SIEM or XDR? Yes
Sophos, Thursday, November 5th, 2026
Sophos argues XDR is effectively a SIEM rebuilt for security outcomes and outlines how to decide whether to replace, consolidate or keep both.
Sophos VP Ratnesh Saxena traces how attackers evading endpoint protection led to EDR and then XDR, which combines endpoint data with network, identity, cloud and email sources.
He says a SIEM and XDR largely overlap in ingestion, analytics, alerting, investigation and response, so many organizations pay twice, with the endpoint agent being the one legitimate reason they coexist.
XDR ingests only vendor-curated data relevant to the threat lifecycle via built-in integrations, while SIEMs often collect irrelevant data just in case and may charge for ingesting it.
The real decision is about capabilities and economics: replace the SIEM, adopt a SIEM-less SIEM or XDR, or keep both with the SIEM limited to non-security uses.