Blockchain-Backed EDR and XDR Systems: A Systematic Review

• •The paper identifies critical gaps in existing blockchain-assisted IDS/IPS literature.
• •A new taxonomy for EDR and XDR systems is proposed to improve classification.
• •Challenges such as latency and cryptographic vulnerabilities hinder blockchain integration.

The article presents a Systematization of Knowledge (SoK) addressing gaps in the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for IoT and IIoT networks. It highlights the shift towards modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, proposing a three-axis taxonomy for classification. The authors synthesize research from 2019 to 2026, revealing a lack of genuine per-endpoint blockchain-anchored response loops due to latency and deployment issues. They also discuss challenges such as consensus latency, post-quantum cryptographic vulnerabilities, and the security of smart contracts. The paper outlines a research agenda focused on hybrid on-chain/off-chain orchestration to enhance rapid response automation. Despite the extensive literature, the authors argue that a comprehensive blockchain-integrated response system remains largely unimplemented. The findings aim to guide future research in enhancing cybersecurity through blockchain integration.