[bluedino]

3rd party software checks the security and regulatory teams boxes, so no matter how bad they are, they won't be going away anytime soon.

[iancarroll]

I have seen companies pass audits with just XProtect, but I think it highly depends on your auditor and the wording you use to justify it.