Before signing with an XDR vendor, ask what data sources it truly ingests, how detections are written and tested, what response actions it can take, who owns your data, and what happens at renewal and exit. Get answers in writing, and test the important ones on your own environment.
XDR means extended detection and response. Because vendors build it from different parts, the same word can hide very different products, so these questions aim at specifics.
Scope and data
1. Which sources are native and which are connectors? Native sources are usually deeper. Ask for a list with the depth of each: raw events, summarized alerts, or only status.
2. What do you not cover? A confident vendor can name limits. Check identity, cloud audit logs, email, SaaS and network against your own list.
3. How is data normalized? Ask to see the same event from two sources side by side. If fields differ widely, correlation is shallow.
4. How long is data searchable, and what does longer retention cost? NIST SP 800-53 control SI-4 expects events to be analyzed, which often needs history. Get the price of each retention tier in writing.
Detection quality
5. How are detections created and validated? Ask who writes them, how they are tested, and the date of the last review for a sample rule.
6. Can we see and edit the logic? Black box rules cannot be tuned. Ask whether you can write your own and whether a vendor update will overwrite your edits.
7. How do you map to MITRE ATT&CK? ATT&CK documents adversary behavior, and mapping shows coverage. Ask for the mapping and for known gaps, and treat a fully green map with suspicion.
8. What is the typical false positive load after tuning? Ask for reference customers you choose from a list the vendor does not curate, and ask them how long tuning took.
Response
9. Which response actions are built in? Isolate a host, kill a process, disable a user, block an address. For each, ask whether it is automatic, approved or manual.
10. What happens if the agent is tampered with or goes offline? Ask how the product detects a silent agent, and what you see when coverage drops.
11. What is the rollback for an automated action? A wrongly isolated production server is an outage. You need a quick way to undo.
Data, security and operations
12. Who owns the data and the detections written for us? And what do we receive at exit, in what format?
13. How is our data protected, and where is it stored? Ask for the vendor's current security attestations and read the scope, not just the headline. Do not accept a logo as an answer. Check any certification claim against the report itself.
14. What does a platform outage look like for us? Ask for the incident history in writing and what the service commitments are.
Commercial
15. What are the renewal, overage and minimum terms? Ask for the overage rate, the renewal uplift limit and the notice period, and get them in the contract. Have counsel review the legal language, since this post is not legal advice.
How to use the list
Send questions 1 to 4 and 12 to 15 in writing before demos, so answers are on record. Keep 5 to 11 for live sessions, where you can watch the product do the thing. Score each answer as proven, claimed or evaded, and weigh evasive answers heavily.
A short plan for the trial
Run a four week trial on a slice of real systems. Agree in advance with your team on a few harmless test events, such as a login from an unusual location with a test account. Check which are noticed, how fast, and what the vendor recommends. Test one containment action on a non-critical machine and one rollback.
What to do
- Send the written questions before any demo.
- Ask for sample escalations and a sample monthly report.
- Run a trial with harmless test events on real systems.
- Test one response action and its rollback.
- Check security attestations against their scope.
- Negotiate overage, renewal and exit terms before signing.
Where Safeguard fits
Safeguard does not sell XDR and does not replace it. It works on application and software supply chain security, including reachability analysis for dependencies. If an XDR alert involves a library flaw, those results help decide how urgent the application fix is.
Quick check
Which question matters most?
Question 9, what the product can actually do in response, and who approves it. Detection without a response path leaves work for people.
Should we trust a vendor's reference customers?
Treat them as one data point. Ask for a few you did not hear about from the vendor, and verify what you can through peers.
Sources
Last reviewed: 18 October 2026.
