The QRadar migration
IBM’s discontinuation of QRadar SaaS products pushed thousands of customers toward Palo Alto Networks. The first wave of retirements ended on April 14, 2026, which removed support for QRadar on Cloud, QRadar Suite Cloud-Native SIEM, QRadar Suite SOAR, SOAR on Cloud, Randori Recon, and QRadar Suite Log Insights. A second phase concluded on August 31, 2026, ending support for QRadar Suite EDR, QRadar Suite XDR, X-Force Threat Intelligence, Randori Attack, and QRadar Advisor with Watson. Palo Alto Networks acquired these assets and provides migration services for eligible customers for the remainder of their existing subscription terms. XSIAM is the newest NG-SIEM on the market and handles these workloads using 2,900+ ML models and 13,300+ up-to-date detections. In MITRE ATT&CK Round 6 testing, XSIAM reached 100% detection and industry-low false positives. The Precision AI system is designed to achieve near 100% accuracy in detecting and preventing sophisticated threats by analyzing massive amounts of data. XSIAM uses machine learning to automate response actions and cross-correlate alerts. I see that this migration movement is quite significant because the QRadar SaaS products are no longer available to renew.
The AI competition and cost
Microsoft Sentinel attempts to compete by providing a data lake tier and a 50-GB/day commitment tier through December 31, 2026. This data lake tier separates cheap long-term storage from expensive real-time analytics. Microsoft advertises savings of up to 52% for customers who commit to a daily volume instead of using pay-as-you-go rates. Sentinel provides commitment tiers ranging from 100 GB/day up to 50,000 GB/day for analytics-tier ingestion. On September 23, 2026, Microsoft also introduced an Integrated Security Operations Center preview to bring XDR and SIEM together in the Defender portal. You should know that while Sentinel prices by ingestion, XSIAM uses a different commercial model. I find the XSIAM licensing process frustrating because it lacks the simplicity of the CrowdStrike annual recurring revenue model. Some users rate the XSIAM cost a 6/10 because the product is expensive and requires additional payments to partners for support. However, the platform is flexible as it allows customers to add custom AI models to the 1,300 existing models on the XSIAM data lake. Using automation to handle detections and investigations can cut manual work by 75%.
| Metric | XSIAM Specification |
|---|---|
| Machine Learning Models | 2,900+ |
| Total Detections | 13,300+ |
| Pre-existing AI Models | 1,300 |
| MITRE Round 6 Detection | 100% |
Unit 42 and the SOC reality
Unit 42 provides 24/7 MDR services using 200+ researchers including threat hunters and malware reverse engineers. The team reviews alerts and uses Cortex XDR data sources to prevent victims from falling to the latest malware campaigns. Unit 42 experts also provide periodic cyber health checks and a dashboard for users to access alerts and events. XSIAM integrates XDR and XSOAR into a single platform to automate detection and response. This integration addresses the tool sprawl that forces companies to manage an average of 17 cloud security tools from five different vendors. XSIAM relies on a security ontology to provide AI agents with a shared model of entities like identities, endpoints, and sessions. 99% of organizations reported at least one attack on their AI systems in the past year. Cisco also introduced an Agentic SOC Workforce in September 2026 to compete in the autonomous space. The ChainDrop worm recently extracted GitHub Actions runner secrets using Ethereum smart contracts for C2 routing, showing how fast attackers move. Does the integration of human expertise with machine intelligence actually close the talent gap for every enterprise?
