SchildmarkGuide
How to choose an XDR for a mid-size company: a buyer’s checklist
Choose an XDR by what it covers, what it can do about an attack on the equipment you already run, and who will read its alerts. Then check patching, compliance evidence, where the data and the AI requests go, how it is priced, and whether a trial runs on your own machines.
What a mid-size company needs from an XDR
A mid-size company usually has an IT team of a few people, sometimes an outside provider, and no security operations centre. The XDR has to cover a mixed estate of Windows, macOS and Linux, a firewall or two, Microsoft 365 and a cloud account, and its alerts have to make sense to someone who also runs the help desk.
Compliance often decides the timing. NIS2 brings many mid-size companies into scope for the first time, and customers ask for ISO 27001, PCI DSS or SOC 2 evidence in contracts. An XDR does not make you compliant, but it should produce the technical evidence those frameworks ask for without extra work.
The XDR buyer’s checklist
Ten criteria, what to check for each, and how Schildmark answers it, so you can put other products in the same table.
| Criterion | What to check | Schildmark |
|---|---|---|
| Coverage | Windows, macOS and Linux, servers as well as laptops; firewalls; Microsoft 365; cloud accounts; the endpoint protection you already run. | Windows, macOS and Linux endpoints and servers, network sensors, firewall syslog, Microsoft 365, AWS, Google Cloud, Defender for Endpoint, Sophos Central. See detection. |
| Response on your firewalls | Can it act on the firewalls and clouds you already run, with an approval step and addresses it must never block? | Blocks on FortiGate, Sophos Firewall, OPNsense, AWS, Azure, Google Cloud, DigitalOcean and Cloudflare; pfSense is read only. Protected addresses are never blocked. See response. |
| Patching | Does it fix what it finds, and how is a fix verified? | Rehearse, approve, install the exact version, re-scan to confirm. Never unattended on high or critical machines. See XDR with patch management. |
| Compliance evidence | Exports per period that an auditor can open, mapped to NIS2, ISO 27001, PCI DSS or SOC 2. | Mapping control by control and an evidence pack of CSV files for a period. See compliance. |
| Data location | Where logs, alerts and backups are stored, and who can reach them. | Hosted in the region you choose, for example Frankfurt or another EU location; logs, alerts, inventory and backups stay there. |
| AI data policy | Which model reads your data, where it runs, and whether you can switch it off. | Your choice: your own model, our standard provider, BAA-covered providers only, or nowhere. See the analyst. |
| Hosted or self-hosted | Can you run it yourself if your policy requires it? | Hosted by us, or on one or two of your own Linux servers. See deployment. |
| Pricing model | Per machine, per user or per data volume; what add-ons cost; whether integrations are extra. | Hosted from $800 per month, depending on machines and add-ons; self-hosting quoted separately; every integration included. See pricing. |
| Trial | On your own machines, long enough to see real alerts and a patch cycle. | 30 days, up to 25 machines, every feature, no payment details. |
| Who reads the alerts | Your team, a provider or both, and how the product helps them decide. | An AI analyst explains alerts and proposes the fix; usable by a small IT team or an MSP or MSSP. |
Red flags when choosing an XDR
None of these rules a product out on its own, but each deserves a direct question.
- A demo only on sample data
- Sample data always looks clean. Ask for a trial on your own machines and firewalls.
- Response that cannot be held back
- Automatic blocking with no approval step and no list of protected addresses will one day block a partner or your own office.
- “Patched” means “installed”
- If a fix is never re-scanned, the report shows what was attempted, not what was fixed.
- No answer on AI data
- If the vendor cannot say which model reads your alerts and where it runs, assume your logs leave.
- “Makes you compliant”
- No product makes you NIS2 or ISO 27001 compliant. A tool produces evidence; your ISMS and your auditor do the rest.
- Data you cannot take with you
- Ask how you export evidence and data, and what happens when the licence ends.
Questions to ask in an XDR demo
Ask the vendor to do these live, not on slides.
- “Show me an alert from my firewall, and what I can do from it.”
- Tests coverage and response on the equipment you own.
- “Explain this alert as you would to our managing director.”
- Tests whether a small team can act on it without a specialist.
- “Take one vulnerability from finding to verified fix.”
- Tests whether patching is verified or just installed.
- “Export the evidence for last month.”
- Tests what you will hand an auditor.
- “Where is this data stored, and where did that AI request just go?”
- Tests the data location and AI data policy in practice.
- “What does it cost for our machines, with the add-ons we need?”
- Tests whether the price you heard is the price you pay.
Hosted or self-hosted XDR
Hosted means the vendor runs and upgrades the servers; ask which region holds your data and whether each customer is isolated. Self-hosted means every log stays on your own servers, and you provide the hardware and the backups.
Schildmark is the same product either way, and every customer gets a stack of its own. A hosted stack runs in the region you choose when it is set up. A self-hosted stack runs on one or two of your Linux servers and keeps one outbound HTTPS connection to our control plane, with no inbound access. Details are on the deployment page, prices on the pricing page.
Questions people ask
What should a mid-size company look for in an XDR?
Coverage of your machines, firewalls, Microsoft 365 and cloud accounts; response on the firewalls you already run; patching that verifies its fixes; compliance evidence per period; a clear data location and AI data policy; a predictable price; and a trial on your own machines.
How much does an XDR cost for a mid-size company?
Most XDR products are priced per endpoint or machine, per month or per year; log platforms often charge by data volume instead. Compare the full price for your machine count with the add-ons you need. Hosted Schildmark starts at $800 per month; the final price depends on protected machines and add-ons, and self-hosting is quoted separately.
Is a hosted or a self-hosted XDR better?
Hosted means the vendor runs and upgrades the servers; ask in which region your data is kept. Self-hosted keeps every log on your own servers, and you provide the hardware. Schildmark is the same product either way: hosted in the region you choose, or on one or two of your own Linux servers.
How long should an XDR trial be?
Long enough to see real alerts and at least one patch cycle on your own machines; 30 days is a common length. Schildmark’s trial runs 30 days for up to 25 machines, with every feature and no payment details.
Can an XDR make us NIS2 or ISO 27001 compliant?
No product can. An XDR carries out and records technical measures, such as incident handling, vulnerability handling and monitoring, and exports the evidence. Risk analysis, policies, training, supply chain and management oversight stay with your ISMS, and the auditor or authority judges the whole.
Put Schildmark through this checklist
Tell us your machines, firewalls and clouds, and the audit you are preparing for. We answer within one working day.