Palo Alto does not publish Cortex XDR pricing on its own site, but its list prices appear as named, part-numbered SKUs in reseller price schedules filed on the UK G-Cloud framework. In the Bytes Software Services schedule (filed April 2024), Cortex XDR Pro lists at $70.00 per endpoint per year (part PAN-XDR-ADV-EP), including 30 days of data retention. The volume alternative is $11,000.00 per TB including 1 TB of Cortex Data Lake (PAN-XDR-ADV-1TB). The add-on most buyers miss is retention: a further 30 days of hot storage lists at $7.50 per endpoint per month, or $2.00 for cold storage. Those same filings price the endpoint SKU identically at their 1,000, 5,000 and 10,000-user bands, so there is no published volume discount on Cortex XDR. Any reduction is negotiated, not listed.
Palo Alto Cortex XDR pricing tiers
| Tier | Price | Real EDR? | Notes |
|---|---|---|---|
| Cortex XDR Pro, per endpointPAN-XDR-ADV-EP | $70.00 / endpoint / yr$5.83/mo equivalent | Yes | Includes 30 days of data retention and standard success. The monthly figure is the annual list divided by 12, not a published monthly rate. |
| Cortex XDR Pro, per TBPAN-XDR-ADV-1TB | $11,000.00 / TB / yr | Yes | The volume licensing axis: priced on ingested data rather than endpoint count, and includes 1 TB of Cortex Data Lake. |
| Cortex XDR Pro, per TB, no Data LakePAN-XDR-ADV-NOCDL-1TB | $9,000.00 / TB / yr | Yes | The same Pro entitlement without Cortex Data Lake, a published $2,000 per TB less. |
| Extra retention, hot storagePAN-XDR-ADV-EP-HOT-RTN | $7.50 / endpoint / mo | No | Adds 30 days of hot storage beyond the 30 included in the base licence. Add-on, not a standalone licence. |
| Extra retention, cold storagePAN-XDR-ADV-EP-COLD-RTN | $2.00 / endpoint / mo | No | Adds 30 days of cold storage beyond the base 30. Cheaper than hot, slower to query. |
| Cloud host protectionPAN-XDR-ADV-EP-CLOUD | $195.00 / host / yr | No | Covers a single cloud host, includes 30 days of retention. A separate unit from the endpoint SKU: cloud hosts do not draw on your endpoint count. |
| Cortex Data Lake retention, 1 TBPAN-XDR-1TB-RTN | $1,200.00 / TB / yr | No | Storage for retention, bought by the terabyte. |
The entry tier that delivers genuine EDR (continuous telemetry, behavioural detection, threat hunting, and response actions) is Cortex XDR Pro at $70.00 per endpoint per year (PAN-XDR-ADV-EP). The cheaper rows in this table are add-ons (retention, cloud hosts, storage), not lesser tiers: none of them is an EDR licence on its own. The filed schedules list only Cortex XDR Pro line items, with no prevention-only Cortex part number. If a reseller quotes you a cheaper Cortex tier, ask for the part number and check it against the schedule.
What it costs at your size
Worked annual figures at the entry EDR tier, before negotiation. Use these to size the budget line, then run your own numbers in the budget calculator, which layers deployment, tuning, and internal operating cost on top of the licence.
| Organisation | Endpoints | Tier | Annual licence | Per endpoint / mo |
|---|---|---|---|---|
| Small business | 200 | Cortex XDR Pro, per endpoint | $14,000 | $5.83 |
| Mid-market | 1,000 | Cortex XDR Pro, per endpoint | $70,000 | $5.83 |
| Upper mid-market | 5,000 | Cortex XDR Pro, per endpoint | $350,000 | $5.83 |
| Enterprise | 25,000 | Cortex XDR Pro, per endpoint | $1,750,000 | $5.83 |
| Mid-market, 60-day retention | 1,000 | Pro plus hot-storage add-on | $160,000 | $13.33 |
Licence only. Deployment, tuning, IR retainer, and internal operating cost sit on top: see the five TCO categories. At SMB scale the licence is roughly half of true all-in cost.
Four ways to bring the Palo Alto Cortex XDR number down
Price the retention tail, not just the seat
The base licence includes 30 days of data retention. A further 30 days of hot storage lists at $7.50 per endpoint per month, which is $90 per endpoint per year, on top of a $70 licence. Doubling retention to 60 days therefore costs more than the EDR licence itself: 1,000 endpoints goes from $70,000 to $160,000. If you can live with cold storage, the same extra 30 days lists at $2.00 per endpoint per month instead. Decide your retention requirement before you take the quote, because this is where the bill actually moves.
Ask which licensing axis your quote uses
The filed schedule prices Cortex XDR Pro two different ways: $70.00 per endpoint per year, or $11,000.00 per TB of ingested data. They meter different things, so which one is cheaper depends entirely on how much telemetry your estate generates per endpoint. Get quotes on both axes and compare them against your own ingest estimate rather than assuming the per-endpoint number is the relevant one.
There is no published volume discount, so ask for one
The filings price the endpoint SKU at exactly the same unit rate whether the band is 1,000, 5,000 or 10,000 users. Whatever discount you get on Cortex is negotiated rather than listed, which means it is entirely a function of how you run the deal. Do not assume a bigger estate automatically earns a better unit rate, and do not let a reseller present list as though the size of your order already earned a reduction.
Check whether you need Cortex Data Lake
Cortex XDR Pro per TB lists at $11,000.00 including 1 TB of Cortex Data Lake, and at $9,000.00 without it. That is a published $2,000 per TB difference for a component some buyers already cover with their own storage and retention arrangements. Ask which of the two part numbers your quote is built on.
When Palo Alto Cortex XDR is the right pick, and when it is not
- + You already run Palo Alto firewalls or Prisma and want a consolidated Palo Alto security platform.
- + You need deep cross-layer correlation (endpoint, network, cloud, identity) in one analytics engine.
- + You have the SOC maturity to operationalise a heavy, data-rich XDR platform.
- + Thirty days of retention covers your requirement, or you have budgeted the per-endpoint retention add-on.
- − You need long retention on a tight budget: at $7.50 per endpoint per month for each extra 30 days of hot storage, the retention add-on outgrows the licence quickly.
- − You want one predictable per-device number: Falcon Pro ($99.99) has a published per-device price and Defender for Endpoint P2 is sold inside Microsoft 365 E5 or as an add-on with no standalone list price; both can land above or below the Cortex licence depending on your retention, but neither meters storage separately, so the quote is the bill.
- − You want a price you can confirm on the vendor's own website: Palo Alto publishes none, so every figure comes from filed reseller schedules.
- − You are on Microsoft 365 E5: Defender for Endpoint P2 is already included in that licence.