Fazlur Rahman
Quick Answer
Palo Alto Cortex XDR pricing in 2026 is quote-based only, but reseller benchmarks put Cortex XDR Pro per Endpoint at $81 to $120 per endpoint per year and Prevent at $48 to $72 per endpoint per year. Cortex Data Lake storage is an additional $11,000 per terabyte per year. Professional services and add-on modules routinely push total first-year cost 40 to 60 percent above the base license (CostBench, August 2026).
The tier comparison matters less than whether Palo Alto is the only vendor on the perimeter. Bundle discounts for organizations already running Palo Alto next-generation firewalls or Prisma Cloud change the procurement math by 20 to 30 percent.
Last verified: Sep 15, 2026.
At a glance
- Cortex XDR Prevent about $48 to $72 per endpoint per year (EPP only)
- Cortex XDR Pro per Endpoint about $81 to $120 per endpoint per year (EDR + XDR)
- Cortex Data Lake storage $11,000 per terabyte per year
- Median verified Cortex XDR deal around $41,000 per year
- Palo Alto bundle discount 20 to 30 percent for NGFW or Prisma Cloud customers
- Unit 42 MDR adds roughly $25 to $50 per endpoint per year on top
Cortex XDR tiers and what each tier enables
Cortex XDR is sold in three primary tiers with separate add-ons for storage and managed hunting. Prevent is the endpoint protection platform layer with next-generation antivirus, host firewall, disk encryption, and device control. Pro per Endpoint adds behavioral analytics plus the full EDR engine, investigation workflows, and threat hunting. Managed Threat Hunting is the top tier sold with Palo Alto's Unit 42 MDR team (Palo Alto Networks docs, September 2026).
| Tier | Coverage | Per endpoint per year (reseller benchmark) | Best fit |
|---|---|---|---|
| Cortex XDR Prevent | NGAV, EPP, host firewall, disk encryption, device control | ~$48 to $72 | AV replacement, EPP-only deployments |
| Cortex XDR Pro per Endpoint | Prevent plus behavioral analytics, EDR, investigation, threat hunting | ~$81 to $120 | SOC teams requiring full EDR and XDR |
| Cortex XDR Pro per TB | Pro plus third-party telemetry ingestion into Cortex Data Lake | ~$11,000 per TB per year add-on | Multi-source telemetry, hybrid environments |
| Managed Threat Hunting | Pro plus Unit 42 MDR overlay | Quote with $25 to $50 endpoint overhead | Teams without 24/7 in-house threat hunting |
The jump from Prevent to Pro per Endpoint is the same boundary every endpoint platform draws. Pro is the minimum tier for organizations whose auditors require endpoint detection and response, not just prevention. Pro also activates the Cortex Data Lake, which is what powers cross-source correlation across endpoints, network, cloud, and identity (Palo Alto Networks, September 2026).
Worked examples for 500 and 5,000 endpoint deployments
Cortex XDR pricing varies sharply by endpoint count and tier. The table below uses the reseller benchmark data to estimate annual spend at two common scales, before volume discounts and professional services (CostBench, August 2026).
| Deployment profile | Endpoints | Tier | Annual list estimate | Real-world range |
|---|---|---|---|---|
| Mid-market | 500 | Pro per Endpoint | $40,500 to $60,000 | $60,000 to $80,000 (with Data Lake) |
| Mid-market | 500 | Pro + Unit 42 MDR | $53,000 to $85,000 | $80,000 to $120,000 (services) |
| Enterprise | 5,000 | Pro per Endpoint | $405,000 to $600,000 | $500,000 to $900,000 (with add-ons) |
| Enterprise (full bundle) | 5,000 | Pro + Data Lake + Unit 42 | $650,000 to $1,000,000 | $900,000 to $1,500,000 |
The median annual deal across 97 verified Cortex XDR purchases on Vendr is approximately $41,000 per year, which fits a 500-endpoint Pro deployment at the floor price with minimal add-ons. Large deployments with Data Lake, Unit 42 MDR, and integration to Prisma Cloud or NGFW regularly exceed $1 million per year (cipherssecurity.com, September 2026).
Bundle economics and the greenfield penalty
Buyers already running Palo Alto next-generation firewalls or Prisma Cloud get the best Cortex XDR pricing. Palo Alto offers 20 to 30 percent bundle discounts when Cortex XDR is attached to an existing next-generation firewall or Prisma Cloud contract, which materially changes the per-endpoint math for greenfield evaluators. The price gap runs $25 to $40 per endpoint per year between full list and a bundle renewal (CostBench, August 2026).
Greenfield deployments pay the largest premium because they pay full list on Cortex, pay full list on the next-generation firewall, pay full list on Prisma Cloud, and add professional services on each layer. For organizations that have not committed to the Palo Alto perimeter stack, the Cortex XDR cost-effectiveness case is weaker than for established Palo Alto houses. CrowdStrike Falcon Enterprise and SentinelOne Singularity Complete both publish list prices closer to $185 per endpoint per year before discount, putting Cortex XDR's $81 to $120 per endpoint per year Pro range in line with peers once the bundle discount is applied (cipherssecurity.com, September 2026).
Hidden costs to budget beyond the license
The Cortex XDR total cost of ownership has three predictable over-list lines. Cortex Data Lake storage at $11,000 per terabyte per year for organizations that exceed the 30-day retention included with Pro. Elite Support runs a 25 percent surcharge on top of the license for the highest-tier SLAs. Professional services for first-year deployment sit between $10,000 and $50,000 for mid-market and easily exceed $100,000 for enterprise (CostBench, August 2026).
Buyer teams that do not itemize these three line items find their first-year Cortex XDR cost lands 40 to 60 percent above the base license. The cleanest procurement hygiene is asking the Palo Alto account team for a written breakdown with license, Data Lake, Elite Support, services, and any cross-product bundle discount shown as separate lines. Without that breakdown, budgeting for Cortex XDR reliably fails (CostBench, August 2026).
