The Future of XDR: “The Gap Between Attacks and Defense Keeps Widening”

Cyberattacks today run around the clock, are increasingly AI-driven and multi-staged – while many IT teams, especially at mid-sized companies, barely grow in headcount. The result: late detection, alert fatigue, and a lack of experience when an incident actually hits.

How exposed mid-sized businesses are to organised cybercrime is shown by the article SMEs in the Crosshairs of Cybercrime: according to Germany's BSI, around 80 per cent of all reported security incidents affect small and medium-sized enterprises.

How can organisations close this gap when skilled security staff simply aren't available on the market? And what role does Extended Detection and Response (XDR) play – pooling signals from endpoints, network, email and logins onto a single platform?

How mid-sized companies can realistically prioritise their security measures is covered by the session How Mid-Sized Companies Realistically Prioritize Security at it-sa EXPO & Congress 2026.

These are some of the topics discussed by Nikolas Schran, Vice President Sales & Marketing at German cybersecurity vendor G DATA, in an approximately 19-minute video interview for it-sa 365. The conversation covers why small and mid-sized businesses in particular benefit from XDR, where automation reaches its limits, what role digital sovereignty plays in choosing a security solution, and how XDR supports companies with NIS2 and DORA compliance.

A discussion about why security today is less a question of how many tools you run than of getting prioritisation right.

Chapter Overview

• 0:00  Intro: Skills shortage meets increasingly professional attacks
• 0:46  The widening gap between attack sophistication and defence capacity
• 2:12  What is XDR – and why is it gaining importance right now?
• 3:54  Concrete value in everyday business: visibility and prioritisation
• 5:36  Is XDR only relevant for large enterprises – or also for SMEs/mid-market?
• 7:58  Complement or replacement for existing security solutions?
• 9:33  Automation vs. human judgement: where does the human stay in the loop?
• 11:38  Data sovereignty, compliance, and digital sovereignty in tool selection
• 14:03  NIS2 and DORA: how XDR supports regulatory compliance
• 16:13  Outlook: XDR over the next 3–5 years
• 18:43  Conclusion and sign-off

 

More on the Video: Key Takeaways

• The gap between attackers and defenders keeps widening: cyberattacks today run around the clock and are increasingly AI-driven, while many IT teams barely grow in headcount. Since the missing skilled staff simply can't be found on the market, Schran argues the answer has to lie elsewhere – in pooling and automating detection and response.
• XDR brings together signals from endpoints, network, email, and logins on a single platform – turning seemingly harmless individual events, such as a suspicious login followed by unusual file movement, into one recognisable, connected attack.
• According to Schran, around 99 per cent of all alerts can already be filtered out automatically. The decision in the remaining grey zone, though, still comes down to people: do you isolate a production system, who informs leadership? This is exactly where experienced analysts are still needed.
• According to Schran, XDR benefits the Mittelstand in particular – “the backbone of the German economy” – not just large enterprises with their own security operations centre. Managed XDR is meant to give even a two-person IT team the kind of security posture otherwise reserved for DAX-listed companies.
• “Security isn't built in Brussels,” says Schran – yet he considers digital sovereignty crucial all the same: what matters is where data is processed and which jurisdiction applies, with the US Cloud Act as a case in point. For European companies, sovereignty ultimately means one thing above all: keeping the freedom to act.

Further Reading:

What the arms race between attackers and defenders using artificial intelligence looks like is explored in the article Artificial Intelligence in Cyber Defence: “AI versus AI is the New Reality”.

What digital sovereignty actually means for German and European companies is discussed in the session “Digital Sovereignty – A Pipe Dream or a Realistic Goal” at it-sa EXPO & Congress 2026.

What obligations the Cyber Resilience Act creates for companies is explained in the article Cyber Resilience Act: ENISA Playbook for Manufacturers.

How Security Operations Centres are already benefiting from artificial intelligence is also covered by the session AI Meets the SOC: How Artificial Intelligence Is Transforming Cyber Defense at it-sa EXPO & Congress 2026.

Want to talk directly about XDR, managed security, and the right solutions for your business? At it-sa EXPO & Congress, you'll find exhibitors, keynotes, and expert panels on today's most pressing cybersecurity topics. Visit now!