How Midsize Organizations Use XDR To Fight Sophisticated Threats

• Security teams face sophisticated, AI-driven threats while being expected to do more with limited headcount and budgets.
• Unifying security tools and data reduces manual work and blind spots, empowering lean teams to handle AI threats faster.
• XDR correlates security signals across multiple surfaces to improve detection speed and root-cause understanding.

Midsize cybersecurity teams are being asked to solve an enterprise-scale problem without access to enterprise-scale resources. AI-driven threats are increasing the speed and complexity of attacks, while security teams continue to contend with limited headcount, constrained budgets, and sprawling technology environments. A Q3 2026 Forrester Consulting study commissioned by Broadcom and surveying 253 cybersecurity decision-makers highlights three realities shaping security strategies in the midmarket:

• Resource constraints are colliding with faster-moving threats. Seventy-seven percent of respondents said their teams are expected to do more with limited resources, while 75% struggle to keep pace with AI-powered attacks.
• Too many disconnected tools are creating operational friction and security gaps. Organizations use an average of 19 security tools, and 69% say the lack of a unified view creates critical security blind spots.
• Consolidation and XDR are emerging as paths forward. Seventy-five percent of organizations are actively consolidating tools or pursuing platform strategies, while 95% of teams that have implemented XDR report realized or anticipated improvements to detection and response speeds.

Together, these findings point to an important shift: Midsize organizations are looking beyond simply adding more security tools and toward creating a more connected security environment. 

Security teams face more threats without more resources

For midsize organizations, the challenge is not simply that cyberthreats are becoming more sophisticated — it is that security teams are expected to respond to those threats with far fewer resources than their larger enterprise counterparts. That imbalance is becoming especially challenging as bad actors get a stronger grip on AI. In Forrester’s study, 75% of respondents reported difficulty keeping pace with AI-powered attacks, while 77% said they are expected to accomplish more despite having limited resources.

At the same time, the technology intended to help security teams can create additional operational burdens. Respondents to the study reported their organizations having an average of 19 security tools, with 42% juggling between 20 and 50.

Rather than making security operations simpler, a large portfolio of disconnected tools can force already-stretched teams to spend valuable time connecting information themselves. In fact, 79% of respondents said they spend considerable manual effort correlating data across disconnected tools.

That fragmentation can have consequences beyond team productivity. Nearly seven in 10 respondents (69%) reported that the lack of a unified view creates critical security blind spots. Meanwhile, 75% face inflated security information and event management (SIEM) ingestion and storage costs. The result is a difficult equation for midsize security teams: more threats and more data to manage, but limited resources with which to make sense of it all.

From more tools to a more unified approach

Faced with these pressures, midsize organizations are beginning to rethink whether adding another point solution is the answer. Instead, consolidation is gaining momentum. Three-quarters of organizations surveyed are actively consolidating their security tools or shifting toward platform strategies. The goal is to reduce the operational friction created by disconnected technologies while helping teams get more value from the security data they already have.

XDR is playing a significant role in that shift. By natively correlating signals across multiple surfaces, XDR can give teams a more unified approach to detection and response. To date, 64% of teams surveyed have implemented XDR. More importantly, those organizations are reporting meaningful results. Among respondents that have adopted XDR, 95% report realized or anticipated detection and response speed improvements, while 94% say the same for better root-cause understanding.

For teams operating with limited headcount and budget, those outcomes are even more critical. Consolidation is not simply about having fewer tools but involves reducing the manual work required to connect security information, minimizing blind spots, and enabling teams to more effectively identify and respond to threats.

As AI-driven attacks continue to challenge midsize organizations, the findings suggest that the path forward may not be adding more tools to an already-crowded environment. Instead, it may require bringing security data and capabilities together so lean teams can operate with greater speed, visibility, and efficiency.

Take a closer look

Want to explore the findings in more depth? Download the full Forrester Opportunity Snapshot, or catch the debrief featuring guest speaker and Forrester Principal Analyst Allie Mellen and Broadcom’s Head of Product Justin Falck.

See firsthand what unified XDR designed for resource-strapped teams looks like. Request a demo for an expert-guided tour.