Topic starter
11/07/2026 8:33 pm
TL;DR: XDR adoption is constrained less by detection ambition than by the cost, fragmentation, and retention limits of telemetry at scale, according to SentinelOne, citing IDC's forecast of 175ZB of global data by 2025 and the operational burden of cross-platform analytics. The governance challenge is now as much about data architecture, retention, and context as it is about threat detection.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “The Rise of Big Data | Solving Today’s Challenges with SentinelOne XDR”.
By the numbers:
- IDC predicts that by 2025 the total volume of data stored globally will reach 175ZB.
- IDC predicts that by 2025 as much as 30% of global data will be classified as real-time, sensorized telemetry from endpoint and IoT devices.
- The article says most vendors tend to cap retention at between 7 and 30 days.
Key questions
Q: How should SecOps teams manage telemetry when XDR data volumes keep growing?
A: Treat telemetry as a governed security asset, not a by-product of tooling.
Q: Why do short retention windows weaken XDR programmes?
A: Short retention limits the period in which analysts can reconstruct attacker activity, especially when incidents are discovered late.
Q: What breaks when telemetry sources stay siloed across security tools?
A: Siloed telemetry breaks correlation.
Practitioner guidance
- Define telemetry collection tiers by investigative value Classify logs, events, and sensor streams by their contribution to triage, hunting, and incident scoping, then stop paying equal cost for unequal value.
- Unify endpoint, cloud, and network context Require correlation across repositories so analysts can move from isolated events to a single attack timeline without manual stitching.
- Set retention to exceed expected detection delay Review whether current log and event retention supports historical hunting for the period when real incidents are typically discovered, not just when they start.
Bottom line: XDR stalls when data collection, normalisation, and retention costs outrun the operational value of the telemetry being gathered.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:02 pm
Telemetry governance has become a security control, not a back-end optimisation issue. XDR only works when organisations can decide what to collect, how to normalise it, and how long to retain it without destroying investigative value. That makes telemetry policy part of security architecture, not an infrastructure afterthought. For practitioners, the real question is whether the data layer supports detection, response, and historical reconstruction at the same time.
A question worth separating out:
Q: How can organisations tell whether XDR visibility is actually working?
A: Look for whether analysts can find, enrich, and pivot across recent and historical telemetry without manual export steps or missing coverage. If unmanaged devices, reduced logging, or short retention prevent routine investigation and hunting, visibility is not working. Effective XDR produces searchable context that supports both alerting and retrospective analysis.
👉 Read our full editorial: XDR data management at scale is the real adoption bottleneck