Cortex XSOAR added agentic AI. Playbooks still do the work.
Simbian doesn't need them.
Cortex AgentiX, the next generation of Cortex XSOAR, adds AI agents, but they act only through the actions assigned to them, and agents that start on an alert are still in preview. Simbian's AI SOC Agent reasons through each alert with no playbook to build, on any vendor's stack, and runs an AI Pentest Agent on the same memory.
Talk to an AI SecOps ExpertIn production across 300+ enterprise environments
What does Cortex XSOAR do with an alert no playbook covers?
If a playbook matches, Cortex XSOAR runs it. If none does, AgentiX's Agentic Response can hand the alert to an agent, but it's a preview, set up per automation rule with its own prompt. Simbian works either alert with no playbook. Toggle between them below.
Playbook exists
User-reported phishing: credential harvesting
Source: Email security · An automation rule runs the phishing playbook your team maintains in Cortex
SimbianAutonomous
IngestAlert picked up from email security
·ReasonWorks the alert directly, forming a hypothesis from the evidence, not a matched pattern
·Apply contextPulls what it already knows about this user, asset, and prior cases from the Context Lake™
·EnrichDetonates the URL, checks sender history, pulls who else received it
·Evaluate severityWeighs blast radius and business context, then reaches a verdict: malicious, active credential theft
·ContainPurges org-wide, resets exposed identities, closes the case under the active mode
Palo Alto NetworksAgentiX on XSOAR playbooks
Build the playbookFirst, your team builds and maintains the phishing playbook, with AI help to write it. Palo Alto maintains autonomous playbooks only for its own XSIAM analytics detections
·IngestAlert received in Cortex
·Match + runAn automation rule matches the alert and runs the playbook
·EnrichPlaybook tasks call enrichment across 1,100+ prebuilt integrations
·Contain + approveActions marked sensitive, like revoking access, pause for analyst approval by default
How does Simbian compare with Cortex XSOAR and AgentiX?
Cortex XSOAR gets full marks for a fixed procedure on a known alert, and neither product connects to every tool out of the box. Simbian leads on alerts no playbook covers and on offense and defense sharing one memory, and its AI also runs on-prem and across other vendors' stacks.
R1
Coverage
Palo Alto NetworksSimbian
Resolves a known, matched alert on its own
Works an alert no playbook covers, with nothing to set up first
R2
Reasoning and the automation artifact
Palo Alto NetworksSimbian
Hand-authored, fixed procedure for a known alert type
No playbooks to write, version, or maintain
R3
Platform breadth and self-improvement
Palo Alto NetworksSimbian
AI penetration testing in the same product as the SOC
One shared memory that investigations and pentest findings both feed (Context Lake™)
Self-improving: learns from each case and from attacks it simulates
A pentest finding raises the severity of a related alert
R4
Deployment and control
Palo Alto NetworksSimbian
Reasons across any vendor's stack, not centered on one vendor's products
AI agents run on-prem or air-gapped, not only in the vendor's cloud
Bring your own LLM
Out-of-the-box integration with every tool in your stack
Takes high-impact containment out of the customer's control
Full Limited None
Frequently Asked Questions
Cortex XSOAR is Palo Alto Networks' security orchestration, automation, and response product, built around playbooks, and it's still available on-premises as XSOAR 8. In October 2025 Palo Alto launched Cortex AgentiX as the next generation of Cortex XSOAR, adding AI agents and 1,100+ prebuilt integrations, first inside Cortex XSIAM and Cortex Cloud and then as a standalone platform in February 2026.
Yes. Palo Alto states that its deterministic scripts and playbooks remain the execution layer, with the AI as the brain, and it recommends a playbook for any workflow that follows a clear map. Agents build plans out of actions such as playbooks, scripts, and commands. Simbian's AI SOC Agent reasons through each alert with no playbook to write, version, or maintain.
Partly. Agentic Response lets an automation rule hand an alert to an agent that reasons step by step, but as of October 2026 Palo Alto lists it as a preview, and in XSIAM it's off by default and must be requested. Each rule needs a chosen agent and a prompt written for it, and the agent can use only the actions assigned to it.
Some. Cortex XSIAM ships autonomous playbooks that Palo Alto updates and maintains, on by default for tenants created on or after May 31, 2026. They cover only Cortex Analytics issues in thirteen listed domains, such as Active Directory and Windows EDR. Alerts from the rest of your stack still need playbooks your team builds and keeps current.
Not inside Cortex. Palo Alto sells agentic offensive testing as a Unit 42 service, Continuous Frontier AI Defense, launched in September 2026, and Cortex Xpanse handles attack surface management. We found nothing showing those findings raise the severity of a Cortex alert. Simbian runs an AI Pentest Agent alongside the AI SOC Agent, so a proven exploit path raises the severity of the alert that touches it.
Yes, for alert handling. Simbian's AI SOC Agent investigates and responds to alerts without playbooks, so XSOAR playbooks are no longer required. It reads from and acts on Cortex XDR, which keeps working as your EDR, and it works across other SIEMs, EDRs, and 100+ security tools, on-prem or in the cloud.