[advisory]List reference prices. The figures on this page are the vendor’s published list or reference prices, not negotiated quotes. Actual pricing varies with volume, contract term, and reseller discount, and should not be used as a basis for procurement decisions. Always request a direct quote from the vendors you shortlist.
Palo Alto Networks does not show Cortex XDR prices on its own site, but its US-dollar list prices are public in UK G-Cloud 15 filings by its resellers. On that list, Cortex XDR Prevent is $40 and Cortex XDR Pro is $70 per endpoint per year, and Pro is also sold by data volume at $400 per daily ingested GB per year. Data ingestion beyond endpoints, extra retention and managed threat hunting are separate line items.
The two subscription tiers
| Tier | List / endpoint / year | What it is |
|---|---|---|
| Prevent | $40 | Endpoint protection: NGAV, host firewall, device control, exploit and behaviour prevention. 180 days of alert retention. |
| Pro (per endpoint) | $70 | Adds detection and response on collected endpoint data, with 30 days of data retention. The XDR tier. |
| Pro (per daily GB) | $400 / GB | Pro licensed by daily ingested data volume, for third-party and network sources. 30 days of ingested-data retention. |
Source: Palo Alto Networks US-dollar list prices as filed on UK G-Cloud 15 by Softcat (pricing document, 16 January 2026) and CDW (8 January 2026), SKUs PAN-XDR-PRVT, PAN-XDR-ADV-EP and PAN-XDR-PRO-GB. Checked 30 October 2026. List prices, not quotes. See /sources.
Four worked totals at list
Endpoint count times the list price, so you can redo it for your own estate. Endpoint licence only: no data ingestion beyond endpoints, extra retention, onboarding or negotiated discount.
| Endpoints | Pro at $70 | Prevent at $40 |
|---|---|---|
| 250 | $17,500 | $10,000 |
| 1,500 | $105,000 | $60,000 |
| 5,000 | $350,000 | $200,000 |
| 25,000 | $1,750,000 | $1,000,000 |
Five ways to keep the Cortex bill down
- Bring a live competing Falcon bid. CrowdStrike publishes its Falcon Enterprise price, so a real competing quote gives the Cortex partner a number to beat rather than a list to defend.
- Size the GB line before you sign. Third-party data is licensed per daily ingested GB. Measure the daily volume of the sources you plan to send and get the overage terms in writing.
- Ask about Prevent where Pro is wasted. Endpoints that never feed detection and response (kiosks, single-purpose devices) may not need Pro. Ask the partner whether a mixed Prevent and Pro estate is allowed on your agreement.
- Commit multi-year only against a roadmap. A longer term usually buys a lower rate but locks the count; commit only if your endpoint count is stable or growing.
- Bundle with existing Palo Alto spend. If you already run Palo Alto firewalls or Prisma, price Cortex inside that agreement and compare it with the standalone list above.
Right pick when
- You already run Palo Alto NGFWs or Prisma Cloud and want native telemetry correlation.
- You are retiring several point tools onto one analytics platform.
- You need strong cloud and identity detection breadth, not endpoint-only coverage.
- You have a SOC mature enough to use behavioural analytics and root-cause analysis.
Wrong pick when
- Your environment is endpoint-only with minimal cloud or identity telemetry.
- You want managed detection and response in the licence; Cortex managed services are separate.
- You are deeply Microsoft-stack and Defender XDR is already mostly paid for via E5.
- Your third-party log volume is high and unmeasured, which makes the per-GB line hard to budget.
// Q&A appendix
Frequently asked questions
01.How much does Cortex XDR cost per endpoint in 2026?+
Palo Alto does not show prices on its own site, but its US-dollar list prices are public in UK G-Cloud 15 reseller filings (Softcat and CDW, January 2026). Cortex XDR Prevent lists at $40 per endpoint per year and Cortex XDR Pro at $70 per endpoint per year, including 30 days of data retention. Pro is also sold by data volume at $400 per daily ingested GB per year. These are list prices, not quotes; a partner prices your deal from them.
02.What is the difference between Cortex XDR Prevent and Cortex XDR Pro?+
Cortex XDR Prevent is the endpoint-protection tier: next-generation antivirus, host firewall, device control, and exploit and behavioural prevention on the endpoint, with 180 days of alert retention on the price list. Cortex XDR Pro adds endpoint detection and response with collected endpoint data (30 days of data retention per endpoint on the list) and the cross-source analytics that define XDR. Pro is the tier most buyers mean when they say Cortex XDR.
03.Is Cortex XDR more expensive than CrowdStrike Falcon?+
Not at list. Cortex XDR Pro is $70 per endpoint per year on Palo Alto's US-dollar price list as filed on G-Cloud 15; CrowdStrike publishes Falcon Enterprise, which includes Falcon Insight XDR, at $184.99 per device per year on its own pricing page. The two lists are different surfaces (a reseller price-list filing versus a vendor web store), and Cortex sells data ingestion and extra retention as separate SKUs, so compare full quotes for your estate rather than the two headline numbers.
04.Does Cortex XDR charge separately for data ingestion?+
Yes. The per-endpoint Pro licence covers endpoint data with 30 days of retention. Third-party and network data is licensed by volume: Cortex XDR Pro per daily ingested GB lists at $400 per year, and additional retention is sold as separate SKUs. Size your daily third-party log volume before the quote so the GB line is not a surprise.
05.What does Cortex XDR cost for 1,000 endpoints?+
At the $70 Pro list price, 1,000 endpoints is $70,000 per year for the endpoint licence. Each daily GB of third-party data you add lists at $400 per year. Onboarding services and any managed threat hunting are quoted separately by the partner.
06.Is Cortex XDR worth it over standalone EDR?+
Cortex XDR is worth the step up when cross-source detection across network, cloud and identity materially cuts your time to detect, when it retires point tools you would otherwise renew, or when you already run Palo Alto firewalls and want native telemetry correlation. For an endpoint-only environment with no consolidation goal, Prevent or a single EDR product is usually the better economic call.