The XSIAM displacement
Palo Alto Networks reported $3.41 billion in revenue for the fiscal fourth quarter of 2026, which marks a 34% increase over the previous year, while next-generation security ARR reached $9.10 billion during this same period. I view the push into Cortex XSIAM as a direct challenge to legacy SIEM vendors like IBM or Splunk. This platform ingests granular data at nearly half the list cost of older products. It reaches an alert-to-incident compression ratio of 50:1 or higher. Organizations report that the mean time to detect drops to minutes instead of hours. The system automates response actions through built-in SOAR playbooks. The AI Analyst capability investigates and closes certain incident types without human involvement. XSIAM replaces the need for analysts to run manual queries on raw logs. The platform ingests everything, correlates it automatically, and surfaces high-fidelity incidents rather than raw alerts. I find the continuous discovery of vulnerabilities through native attack surface management to be the most effective way to outpace threats. This capability relies on threat intelligence from tens of thousands of Palo Alto Networks customers.
The CrowdStrike rivalry
CrowdStrike grew its revenue 26% to $1.39 billion in its fiscal first quarter, compared with $1.1 billion in the year-ago period. Its annual recurring revenue reached $5.5 billion. I find that the competition between these two giants defines the current market. If you prioritize endpoint detection depth alone, I suggest CrowdStrike Falcon. Its Charlotte AI capabilities provide more mature analyst workflows than Cortex XDR. However, the Palo Alto platform covers cloud, network, and SOC needs through a single integration. You should consider this if you want to replace multiple point solutions with one vendor. Palo Alto’s revenue in its fiscal third quarter grew 31% to $3 billion. I note that while CrowdStrike focuses on the endpoint, Palo Alto targets the entire enterprise stack. CrowdStrike reported record net new ARR growth of $256 million, an increase of 32% year over year. CrowdStrike CEO George Kurtz said the introduction of Anthropic’s Mythos created an inflection point for cybersecurity in the AI ecosystem. The demand for security is rising because deploying AI across the enterprise is risky without protection. I wonder if Palo Alto can maintain its growth while catering to such a massive, diverse user base.
Implementation and the competitive landscape
A move to a platform like XSIAM requires a 12 to 24 month program. The annual cost for XSIAM typically ranges from £200,000 to over £1 million based on data ingestion and user counts. For an enterprise with 2,000 employees, a full consolidation costs between £1.5 million and £4 million annually. I find the migration from legacy systems to this AI-driven platform difficult because of its complexity. Fortinet provides a comparable platformization vision at a lower price point for mid-market organizations. Zscaler focuses on cloud-only SASE and does not compete on firewalls or SIEM. If you run a complex multi-cloud architecture, Prisma Cloud provides the necessary coverage for code security, CSPM, CWPP, CIEM, and API security. I find that the integration between Prisma Access and the rest of the platform allows a credential compromise detected by Cortex XDR to trigger a policy change to block lateral movement. The pricing for Palo Alto products depends heavily on data ingestion volumes, number of cloud resources, or deployment scale. If you prioritize simplicity, Zscaler’s ZIA and ZPA products provide a more direct path for remote workforces. I suggest the Cortex XDR option if you want to displace your current endpoint vendor.
