Most organizations I talk to are not short on detection. They have invested in advanced security tools, and those tools are good at one thing: telling you something happened. Then the real work starts. Someone has to decide what it means, who needs to know, and what to do next. That gap between seeing a threat and acting on it is where security programs succeed or fail, and it is the lens I use for XDR, for AI, and for where the SOC goes from here.
XDR isn’t broken. Our rollouts are.
Let me start with the verdict I keep hearing: that XDR has run its course. I disagree. The potential effectiveness of its insights, as well as prevention and response, is still 100% true and valuable.
What I will concede is that it proves challenging to implement. SOC teams are often siloed across network and endpoint security, so each side watches its own console, and the gaps between them become missed opportunities. The skills to close those gaps are well within a mature security practice, for open and closed XDR deployments alike. The hard-won lesson is that EDR and NDR have to be planned and continually refined into a cohesive toolset, not left as effective point solutions. Add SIEM and SOAR integration, and the effort is worth it.
This is also why I push back on the most common misconception in the market. XDR is not simply the evolution of EDR or NDR into a new product or category. Teams that buy it as a rebrand tend to keep the same silos under a new label.
Why hasn’t more detection meant less noise
If the tools are this capable, why are analysts still buried in alerts? Some of it is simply the world we work in. Threat actors have more tools than ever, and those tools keep evolving. But a lot of it sits on the customer side, in the struggle to coordinate results from multiple security products and the people who run them.
Another dashboard won’t fix that. It isn’t simply a better SIEM/SOAR tool or unifying threat intelligence but a methodology and discipline to refocus continuously on the context of incidents rather than the ever-increasing raw alert volume. An alert tells you something fired. Context tells you whether it matters.
The New Reality of AI-Driven Breaches
The Visibility Gap That Puts CISOs at Risk
Strategic Recommendations for CISOs
Where the context comes from
So how does a team build that context? Three or four years ago, collecting data was most of the pitch. Today the expectation is that the data teaches you something. A customer can introduce metadata collection across endpoints and the network, run behavioral analytics on it, and carry what it learns into better automation and playbooks. That lifts the posture and efficacy of both the IR team and the SOC. This is what XDR is actually for, and it is the foundation everything else, AI included, depends on.
AI makes the gap wider or smaller, depending on how you use it
This is where AI enters, and it cuts both ways. Attackers use it to scale phishing campaigns and malware code. Some have gone further and use AI to trick defensive AI into missing real threat activity. Awareness of that double-edged quality is critical if you want to use AI to improve your own posture.
On our side of the fence, AI is not a set-and-forget asset. Deployed that way, it produces a host of unwanted side effects, from missed incident context to incorrectly locking out users. That is the same failure as alert fatigue in a new form: automation without context.
So what is noise? My concern is that the hype will drown out defense in depth and the steady refinement of best practices and process, of which AI is one of the newest components. It is not a silver bullet, and it is not plug-and-play. Careful application of its strengths nets the greatest efficacy.
Telling real AI from a bolt-on
If AI is only as good as its fit, buyers need a way to test that fit. With so many XDR vendors making similar claims, start with the white papers and data sheets. Is the AI a general-purpose LLM, or is it geared to NDR and EDR use cases? Does the vendor describe context windows and specific performance models matched the source data, meaning log output as well as metadata analytics? Sometimes a smaller, low-latency model is the better choice, because incident response and playbook automation depend on speed.
Be realistic about the market too. Most existing products did not have AI built-in natively, and most carry some degree of bolt-on. What matters is how it is applied. Does the vendor use AI as a natural language chatbot that summarizes alerts, or as embedded agentic AI that can autonomously query logs, triage incidents, and help create or revise rules? The first gives analysts a nicer summary. The second changes how the SOC works.
The decisions that stay human
Capable automation raises the next question, which is what we hand over. AI can accelerate initial triage, log correlation, and the filtering of false positives. That frees analysts to review the generated summaries and reports, confirm the prioritization of what the automation surfaces, and own validation, governance, incident management, and communications. They also weigh business impact and consequences, which AI is not currently able to do as well.
The pitfalls are hallucinations, missing context, and a lack of common sense. Correlation is a strong suit of AI, but it is not a reliable source of cause and effect, and it should not be what triggers an automated mitigation. There is an adversarial reason, too. An attack can be designed to provoke an expected response, and without human supervision the attacker ends up steering your defenses. Detection can be automated. Judgment shouldn’t be, at least not yet.
Where XDR goes next
Looking three to five years out, I expect XDR to become identity-centric, because device telemetry alone will not keep pace. Non-human identities in cloud and hybrid environments are growing fast, and the workforce now includes SaaS applications, service accounts, and networks. Correlating across those identities will take XDR beyond the enterprise perimeter. Agentic AI and autonomous operations will arrive with it, so the SOC can scale.
The SOC of 2030
Put it all together and the ideal SOC in 2030 looks something like this.
Tier 1 roles are carried out by agentic AI workforces, supported by matured detection engineering and AI threat modeling. But don’t lose sight of the value and need for human oversight. Its definition and scope will evolve in step with AI, and it will matter more as the machines do more.
My advice to CISOs planning the next few years is short. Data is still king for IT, so keep an eye on governance and post-quantum cryptography. Detection will keep getting easier to buy. Judgment, context, and discipline will not.
The post Detection is Only the Beginning: Future of XDR in the Era of AI appeared first on Fidelis Security.
No Responses