ASM TOOL PROFILE · RANK 5 OF 9
Cortex Xpanse review: internet-wide scanning with automated response playbooks
THE SHORT ANSWER
Cortex Xpanse ranks 5 of 10 at 6.40 out of 10. Palo Alto Networks documents internet-wide scanning and Active Response playbooks with deep ties to Cortex XSOAR, so it scores well on finding assets, containment and stack fit. Its pages reviewed do not describe exploitability validation or a retest after a fix, and Palo Alto Networks publishes no price (a UK reseller lists one).
Rank 5 of 10 on default weights
Company: Palo Alto Networks
Deployment: SaaS within the Cortex portfolio.
Best for: Palo Alto Networks Cortex estates that want automated response through XSOAR
Gartner Peer Insights (context, not scored): 4.5 (66 ratings). Context only; not a score input.
Which steps does Cortex Xpanse document?
- FOUNDDocumented
Internet-wide IPv4 scanning several times a day.
- OWNEDPartial
Third-party stakeholders identified; subsidiary attribution not detailed.
- PROVENNot documented
Exploitability validation not described on the pages reviewed.
- CONTAINEDDocumented
Active Response automated playbooks.
- ROUTEDDocumented
Routing and remediation through Cortex XSOAR playbooks.
- RECHECKEDNot documented
Retest after a fix not described.
How does Cortex Xpanse score on each criterion?
| Criterion | Weight | Score | Why | Source |
|---|---|---|---|---|
| Finds the unlisted estate | 15% | 8 / 10 | Palo Alto Networks states it scans all 4.3 billion IPv4 addresses several times a day and 500 billion+ ports daily. | |
| Routes to an owner | 10% | 7 / 10 | Identifies third-party stakeholders for exposures; subsidiary attribution detail is not on the pages reviewed. | |
| Proves exploitability | 20% | 5 / 10 | Exploitability validation is not described on the product pages reviewed; the emphasis is discovery and response. | |
| Contains before the patch | 20% | 7 / 10 | Active Response runs built-in automated playbooks against exposures; edge WAF rules are not named. | |
| Closes the loop | 15% | 6 / 10 | Routes and remediates through Cortex XSOAR playbooks; a retest after the fix is not described. | |
| Fits the enterprise stack | 10% | 9 / 10Tied highest | Native ties to Cortex XSOAR and Prisma Cloud inside the Palo Alto Networks Cortex portfolio. | |
| Buying transparency | 10% | 3 / 10 | No price from Palo Alto Networks; a UK G-Cloud reseller listing shows £70,850.84 per instance per year. |
What does Cortex Xpanse do, by its own account?
Internet-wide scanning tied to automated response playbooks inside the Palo Alto Networks Cortex portfolio.
- Scanning
- Palo Alto Networks states Xpanse scans all 4.3 billion IPv4 addresses multiple times a day and more than 500 billion ports daily.
- Active Response
- Built-in automated playbooks.
- Platform ties
- Xpanse with Cortex XSOAR playbooks and with Prisma Cloud; third-party stakeholders identified for exposures.
- Name
- Still marketed as Cortex Xpanse on the pages reviewed.
What does Cortex Xpanse claim?
No vendor performance figure was collected for this page.
Palo Alto Networks cites being a Leader in The Forrester Wave: Attack Surface Management Solutions, Q3 2024.
What does Cortex Xpanse cost, and what do you need to start?
No price from Palo Alto Networks. Reseller price: a UK G-Cloud 14 listing by Khipu Networks shows £70,850.84 per instance per year, no free trial, public-facing attack surface only.
To start: Not published on the pages reviewed.
Where is it strong, and what should you check?
Strengths
- Internet-wide scan data and automated response playbooks in one portfolio.
- Native ties to Cortex XSOAR and Prisma Cloud.
Check before you buy
- Exploitability validation is not described on the pages reviewed.
- No vendor price; the only published figure is a reseller's G-Cloud listing.
Who should choose Cortex Xpanse?
Choose Cortex Xpanse if Cortex XSOAR already runs your response and you want exposures acted on by playbook. Look elsewhere if proof of exploitability is your main gap.
How does Cortex Xpanse compare head to head?
| Opponent | Higher overall | Cortex Xpanse scores higher on | Opponent scores higher on |
|---|---|---|---|
| IONIX | IONIX | Fits the enterprise stack | Finds the unlisted estate, Routes to an owner, Proves exploitability, Contains before the patch, Closes the loop and Buying transparency |
| watchTowr | watchTowr | Fits the enterprise stack and Buying transparency | Proves exploitability, Contains before the patch and Closes the loop |
| CyCognito | CyCognito | Contains before the patch and Fits the enterprise stack | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency |
| Hadrian | Hadrian | Finds the unlisted estate, Contains before the patch and Fits the enterprise stack | Proves exploitability, Closes the loop and Buying transparency |
| CrowdStrike EASM | Cortex Xpanse | Finds the unlisted estate, Routes to an owner, Contains before the patch and Fits the enterprise stack | No criterion |
| Tenable ASM | Cortex Xpanse | Finds the unlisted estate, Routes to an owner, Contains before the patch and Closes the loop | No criterion |
| Rapid7 Surface Command | Cortex Xpanse | Finds the unlisted estate, Routes to an owner, Contains before the patch, Closes the loop and Fits the enterprise stack | Buying transparency |
| Censys ASM | Cortex Xpanse | Finds the unlisted estate, Routes to an owner, Contains before the patch and Fits the enterprise stack | Buying transparency |
| Microsoft Defender EASM | Cortex Xpanse | Finds the unlisted estate, Proves exploitability, Contains before the patch, Closes the loop and Fits the enterprise stack | Buying transparency |
Frequently asked questions
What is Active Response in Cortex Xpanse?
Built-in automated playbooks that act on exposures, per Palo Alto Networks. Remediation can also run through Cortex XSOAR playbooks.
Does Cortex Xpanse validate exploitability?
It is not described on the product pages reviewed. The emphasis is discovery from internet-wide scanning and automated response.
Is Cortex Xpanse still sold under that name?
Yes. It was still marketed as Cortex Xpanse on the Palo Alto Networks pages reviewed in September 2026.
Read next
- Beyond Cortex Xpanse: alternatives
Eight alternatives ranked on our weights
- Line Cortex Xpanse up against others
Every score side by side
- Exposure triage calculator
Set your own weights and must-haves
- How we weigh
Criteria, weights and limits
- Related lesson: Compensating controls
Four ways to buy time, and what each costs.