The Forrester Wave™: Cybersecurity Consulting Services, Q2 2024

Cybersecurity Consulting Services Vendor Product Comparisons 2024

Key features and pros and cons of top Cybersecurity Consulting Services products:

McKinsey & Company - Leaders

Pros:

Solves cybersecurity problems and avoids implementation work
Recognizes cybersecurity as a business enabler, not a cost center
Sees cybersecurity as a board-level priority
Excels in business-aligned cybersecurity strategy and vision creation, budget optimization, and technology stack consolidation
Demonstrates that budget optimization does not need to be synonymous with cost takeouts
Helps build business cases that increase security budgets tied to strategic initiatives
Strong polish, credibility, and almost automatic board-level buy-in

Cons:

Makes limited contributions back to the broader cybersecurity community outside of thought leadership
Not a strong choice for basic staff augmentation engagements

Trail of Bits - Leaders

Pros:

Stays at the forefront of cybersecurity innovation year after year
Delivers services better than any other firm in this evaluation
Straddles a line between conducting research on the latest cyber challenges and making that research expertise available in consulting engagements
Publishes and gives back research via open-source projects, blogs, and community events
Particularly strong when helping security leaders secure emerging technologies and in its technical assessment portfolio
Helps create many of the tools and methodologies that other providers use when securing large language models, machine learning, and blockchain
Approach to software security differentiates by moving well past simple penetration testing and code assessments

Cons:

Offers a more limited portfolio of services compared to others in this evaluation

TrustedSec - Leaders

Pros:

Brings a threat-actor-centric approach to its portfolio of services
Founded with a commitment to improving the security posture of its clients and making strong contributions to the overall cybersecurity community
Innovative research is embedded in its engagements
Makes research available via conference talks, open-source projects, and blog posts
Can adapt as quickly as adversaries because of its commitment to research
Makes threats and threat actors the centerpiece of its cybersecurity consulting approach
Technical assessment services, which include penetration testing, purple teaming, and red teaming, are unsurpassed
Can assist clients by creating security strategies that focus on cybersecurity controls and an overall security program's ability to defend against realistic threats
Technical competence and best-in-class offensive knowledge are obvious

Cons:

Localized delivery support in a global business is not a strong suit for the smaller provider

Accenture - Strong Performers

Pros:

Executes global delivery with ease
Successfully blends traditional consulting work with partnerships and acquisitions to offer managed services
Well positioned to help solve problems like technology bloat
Reference customers admired Accenture's bench, deep technical skills, and flexibility
Strong with pure governance, risk, and compliance engagements
Makes standard marketing-oriented contributions back to the broader cybersecurity community

Cons:

Needs to impress non-tech executives
Primary challenge is that it's an extraordinarily strong deployment, implementation, and integration provider, but those services are becoming less important with cloud, SaaS, marketplaces, and plug-ins

Boston Consulting Group - Strong Performers

Pros:

Sees cybersecurity's importance and understands the strategic and business implications
Offers an external perspective on increased importance for CISOs that helps validate what the board and C-suite have heard
Standout engagements include security budget optimization and tech stack consolidation
Strong reputation and exposure within the C-suite helps CISOs make the case for more attention and investment
Delivers engagements that seek more investment in a cybersecurity program rather than focusing only on reducing costs
Strategic polish, use of data, and deliverable quality stand out as highlights from reference customers

Cons:

Needs to earn credibility with CISOs as a relative new entrant into cybersecurity
More expensive than other providers in this evaluation
Not as strong on the technical front
Does not manage technology or offer extensive staff augmentation

Deloitte - Strong Performers

Pros:

Coasts on size, reputation, and polish
True jack of all trades
No other provider manages to upskill its consultants with strong presentation and executive engagement skills like Deloitte
Often snags technical talent from other firms and upskills them in presenting and polish

Cons:

Master of none, except perhaps when it comes to consultant polish
Allows risk to dominate over cyber in its approach
Often the most expensive of the Big Four providers
Vision is to use consulting to open pathways to earn business in recurring revenue 'operate' services
Declined to participate in the full Forrester Wave evaluation process

EY - Strong Performers

Pros:

Brings strong security strategy development
Offers strong cybersecurity vision and transformation capabilities
Strong governance, risk, and compliance engagements backed by time-tested maturity frameworks and benchmarks
Reference customers mentioned efficient and capable project management
Pricing reported as favorable compared to competitors

Cons:

Can't resist managing technology
Reference customers identified inconsistent outputs across engagements and issues encountering complexity inside EY as potential concerns

PwC - Strong Performers

Pros:

Markets trust heavily
Strong partnerships — especially those in cloud with Azure and AWS — set the vendor apart as business enablers
Possesses extensive capabilities in cybersecurity strategy, budget optimization, and tech stack consolidation
Aligned with what a CISO needs from a large cybersecurity consulting provider today

Cons:

Relies on risk for cybersecurity in the end
Real focus is on risk rather than trust
Buries cybersecurity within risk and relies on common concepts like three lines of defense
Less visionary or transformative and more of a preservationist of the status quo in cybersecurity consulting
Declined to participate in the full Forrester Wave evaluation process

CrowdStrike - Contenders

Pros:

