# Palo Alto Networks Cortex XSIAM: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 20 judge labels across 5 categories by 11 of 14 models. Page: https://www.gane.ai/index/it/vendors/palo-alto-networks-cortex-xsiam

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [SIEM platforms](https://www.gane.ai/index/it/security/siem-platforms/index.md) | 0% | 18 | 14% | 7 |
| [AI SOC agents](https://www.gane.ai/index/it/security/ai-soc-agents/index.md) | 0% | 30 | 17% | 6 |
| [Identity threat detection and response](https://www.gane.ai/index/it/identity/identity-threat-detection-and-response/index.md) | 0% | 35 | 0% | 3 |
| [SOAR platforms](https://www.gane.ai/index/it/security/soar-platforms/index.md) | 0% | 19 | 0% | 3 |
| [Extended detection and response](https://www.gane.ai/index/it/security/extended-detection-and-response/index.md) | 0% | 70 | 100% | 1 |

## What the models said for it

- "Deepest data consolidation, AgentiX for custom agents, strong compliance | Less agnostic; expensive if not already on PAN" (Grok 4.20, AI SOC agents)
- "utilizing their native platforms (Cortex XSIAM/XSOAR or Google SecOps) provides deep, out-of-the-box integration" (Gemini 3.5 Flash, SOAR)
- "| 5 | Palo Alto Cortex XSIAM (AgentiX) | Platform incumbent | Deepest consolidation, 1.2B playbook executions |" (MiniMax M2.5, AI SOC agents)
- "Choose CrowdStrike / SentinelOne / Palo Alto when you want identity signals fused with endpoint/XDR" (Muse Glimmer 30B, ITDR)

## And against it

- "enterprise buyers saw Palo Alto Networks Cortex XSIAM at 0% first-choice share with an 11% negative rate" (Muse Glimmer 30B, AI SOC agents)
- "Cheaper options may lack the depth of premium platforms like Palo Alto Cortex XSIAM" (Grok 4.20, XDR)
- "may be unsuitable if your architecture requires fully on-premises deployment" (Perplexity Sonar, SIEM)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 2 | 0 | 2 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 2 | 1 | 0 | 3 |
| Perplexity Sonar | 0 | 1 | 0 | 1 | 2 |
| Grok 4.20 | 0 | 1 | 1 | 1 | 3 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 0 | 1 |
| Llama 4 Maverick | 0 | 0 | 1 | 0 | 1 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 0 | 1 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 1 | 0 | 1 |
| MiniMax M2.5 | 0 | 3 | 0 | 0 | 3 |
| GPT-6 Luna | 0 | 1 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 1 | 0 | 1 | 2 |

## Sources returned with these answers

The sites and pages cited by the answers that named Palo Alto Networks Cortex XSIAM, from 86 of the 93 answers that named it (only the models that return a source list).

### Domains cited

- underdefense.com: 33
- github.com: 28
- paloaltonetworks.com: 25 (its own site)
- g2.com: 24
- securityboulevard.com: 21
- microsoft.com: 19
- intezer.com: 17
- exabeam.com: 16
- gane.ai/index: 16
- crowdstrike.com: 13

### Pages cited

- https://github.com/volod-k/agentic-ai-soc-knowledge-base/blob/main/research/how-to-evaluate-vendors/best-ai-soc-enterprise.md: 18
- https://github.com/volod-k/agentic-ai-soc-knowledge-base/blob/main/research/how-to-evaluate-vendors/best-agentic-soc-platforms.md: 13
- https://underdefense.com/blog/siem-solutions-comparison: 12
- https://www.gane.ai/index/it/security/ai-soc-agents/enterprise: 10
- https://reliaquest.com/cyber-knowledge/ai-soc-tools: 10
- https://conifers.ai/blog/top-ai-soc-agents: 9
- https://resources.rework.com/tools/ai-agents/best-ai-agents-for-cybersecurity-2026: 9
- https://techrepublic.com/article/siem-tools: 9

## In its own words

What Palo Alto Networks Cortex XSIAM's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: the unified AI-driven SOC platform (https://www.paloaltonetworks.com/cortex/cortex-xdr)
- For: SOC (https://www.paloaltonetworks.com/cortex/cortex-xdr)
- Integrations claimed: 1000 (https://www.paloaltonetworks.com/cortex/managed-xsiam)
- Certifications: FedRAMP, HIPAA
- Customers named: Green Bay Packers, CBTS, Oneida Nation, NHL, MoJ, State of Louisiana, North-West University, BCA

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.