If your SOAR started life as Demisto, look closely at what you are renewing this cycle. The product has changed names and shapes more than once, and the direction it is heading may not be the one you signed up for.
Three generations in seven years
The short chronology, in Palo Alto’s own dated language. Demisto was acquired and became Cortex XSOAR. On October 28, 2025, Palo Alto named Cortex AgentiX the next-generation successor to XSOAR, delivered within Cortex XSIAM/XDR. And XSOAR professional-services SKUs reached end-of-sale on February 1, 2026. Three generations in roughly seven years: Demisto, XSOAR, and now the AgentiX direction.
Precision matters here, so two things to keep straight. XSOAR is not product-wide end-of-life, and XSIAM is not the successor. AgentiX is. What is true is narrower and still consequential. The professional-services SKUs that help you build and maintain content are no longer sold, and the next generation Palo Alto points to is a different product delivered inside its SIEM/XDR platform.
What a renewal actually buys
That reshapes what a renewal means. Renewing extends the tool you know, and it also buys more time on a generation with a named successor sitting behind it. When you eventually move to that successor, the move is a migration, not an upgrade. Because the AI-driven SOC lives in XSIAM, it can pull your SIEM along with it.
The pricing model, separate from the price
There is also the pricing model to read, separate from any specific price. XSOAR has no public list price, and bundle gravity is real. Discounts are often financed by broader portfolio commitments, which is a different thing from the product standing on its own economics. Marketplace points expire after five years. None of that is a dollar figure. It is the shape of the deal, and the shape is worth understanding before you re-up.
So here is the reframe for a Demisto-era team. You have been migrated before, whether you thought of it that way or not. The next migration is coming regardless. The only real decision left is whose terms it happens on, and whether the destination costs you a SIEM re-platform.
Morpheus is the version where it does not. It is a modern deterministic SOAR and an accountable agentic SOC on one engine, so the move retires a tool from your stack. It is priced at or under what you pay today, with the AI in the platform price. And it migrates only the orchestration and investigation layer. You keep your existing SIEM, EDR, and identity stack, and D3 ports your playbooks and integrations off a legacy SOAR for free in 60 days.
A Fortune 500 enterprise that made exactly this move described the difference in relationship terms, not feature terms: “D3 is not Palo Alto. It is refreshing to work with a company that listens and values product feedback. You quickly incorporate our suggestions to improve the product.” That is their assessment, in their words.
Before you sign, ask what you are buying more of. A growing number of teams facing the same successor path are using this renewal cycle to pick a destination of their own.
Bring your XSOAR renewal. We will walk the comparison and the 60-day migration, line by line. The full consolidation comparison and the answers to the common renewal questions sit on Morpheus for the price of Cortex XSOAR. If your renewal date is already on the calendar, let’s get ahead of it: Book a Demo (30 minutes)
XSOAR professional-services SKUs reached end-of-sale February 1, 2026; Cortex AgentiX was named the next-generation successor to XSOAR on October 28, 2025, delivered within XSIAM/XDR (Palo Alto announcements). XSOAR is not product-wide end-of-life, and XSIAM is not the successor. The customer quote is cleared, verbatim, and anonymized. D3 figures are approved. No Palo Alto price is stated as fact. Cortex, XSOAR, AgentiX, XSIAM, XDR, and Demisto are trademarks of Palo Alto Networks; all trademarks belong to their owners.