Incident response expertise propagates through its consulting offering, bringing unique insights into adversary tactics
Excels at upskilling client personnel
Makes extensive contributions to the broader cybersecurity community
Well equipped to deliver technical assessments and engagements
Services vision uses products and platforms as the core of its consulting offering, reflecting discipline of its services leaders

Cons:

Products overshadow consulting
Upskilling is primarily siloed to its own platforms
Falls short of some of the top-tier firms in technical assessments
Unless the engagement involves CrowdStrike products, the firm lacks credible capability for compliance-oriented assessments, staff augmentation, and vendor consolidation services
Declined to participate in the full Forrester Wave evaluation process

Infosys - Contenders

Pros:

Broad portfolio fits best for cash-strapped CISOs looking to outsource
Flexible approaches to staffing engagements to reduce costs
Customer-centric approach to solving problems
Finds ways to creatively solve security problems
Creativity and flexibility are highly valued by reference customers

Cons:

Lacks a unique perspective in cybersecurity
Strategy features elements competing providers have offered and specialized in for years
Heavy focus on tech optimization and cost reduction
Emphasizes the basic building blocks of cybersecurity — risks, compliance, and tactical activities — over threats and controls
Reference customers commented the firm is overambitious and occasionally overconfident in what tasks it can perform

KPMG - Contenders

Pros:

Stable provider with global reach
Can handle tactical work
Plenty of KPMG clients and prospects will have excellent experiences based on relationships with partners, experience in specific verticals, and local delivery personnel

Cons:

Cybersecurity relevance continues to wane
Gap between the big three and fourth place continues to widen in cybersecurity
Conflates implementation with innovation
Strategy is a fast follower at best - whatever Deloitte, EY, and PwC did one to three years ago will feature prominently as KPMG's vision
Lacks innovation for its cybersecurity services
Declined to participate in the full Forrester Wave evaluation process

Wipro - Contenders

Pros:

Shows promise in innovation
Wide portfolio, expertise in execution, and technology skills
Commitment to technology — including building and acquiring its own when appropriate
Expertise in running client technologies gives it an edge when building its own tech
Bread-and-butter service is staff augmentation and outsourcing with plethora of flexible options
Clever and customer-collaborative approach to problem-solving was confirmed by reference customers

Cons:

Falls short of being a CISO's top strategic choice
Doesn't measure up against the leaders when it comes to C-level access, credibility, and engagement
For most services like budget optimization and tech stack consolidation, cost takeouts are areas of focus
Challenges include internal bureaucracy and lack of a clear forward-looking point of view toward cybersecurity

HCLTech - Challengers

Pros:

Fine tactical partner for CISOs
Can help identify personnel to run technologies and processes the cybersecurity program relies upon
Strategy features providing technologists to help clients migrate to cloud, run identity and access management deployments, and secure OT environments

Cons:

Lacks true depth in security domains
Shares a lineage with other firms that were first outsourcers and offshorers, then pivoted from IT to cybersecurity
In most cases, another firm is the provider developing the strategy and HCLTech is the deployment, implementation, and day-to-day operator
Lacks the strategic, visionary, or threat-focused expertise that many other providers offer
Declined to participate in the full Forrester Wave evaluation process

IBM - Challengers

Pros:

Strong revenue and growth numbers in past
Focusing on threat-focused services and X-Force brand

Cons:

Fading strategy makes it a choice only for those already invested in its products
Falling well behind other cybersecurity vendors in innovation, relevance, and market share
Has lost cybersecurity revenue multiple quarters in a row
Pivoting to place hopes on genAI and resurrected 'watsonx'
Strategy depends on its products to drive its services revenue
Weakening demand for the provider's product set results in revenue declines for cybersecurity consulting services
While IBM allowed the once-vaunted X-Force brand to languish, other providers stepped in to become the premier technical experts
Declined to participate in the full Forrester Wave evaluation process

Tata Consultancy Services - Challengers

Pros:

Valuable tactical partner for cybersecurity
Offers strong deployment and implementation, security staff augmentation, and outsourcing services
Reference customers confirmed the provider's willingness to perform technology-based work and its affordability as highlights

Cons:

Limited tactical partner
Tries to be visionary but gives little reason to view it as anything but a small player relegated to basic activities
Strategy includes a standardized framework-heavy approach with an emphasis on risk and a focus on implementation work
Does not impress in areas important to CISOs like technical assessments, overall cybersecurity strategy work, and security budget optimization
References called out a lack of deep industry expertise, and inconsistent and dated deliverables

FAQs

Q: Which vendors are Leaders in 2024?

A: McKinsey & Company, Trail of Bits, TrustedSec

Q: What does "Leader" mean in Forrester Wave terms?

A: The Forrester Wave evaluation highlights Leaders, Strong Performers, Contenders, and Challengers. Leaders are vendors that demonstrate the strongest current offering and strategy in the market. In this cybersecurity consulting services evaluation, Leaders possess deep technical expertise with a focus on innovation and research, instill confidence and credibility with boards and senior leaders, and contribute to the community to make the entire industry better through sharing intellectual property via conferences, open-source projects, published frameworks, and other initiatives that do not require client status to obtain.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Cybersecurity Consulting Services in 2024

Cybersecurity Consulting Services Vendor Product Comparisons 2024

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2024?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference