XDR (Extended Detection and Response) is a unified security platform that collects and correlates telemetry across endpoints, email, identity, cloud workloads, and network — and uses analytics and automation to detect and respond to threats in one console. Where EDR sees only endpoints, XDR connects the dots: e.g., 'a phishing email arrived → the user clicked → a process spawned PowerShell → it called a known C2 domain → it tried to enumerate Active Directory'. By correlating signals from multiple layers, XDR catches attacks that single-layer tools miss and reduces analyst fatigue from chasing alerts in 5 different products.

EDR (Endpoint Detection and Response) monitors *only endpoints* — laptops, servers, workstations — recording process trees, file activity, network connections, registry changes. XDR (Extended Detection and Response) extends EDR with telemetry from email, identity (Active Directory, Entra ID, Okta), cloud workloads (AWS, Azure, GCP), SaaS apps, and network traffic, then correlates events across all of them. Practical example: EDR sees a suspicious process on a laptop. XDR sees the same process *plus* the phishing email that delivered it, *plus* the user identity it abused, *plus* the cloud resources it tried to access — and produces one incident instead of four disconnected alerts.

Different goals: SIEM (Security Information and Event Management — Splunk, Sentinel, Elastic, QRadar) is a flexible log aggregation and search platform; you bring any log source, write your own correlation rules, and run compliance reports. XDR is a focused detection-and-response platform pre-tuned by the vendor to specific telemetry sources, with built-in detections, automated response and a curated UI. SIEM is broader and more customisable but more expensive to operate. XDR is faster to deploy and run but less flexible. Many enterprises run both — XDR for fast detection on endpoints/identity/cloud, SIEM for compliance, custom apps and long-term log retention.

Native XDR — single vendor controls the whole stack: their EDR agent, their email gateway, their identity layer, their cloud workload protection. Best correlation, simpler deployment, but vendor lock-in. Examples: Microsoft Defender XDR, CrowdStrike Falcon Insight XDR, Palo Alto Cortex XDR, SentinelOne Singularity. Open XDR — vendor-agnostic platform that ingests data from third-party tools (any EDR, any email gateway, any cloud, any firewall) and runs correlation on top. Better for heterogeneous environments. Examples: Stellar Cyber, Hunters, Anomali ThreatStream. Trade-off: native is more turnkey but locks you in; open is flexible but requires more integration work.

Five leaders by market position: (1) CrowdStrike Falcon Insight XDR — strong endpoint heritage, fast cloud-native architecture, premium pricing, (2) Microsoft Defender XDR — best fit for Microsoft estates (M365, Entra ID, Azure), included with E5 licensing, (3) Palo Alto Cortex XDR — strong network correlation, integrated with Palo Alto firewalls, (4) SentinelOne Singularity XDR — autonomous AI-driven response, strong on Linux, (5) Trellix XDR — formed from McAfee + FireEye, broad ecosystem. Honourable mentions: Sophos XDR (mid-market), Cisco SecureX, IBM QRadar XDR. Selection depends on existing security stack, identity infrastructure, and skill base.

XDR is the primary detection-and-response platform inside a modern SOC, replacing or complementing legacy SIEM-only architectures. A typical XDR-driven SOC operates on three tiers: (1) Tier 1 (triage) — analysts handle XDR alerts using built-in playbooks and recommended responses, (2) Tier 2 (investigation) — escalation, threat hunting, deeper forensics across XDR's correlated timeline, (3) Tier 3 (incident response) — containment, eradication, recovery, post-incident analysis. Average XDR-driven SOCs achieve mean time to detect (MTTD) under 30 minutes and mean time to respond (MTTR) under 4 hours — significantly faster than SIEM-only architectures.

XDR is typically priced per endpoint or per user per month. Common ranges (2026): CrowdStrike Falcon Insight XDR — $8–18/endpoint/month depending on modules, Microsoft Defender XDR — included with M365 E5 ($57/user/month) or as standalone ($12/user/month), Palo Alto Cortex XDR Pro — $10–20/endpoint/month, SentinelOne Singularity Complete — $7–15/endpoint/month. Total cost of ownership also includes onboarding ($25K–$150K), tuning, and (for most organisations) a managed XDR/MDR service ($30–80/endpoint/year) to handle 24/7 triage.