Rethinking Channel Partnerships in the Age of XDR and AI

Discussion with Edward DeWolfe

Edward DeWolfe brings more than a decade and a half of experience navigating the fast-evolving cybersecurity space, where he's played a key role in building global partner ecosystems and crafting successful go-to-market strategies for both startups and large-scale enterprises. From launching his career at Invincia to channel roles at Fidelis, Secureworks and Sophos, he's seen the industry from every angle. In this interview, DeWolfe shares his candid perspective on how channel models are evolving, why services are overtaking sales, and how regional insight and strong relationships remain at the heart of global growth.

From Tool Overload to Stack Consolidation

For years, security teams tried to plug every gap with a new tool. The result? A cluttered stack, poor integration, and overwhelmed teams. DeWolfe has seen this story repeat across industries. "I've talked to multiple large enterprises and government agencies that said, 'We have 60 or 70 security tools. Because of that, we don't know any of them really well.' They're not all integrated. Some are not even used at all."

That level of fragmentation creates operational blind spots and makes threat detection inefficient and reactive. Security teams can’t extract the full value from their stack when they’re constantly shifting between interfaces, dashboards, and protocols. XDR addresses this by acting as an orchestration layer, consolidating data, and streamlining workflows with automation and AI. "That's the reason XDR has become prominent. At Sophos, our Tagous XDR platform allows MSSPs and enterprises to manage fewer tools while responding more effectively to threats."

This isn’t just about reducing the number of tools, it’s about enhancing signal fidelity, making correlation faster, and enabling teams to act with confidence. Stack consolidation has evolved from a cost-saving initiative into a strategic imperative for agility and resilience.

The New Revenue Model: Services Over Sales

The economics of the channel are changing. Resellers once made money by integrating complex toolsets. But with XDR doing much of that heavy lifting natively, partners have had to rethink where their value lies. "With XDR, there's not as much integration work that resellers or system integrators need to do. So, there's probably a bit of diminished returns."

This change has opened a new lane for partners to offer managed services, turning integration expertise into operational security delivery. XDR gives them a platform to build on, rather than replace. "They've seen the writing on the wall. Many are now prepared to offer security services on top of XDR to maintain their revenue streams."

By layering value-added services on XDR platforms, like threat hunting, identity protection, and remediation, partners generate more predictable, long-term revenue. It also positions them more strategically in the client relationship, offering continuity and outcomes rather than one-off implementations.

From Resellers to Strategic Security Partners

Today’s customers don’t just want a product, they want a partner. The traditional model of selling a tool and moving on is fading. DeWolfe sees resellers reinventing themselves as true collaborators. "You see a lot of national resellers moving into the system integrator space. They're offering a wider array of services to support customers."

This evolution reflects a more consultative approach to cybersecurity. Rather than simply filling technology gaps, partners are aligning with clients’ risk management frameworks and business goals. It’s a shift from procurement support to active participation in operational execution. "Supporting the products they sell versus just moving on to the next product, that's the big evolution."

Strategic partners are now involved post-sale, monitoring threats, tuning systems, advising on architecture. This proximity builds trust and creates retention loops that are difficult for pure-play vendors to replicate.

Upskilling at Scale: A New Enablement Paradigm

As the nature of channel work changes, so does the skillset required. What hasn’t changed is the importance of training, only now, it’s more accessible and scalable. "The critical part of a partnership is understanding the product and how to deliver a specific service on it. That has always been the case."

Instead of relying on in-person bootcamps or vendor-led certifications, partners can now onboard teams at scale through digital learning portals. These programs emphasize modular, role-specific learning, tailored to engineers, analysts, and business leaders alike. "There's more self-help, self-paced online training and certifications. That makes it quicker and easier for partners to get multiple people trained at their own pace."

This democratized model is particularly useful in fast-growing markets, where time, geography, and cost can be barriers to enablement. It also helps vendors activate partners faster, shortening ramp times and increasing service consistency.

Going Global: The Importance of Localization

Scaling internationally doesn’t just mean opening new markets, it means adapting to them. DeWolfe stresses that local context, language, and relationships are critical. "In many global markets, like LATAM and the DACH region, companies are more likely to engage with a local team versus someone on Zoom from the U.S."

Localized presence matters not only for communication, but for cultural fluency and speed of execution. Partners and customers are more likely to invest in a solution when they know it’s backed by teams who understand their regulatory environments, procurement cycles, and risk appetite. "Expanding your channel means finding distributors and resellers that are willing to invest time in understanding your product and helping you scale."

Establishing these regional footholds also creates better product feedback loops, stronger brand equity, and more sustainable pipeline development. It's a reminder that global reach depends on local relevance.

Open Platforms, Complex Dynamics

Working with MSSPs can be powerful, but tricky. In many cases, vendors and partners might find themselves on both sides of a deal: collaborator one moment, competitor the next. "When you build a go-to-market plan with an MSSP who may also be competing with you, it can be challenging."

Open platforms enable flexibility, but they also require strong governance. DeWolfe notes that vendors must approach these relationships with clear alignment on go-to-market roles, opportunity segmentation, and joint accountability. "You need a very specific go-to-market plan and understanding of how companies will work together, especially when competing in the same market."

When those boundaries are clearly defined, even competitive overlap can be turned into shared growth. It’s about being pragmatic, not possessive, and letting value delivery, not turf, drive collaboration.

AI: A Core Requirement, Not a Feature

AI is no longer an innovation, it’s table stakes. But not all AI is created equal, and DeWolfe sees meaningful differences in how deeply AI is embedded in today’s XDR platforms. "Everyone has access to the same tools. The question is: who has integrated AI with the most automation and highest efficacy?"

It’s one thing to bolt AI onto an existing product, it’s another to architect a platform with machine learning and AI at its core. The former often leads to superficial automation and delayed insights; the latter enables proactive defense and scalable action. "Some vendors tacked on AI later. Others, like Sophos’ Taegis, built their XDR platform around AI from day one. That makes a difference."

AI’s real value lies in filtering noise and surfacing actionable insights at the right time. In high-volume environments, this translates to real cost savings and faster incident containment. "You couldn’t survive as an XDR platform without very good AI functionality."

Final Takeaways for Channel Leaders

DeWolfe leaves us with three core lessons for vendors and partners navigating today’s cybersecurity environment:

• Put outcomes first: It's not about selling a product, it's about solving a problem. Show how XDR reduces risk and improves resilience.
• Design for integration: Flexibility wins. Your platform must play well with others to stay relevant.
• Make AI work for you: Don’t just have AI, build around it. Real differentiation comes from seamless, high-impact integration.

The channel is evolving, but it’s far from obsolete. For those willing to embrace services, invest in partnerships, and build around outcomes, the future is wide open.

‍