Cato XDR
Cato XDR: A Cato-centered XDR for correlating incidents and coordinating supported response actions. Ranked #12 of 43 in Extended Detection and Response Platforms by our editors (8.2/10); pricing: Pricing on request; best for cato customers investigating cross-surface incidents.
At a glance
- Editor score8.2 / 10
- PricingPricing on request
- Best forCato customers investigating cross-surface incidents
- Free planNo
- Telemetry sourcesCato SASE network and security telemetry; supported third-party EDR/security events, including Microsoft Defender for Endpoint, Microsoft Entra ID, SentinelOne, and CrowdStrike
- Facts checked13 Oct 2026
Where it wins
- Prioritizes related security signals as incident stories with evidence and risk scores
- AI-assisted hunting, incident summaries and MITRE ATT&CK mapping
- Can update policies, block traffic and initiate supported EPP scans
Where it doesn't
- Third-party telemetry is limited to supported sources such as named EDR tools
- Response actions are focused on Cato policies, traffic blocking and supported workflows
- Purchasing requires contacting a Cato representative or reseller
Our verdict on Cato XDR
Cato XDR is the detection and response capability within Cato’s SASE platform, aimed at security teams investigating incidents across Cato network and security telemetry alongside supported third-party events. It brings related signals together as prioritized incident stories and presents evidence and risk scores in an investigation workbench in the Cato Management Application. Teams can use AI-generated explanations and recommendations, hunt across the data lake, and take supported response actions from the same interface. It is most relevant to organizations already invested in Cato; teams seeking broad, vendor-neutral telemetry and response should assess alternatives.
Its ecosystem fit is centered on Cato SASE telemetry, with ingestion of supported third-party EDR and security events. Named integrations include Microsoft Defender for Endpoint, Microsoft Entra ID, SentinelOne and CrowdStrike. This offers a cross-surface view without implying universal connector coverage. Response options include updating security policies, blocking malicious traffic and initiating supported remediation workflows, including EPP scans. The workflow is useful when investigations need to connect network signals with endpoint or identity events, but the defined response scope is narrower than platforms offering broader actions across many external products.
Cato’s published documentation describes XOps as a paid tier and MDR as a paid managed 24/7 SOC tier; MDR is for organizations seeking a managed SOC service. Public list pricing is not provided, and purchase information directs customers to a Cato representative or reseller. Current documentation describes XOps licensing, so buyers should clarify the applicable packaging with Cato. Choose Cato XDR when Cato telemetry is central and prioritized investigation with supported response is the goal. Organizations that need a wider set of named data sources or more extensive external remediation may prefer another XDR platform.
Your product? Our editors can test Cato XDR in depth and publish a review, labelled as paid · from $99/mo →
Cato XDR pricing
Cato XDR fact sheet
| Free plan | No |
|---|---|
| Paid from | Not verified |
| Telemetry sources | Cato SASE network and security telemetry; supported third-party EDR/security events, including Microsoft Defender for Endpoint, Microsoft Entra ID, SentinelOne, and CrowdStrike |
| Managed XDR option | Yes |
| Open XDR support | Yes |
| Threat hunting | Yes |
| Supported operating systems | Not verified |
| Response actions | Update security policies; block malicious traffic; initiate supported remediation workflows, including EPP scans |
| Deployment | Cloud |
| Platforms | Web |
| Compliance & security | ISO 27001, SOC 2, GDPR |
| Support | Phone, Tickets, Docs, Community · 24/7 |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 4 integrations: Microsoft Defender for Endpoint, Microsoft Entra ID, SentinelOne, CrowdStrike |
| Pricing | Pricing on request |
| Website | catonetworks.com |
| Facts checked | 13 Oct 2026 |
Cato XDR integrations
Cato XDR lists 4 integrations on its own site.
- Microsoft Defender for Endpoint
- Microsoft Entra ID
- SentinelOne
- CrowdStrike
Alternatives to Cato XDR
- Palo Alto Networks Cortex XDRBroad XDR coverage with prevention, investigation and response in one platform.9.3
- Sophos XDRBroad telemetry correlation and response for teams working across security tools.9.2
- SentinelOne Singularity XDREndpoint-led XDR pairs cross-surface correlation with PowerQuery hunting and automated response.9.1
See all Cato XDR alternatives →
Used Cato XDR? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Cato XDR for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Cato XDR is listed in our Extended Detection and Response Platforms directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/cato-xdr/"><img src="https://www.itechguides.com/best/badge/cato-xdr.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. How we rank.
Last updated · How we research and update