Notifications
Clear all
Topic starter
11/07/2026 8:33 pm
TL;DR: XDR adoption is constrained less by detection ambition than by the cost, fragmentation, and retention limits of telemetry at scale, according to SentinelOne, citing IDC's forecast of 175ZB of global data by 2025 and the operational burden of cross-platform analytics. The governance challenge is now as much about data architecture, retention, and context as it is about threat detection.
NHIMG editorial — based on content published by SentinelOne: XDR data management at scale and the challenges of successful XDR adoption
By the numbers:
- IDC predicts that by 2025, the total volume of data stored globally will reach 175ZB.
- Of the predicted 175ZB, roughly 85% is enterprise and/or public cloud data storage.
- IDC predicts that by 2025 as much as 30% of this data will be classified as real-time, sensorized telemetry from endpoint and IoT devices.
Questions worth separating out
Q: How should security teams decide which telemetry sources to retain in XDR programmes?
A: Start with the sources most often needed to prove attacker behaviour, not the sources that are cheapest to collect.
Q: Why do separate telemetry repositories weaken detection and response?
A: Separate repositories break the chain analysts need to connect alerts into a timeline.
Q: What breaks when security data is retained for only 30 days?
A: A short retention window often makes historical hunting impossible when an incident is discovered late.
Practitioner guidance
- Map telemetry by investigative value Inventory endpoint, identity, cloud, network, and application events by how often they are used in real investigations, then prioritise high-value sources for retention and correlation.
- Align retention to dwell time assumptions Set retention windows based on how long a serious attacker might remain undiscovered in your environment, not on a vendor default or storage budget target.
- Unify identity and security timelines Make authentication alerts, privileged access events, and service account activity searchable in the same investigation window as endpoint and cloud telemetry, so analysts can reconstruct access paths without switching stores.
What's in the full article
SentinelOne's full article covers the operational detail this post intentionally leaves for the source:
- Cost and retention trade-offs for high-volume telemetry collection across endpoint, cloud, and network sources
- How the platform's data pipeline stitches events into a single timeline for investigation and hunting
- Examples of long-term retention and historical search use cases that inform SecOps design
- The role of remote agent deployment and visibility tooling in reducing unmanaged device blind spots
👉 Read SentinelOne's analysis of XDR data management at scale →
XDR data management at scale: what it means for SecOps teams?
Explore further
11/07/2026 9:02 pm
XDR data management is a governance problem disguised as a tooling problem: the central issue is not whether the platform can see more, but whether the enterprise can afford to keep enough telemetry in a usable form. When logging, normalisation, and retention are fragmented, security teams lose the continuity needed for investigation and control validation. Practitioners should treat data architecture as part of the detection fabric, not an afterthought.
A question worth separating out:
Q: How do organisations know if their XDR data architecture is working?
A: It is working when analysts can search a cross-source timeline quickly enough to answer three questions: what entered, what escalated, and what was affected. If the team cannot do that across endpoint, identity, cloud, and network data within the retention window, the architecture is not supporting real response.
👉 Read our full editorial: XDR data management at scale is the real adoption bottleneck
