Vendor profile
Cortex XSOAR profile: a SOAR adding AI agents in place
The short answer
By The Triage Desk · AI Cyber Compare · Published 2026-10-08
Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.
Which operating model is XSOAR?
Primary model: SOAR playbook engine.
It also reaches into: AI SOC analyst Palo Alto describes Cortex AgentiX as the next generation of Cortex XSOAR, adding agents that reason and plan inside the existing estate.
Who carries each stage in XSOAR?
- Your analysts
- Rules you write
- AI agent
- Provider's analysts
- Shared
- Not described
- Investigate: AgentiX agents can reason and plan inside existing playbooks.
Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026
- Respond: Approval can be required for high-impact actions.
Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026
XSOAR matches the general SOAR pattern on every stage.
What does XSOAR document?
| Capability | Status |
|---|---|
| Runs response actions itself | Documented |
| Approval or sign-off before actions | Documented |
| Can act alone on some cases | Documented |
| Translates existing SOAR playbooks | Not described |
| Optional service where the vendor's people work the queue | Not described |
| Multi-tenant or MSSP offering | Not described |
| On-premises, hybrid or your own cloud tenant | Documented |
| Single-tenant option | Not described |
| Data residency option | Not described |
| Integration count published | Documented |
| Pricing unit or tiers published | Not described |
Documented: 5 of 11. Not described: translating existing SOAR playbooks, an optional service where its own people work the queue, a multi-tenant or MSSP offering, a single-tenant option, a data residency option and a published pricing unit or tiers.
What are XSOAR's strengths?
Strengths
- The largest integration and content catalog among the vendors here.
- SaaS and on-premises editions, and a route to agents without migrating playbooks.
What are XSOAR's limits?
Limits
- Investigation depth per alert still depends largely on the playbooks your team maintains.
- Pricing is not published, and XSOAR 8 On-prem has a stated end-of-life date of 30 September 2029.
What does XSOAR say about its own results?
Key facts
| Fact | Detail |
|---|---|
| Playbooks | Visual playbook editor, war room collaboration, case management, threat intel management with Unit 42 intelligence. Source: Palo Alto Networks: Cortex XSOAR · Read 27 Sep 2026 |
| Cortex AgentiX | "The next generation of Cortex XSOAR": agents that "reason, plan and execute workflows", act "within existing roles and permissions" and can "require approval for high-impact actions". Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026 |
| Prompts in playbooks | Teams can drop prebuilt AI prompts into playbooks or write their own in natural language. Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026 |
| Editions | XSOAR 8 SaaS, XSOAR 8 On-prem (end of life 30 September 2029), XSOAR 6. Source: Cortex XSOAR documentation · Read 27 Sep 2026 |
Integrations, deployment, pricing, compliance and funding
- Integrations
- 900+ prebuilt integrations and automation packs; thousands of security actions in the Marketplace.
- Deployment
- Cortex XSOAR 8 SaaS, Cortex XSOAR 8 On-prem (end of life 30 September 2029 per Palo Alto documentation) and Cortex XSOAR 6.
- Pricing
- Not published
- Compliance
- Not reviewed
- Funding
- Not in our sources
If XSOAR is not the fit, which vendors document what it does not?
| Capability | Documented by |
|---|---|
| Translates existing SOAR playbooks | Mate Security |
| Optional service where the vendor's people work the queue | 7AI, Artemis Security, Exaforce and Prophet Security |
| Multi-tenant or MSSP offering | Conifers CognitiveSOC and Dropzone AI |
| Single-tenant option | Dropzone AI and Prophet Security |
| Data residency option | Conifers CognitiveSOC and Dropzone AI |
| Pricing unit or tiers published | Dropzone AI, Intezer and Tines |
How does XSOAR compare head to head?
Dispatches that mention XSOAR
Asked often about this page
What does Cortex XSOAR cost?
Not published.
Does Cortex XSOAR replace SOAR?
It is a SOAR. Palo Alto describes Cortex AgentiX as the next generation of Cortex XSOAR, adding agents that reason and plan inside the existing estate.
Does Cortex XSOAR offer a managed service?
Not on the pages reviewed. Cortex XSOAR is sold as software your team runs.
Sources for this profile
Source: Palo Alto Networks: Cortex XSOAR · Read 27 Sep 2026
Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026
Source: Cortex XSOAR documentation · Read 27 Sep 2026