Check Point Extended Detection and Response

Name: Check Point Extended Detection and Response
Brand: Check Point Software Technologies
Rating: 4.6 (232 reviews)

Leader

Customers rely on Lakera for real-time security that doesn’t slow down their GenAI applications.

Est 1993|Valuation $14.1B|Raised $1.8B

LinkedIn 11K|Website|Web traffic 2.0M|FTEs 6,825|HQ San Francisco, CA

MarketsSecurity Information and Event Management (SIEM)Endpoint Security (EPP/EDR)Security Orchestration, Automation, and Response (SOAR)

Published Oct 15, 2026

01Common complaints

Consider alternatives when: - The organization requires XDR anchored in a dominant endpoint platform already owned; if an organization is fully standardized on Microsoft Defender, CrowdStrike, or Cortex, the incremental value of an external correlation layer may be limited. - Validated third-party integration breadth is required on day one; historical analyst notes indicated integration gaps at one point, so buyers should confirm current connector coverage and roadmap. - The security team is sensitive to operational complexity; community discussions highlight portal proliferation and upgrade planning concerns. - Budget is constrained and the organization does not already have Check Point sensors deployed; the cost of adding sensors or licensing connectors/logging can affect ROI.

Deal disqualifiers (poor fit)

Organizations requiring fully transparent, self-serve pricing models
Organizations committed to an all-Microsoft or all-Palo Alto SecOps stack and seeking single-vendor simplicity over cross-vendor federation
Organizations lacking staff for integration, tuning, and playbook maintenance (unless MDR is procured)

Vendor-acknowledged / implied limitations

Branding and platform consolidation has occurred: documentation indicates Horizon XDR/XPR was rebranded to Infinity XDR/XPR, which can create confusion in procurement, training, and documentation alignment.

Limitations implied by external commentary

Integration coverage may not be uniform across all Check Point product families at all times; buyers should validate current integration matrices.

Community-reported operational pain points (not necessarily XDR-only)

Multiple portals and navigation complexity have been reported by community users.
Reports of bugs and uncertainty about upgrade tracks have been noted in community threads.

02Why they buy

Claimed differentiators supported by vendor and community signals

The vendor emphasizes a "prevention-first" XPR framing (presented as distinct from detection-only XDR).
Integrated automation via Playblocks is promoted as part of the broader SecOps workflow.
Integration with Microsoft Defender for Endpoint is documented as a telemetry ingestion option for mixed estates.

Where competitors may have clearer advantages

Endpoint-native XDR vendors (CrowdStrike, SentinelOne, Palo Alto) may provide simpler single-agent operational models.
Microsoft may offer procurement and integration advantages in M365-heavy environments.

03Field reports

Review-platform coverage limitations

Many review sites aggregate "Check Point" reviews across multiple products (e.g., firewalls, endpoint, cloud) rather than a dedicated Infinity XDR/XPR page. This makes it difficult to extract product-specific feedback.

G2 (mixed relevance)

G2 hosts Check Point reviews that are often product-ambiguous (firewall vs other products). Cited pros commonly include reliability and stability; cited cons often include complexity, UI/management learning curve, and cost. Because the listing may not be scoped to XDR/XPR specifically, treat such feedback as brand-level unless filtered to the specific product.

Community discussions (Reddit) — themes

Community feedback is anecdotal but provides candid viewpoints. Reported positive themes: - Community posts have claimed high detection performance on certain scenarios (e.g., zero-days and phishing) and praised Check Point research investment, while also noting weaknesses in other product areas (e.g., SD-WAN). - Some users recommend adopting the broader Check Point ecosystem including XDR/Playblocks, indicating familiarity with Check Point’s approach. Reported negative/critical themes: - Complaints about software bugs and release/upgrade uncertainty (relevant because XDR depends on stable sensors and integrations). - Some community threads indicate that Check Point may be deprioritized for newer categories (SASE/SSE, CNAPP, XDR) during vendor selection, suggesting challenges in market mindshare compared with newer platform-native XDR solutions.

Why customers choose Check Point (inferred from reviews/discussions)

Existing footprint: organizations already running Check Point gateways/endpoints may prefer consolidation.
Reported prevention capability and Check Point’s long history in network security.
Interest in unified event correlation across Check Point and selected third-party tools (for example, Microsoft Defender integration messaging).

Why some customers leave / don’t shortlist (inferred)

Preference for platform-native or "single-vendor" approaches (best-of-breed preferences where buyers standardize on other vendors).
Concerns about product maturity in newer categories (as suggested by some community commentary).
Pricing and licensing complexity.

Availability gap

Reviewed materials included solution briefs, admin guides, and vendor marketing claims, but few independently verifiable case studies with quantified outcomes for Infinity XDR/XPR were located.

Vendor/marketing metrics that need validation

- Check Point’s product page states a vendor claim of complete detection in the 2024 MITRE ATT&CK Evaluations for Infinity XDR/XPR. This vendor claim requires verification against MITRE Engenuity’s published results and methodology. Specifically, buyers should evaluate: - Detection granularity (technique vs tactic) - Telemetry richness - False positive rates and operational workload - Required Check Point sensor footprint and configuration to reproduce the claimed results

04Best fit

Best-fit org profile

Size: mid-market to enterprise organizations with a formal IT/security function.
Security maturity: organizations with an internal SOC or a managed service, seeking to unify signals across multiple domains.
Environment: hybrid environments (on-prem + cloud) with multiple security tools.

Decision makers and users

Decision makers: CISO, VP Security, Head of SecOps, IT Director
End users: SOC analysts, incident responders, detection engineers

Pain points it addresses

Tool silos and fragmented incident timelines
Slow investigations due to lack of correlation
Need for automated response and playbooks

Deal qualifiers (good fit)

Existing investment in Check Point Quantum, Harmony, or CloudGuard
Willingness to adopt Check Point portals and workflows
Need to correlate Check Point signals and selected third-party sources

05The pitch

What the product does (core value proposition)

Check Point’s Extended Detection and Response offering is currently branded as Infinity XDR/XPR (formerly Horizon XDR/XPR). It is a cloud-delivered SecOps platform that correlates telemetry across multiple security control planes (Check Point and third-party) to detect, investigate, and respond to threats across endpoints, network, email, cloud, and mobile. Check Point describes the product using the term "prevention-first" and often refers to it as XPR (extended prevention & response) rather than only XDR. Official product page: Official vendor product overview and feature pages Key elements highlighted in official materials: - Cross-product correlation of events and incidents across Check Point and third-party sources (connectors/integrations). - ThreatCloud AI / threat intelligence as the correlation engine, fed by Check Point Research and customer telemetry. - Automation and orchestration via Playblocks (Check Point’s SOAR-like playbooks), frequently presented as included or closely coupled.

Target market and positioning

- Mid-market to enterprise organizations with a SOC (or those procuring MDR) that require unified investigations and response across heterogeneous tools. - Positioned to appeal to organizations with existing Check Point estates (Quantum gateways, Harmony Endpoint/Email, CloudGuard), where native integrations may be deeper and easier to operationalize. - Marketed to buyers who wish to retain some incumbent tools (e.g., Microsoft Defender for Endpoint) while adding correlation and coordinated response.

Get a comprehensive analysis of Check Point Extended Detection and Response including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →