20, SOAR)
- "Palo Alto Cortex XSOAR – Powerful but expensive, complex... It's overkill for a small team." (DeepSeek V4 Flash, SOAR)
- "you should be cautious about Cortex XSOAR, Splunk SOAR, Swimlane, IBM QRadar SOAR, and Torq" (Mistral Small, SOAR)
- "typically start at $10K–$100K+ per year, making them unsuitable for limited budgets" (DeepSeek V4 Flash, SOAR)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 0 | 1 | 1 | 3 |
| GPT-5.4 mini | 1 | 2 | 0 | 0 | 3 |
| Gemini 3.5 Flash | 1 | 1 | 0 | 3 | 5 |
| Perplexity Sonar | 1 | 0 | 1 | 4 | 6 |
| Grok 4.20 | 1 | 1 | 1 | 4 | 7 |
| Mistral Small | 1 | 1 | 4 | 1 | 7 |
| DeepSeek V4 Flash | 0 | 0 | 1 | 5 | 6 |
| Llama 4 Maverick | 1 | 1 | 2 | 1 | 5 |
| Qwen 3.7 Flash | 1 | 0 | 0 | 4 | 5 |
| Kimi K2 | 1 | 1 | 1 | 2 | 5 |
| GLM 4.7 FlashX | 3 | 0 | 0 | 0 | 3 |
| MiniMax M2.5 | 1 | 0 | 1 | 1 | 3 |
| GPT-6 Luna | 1 | 0 | 0 | 0 | 1 |
| Muse Glimmer 30B | 1 | 1 | 0 | 1 | 3 |

## Sources returned with these answers

The sites and pages cited by the answers that named Cortex XSOAR, from 165 of the 188 answers that named it (only the models that return a source list).

### Domains cited

- csoonline.com: 69
- aimultiple.com: 68
- softwareadvice.com: 45
- strike48.com: 44
- g2.com: 43
- gane.ai/index: 41
- expertinsights.com: 40
- paloaltonetworks.com: 39
- peerspot.com: 39
- cloudsek.com: 38

### Pages cited

- https://csoonline.com/article/3622920/soar-buyers-guide-11-security-orchestration-automation-and-response-products-and-how-to-choose.html: 69
- https://aimultiple.com/top-soar-platforms: 68
- https://softwareadvice.com/soar: 42
- https://cloudsek.com/knowledge-base/best-soar-platforms: 37
- https://ciopages.com/buyer-guides/security-orchestration-automation: 33
- https://comparitech.com/net-admin/best-soar-software: 33
- https://expertinsights.com/network-security/the-top-soar-solutions: 29
- https://intezer.com/guides/soar-security/soar-platform-guide: 28

## In its own words

What Cortex XSOAR's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: Cortex Internal Developer Portal makes it easy for engineering organizations to gain visibility into their services and deliver high quality software. (https://trust.cortex.io)
- For: engineering organizations (https://trust.cortex.io)
- Certifications: ISO 27001
- Customers named: BigCommerce, Rapid7, Pismo, H&R Block, Skyscanner, Tala, Archer, Outreach

## What it publishes

Every page cortex.io exposes, read 2026-09-29: 781 addresses. By kind, pages and the last 90 days:

- blog: 324 pages, 7 in the last 90 days, latest 2026-08-11
- case study: 15 pages, 2 in the last 90 days, latest 2026-08-05
- webinar or virtual event: 2 pages, 0 in the last 90 days, latest 2026-01-27
- conference or event: 2 pages, 0 in the last 90 days, latest 2025-06-18
- report or ebook: 66 pages, 0 in the last 90 days, latest 2026-06-16
- comparison: 16 pages, 1 in the last 90 days, latest 2026-08-18
- template or tool: 2 pages, 0 in the last 90 days, latest 2026-01-14
- glossary or explainer: 32 pages, 1 in the last 90 days, latest 2026-09-03
- podcast or video: 24 pages, 6 in the last 90 days, latest 2026-09-10
- Recent: 2026-09-10 podcast or video: Judgment is the job planera s naveen puvvula on keeping the human at the front of the pdlc https://www.cortex.io/podcasts/judgment-is-the-job-planera-s-naveen-puvvula-on-keeping-the-human-at-the-front-of-the-pdlc
- Recent: 2026-09-03 glossary or explainer: What is an internal developer portal https://www.cortex.io/post/what-is-an-internal-developer-portal
- Recent: 2026-08-27 podcast or video: Attacker expertise just got commoditized semgrep s adam berman on security in the agent era https://www.cortex.io/podcasts/attacker-expertise-just-got-commoditized-semgrep-s-adam-berman-on-security-in-the-agent-era
- Recent: 2026-08-18 comparison: Drive vs dx core 4 https://www.cortex.io/post/drive-vs-dx-core-4
- Recent: 2026-08-13 podcast or video: Garbage in garbage out splunk s steve flanders on why ai can t fix your bad telemetry https://www.cortex.io/podcasts/garbage-in-garbage-out-splunk-s-steve-flanders-on-why-ai-can-t-fix-your-bad-telemetry
- Recent: 2026-08-11 blog: Drive and space https://www.cortex.io/post/drive-and-space

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.