The Forrester Wave™: Cybersecurity Incident Response Services, Q2 2024

Cybersecurity Incident Response Services Vendor Product Comparisons 2024

Key features and pros and cons of top Cybersecurity Incident Response Services products:

Accenture - Leaders

Pros:

Provides extensive, exec-translated IR services with global consistency
Large global footprint with in-country and multilingual support ensuring seamless handoffs
Uniform, continual upskilling via cyber response boot camp and academy
Multiday onboarding including IR plan/playbook review and forensic triage tool testing
Immersive, multi-industry crisis simulations with incident simulation within first three months for OT/ICS customers
Smooth handoffs between managed IT staff and responders
Pragmatic, prioritized post-incident recommendations

Cons:

Other IR firms are better at attacker attribution according to reference customers

Aon - Leaders

Pros:

Data-backed, expert-driven, insurance-minded IR lifecycle
Synergies between IR firm Stroz Friedberg acquisition benefiting customers and cyber insurance carriers
Carrier-aligned security assessment with 'red flag' alerts in CyQu cyber risk assessment platform
Streamlined business email compromise (BEC) service launched January 2024
Resilience Retainer for dedicated funds across IR, assessments, risk management, and partner services
Engagement managers staffed with former attorneys or law enforcement agents
Strong cloud IR capabilities and training delivery to customers' internal teams
Top-notch technical expertise with excellent ability to translate technical terms

Cons:

Booz Allen Hamilton - Strong Performers

Pros:

Years of experience in IR and threat actor engagement
Well regarded by law firms for working in lockstep during real or simulated crisis
Tri-party agreement templates with over 100 law firms for efficient response under privilege
Highly experienced incident leadership for litigation support, crisis management, and insurability
Direct threat actor negotiation capabilities
Highly realistic crisis simulations across environments
Comprehensive in-house recovery services
Strong OT/ICS capabilities with newly opened lab in metro Washington, DC
Strong ransomware negotiation and recovery capabilities

Cons:

Vision relies on platitudes and competitor comparisons instead of differentiation
Does not share information or intelligence outside own customer base and government agencies
Provided only one reference customer for evaluation

Cisco - Contenders

Pros:

In-house OT/ICS response expertise
Cyber range and incident simulation options for security teams

Cons:

Primarily focused on networking, cloud, software, and security products rather than IR services
Struggles with separating Talos IR services from larger product portfolio
Little investment in innovation, global presence, or talent acquisition for IR services
More rigid parameters for rolling over retainer hours compared to market
Outdated guaranteed response times
Retainers positioned as add-ons with little focus on IR-specific onboarding
Lacks immersive crisis simulations for organizational resilience
Shares threat intelligence and IR findings sporadically

CrowdStrike - Leaders

Pros:

Executes bold vision with improved ecosystem alignment
Strong relationships with law firm and insurance community
Bolstered incident readiness offerings for executives and boards
SEC readiness consulting services for C-level executives
Solid supporting products and partner network for breach surges
Customer-attested rapid response times
Thorough onboarding with response readiness exercises
Shares valuable threat intelligence via social channels, guides, and annual reports
Strong cloud IR experience and expertise
Effective technology capabilities
Top threat intelligence capabilities

Cons:

Uses partners for some aspects of remediation according to reference customers

Deloitte - Strong Performers

Pros:

Strong talent management via Deloitte Academy and Technology Academy programs
Focus on maintaining and rebuilding trust
Strong partner network
Incident commanders and responders collaborate well with ecosystem players
In-house recovery services for resuming normal business operations
One-to-three-year roadmap of services to improve incident readiness and resilience

Cons:

Acquisitions and new partnerships appear to have stagnated
Shares noticeably little intelligence with greater cybersecurity community
Website hosts few marketing-focused case studies
Social channels filled with job postings instead of helpful intelligence
Declined to participate in full Forrester Wave evaluation process

EY - Strong Performers

Pros:

Strength in ecosystem alliances strategy
Focus on transforming and managing tech for customers
Center of Excellence for Crisis Simulations with proprietary platform
Immersive simulation exercises in multiple locations or virtually
Cyber insurance assessment for retainer customers

Cons:

Talent strategy largely focused on advanced degrees
Talent development skews toward pursuit of higher education or internal badges
Customer-facing focus on 'first-ever fully accredited corporate MBA offered by a Big Four'
Threat intelligence provided largely through partners
Does not share insights with greater cybersecurity community except a few regulatory bodies
Declined to participate in full Forrester Wave evaluation process

Google (Mandiant) - Leaders

Pros:

Comprehensive, innovative end-to-end IR services
Innovation through automation, orchestration, and AI post-Google acquisition
In-house crisis communications and expanded strategic readiness offerings
Assists organizations and governments globally against sophisticated nation-state attackers
Shares war stories via annual M-Trends report and Mandiant Academy training
Full in-house OT/ICS IR services
Litigation and regulation-aware, tech-agnostic IR
Google Security Operations and Workspace for security analytics and communication
Excellent at attacker attribution and law enforcement engagement globally
Credibility at executive table and with tech teams
Leading edge threat intelligence capabilities

Cons:

IBM - Contenders

Pros:

Immersive cyber range with physical location in Washington DC area
OT/ICS practice expertise
Focus on bringing early-career professionals through multiple programs
Expertise in running executive tabletop exercises

Cons:

Lacks innovation in products and services to support IR lifecycle
Relies on partners for detection and response technology innovation
X-Station IR triage platform still in future development
Rigid retainer structure with unused hours rolling over by exception only
More variable years of experience at senior level compared to peers
Need for more industry-specific threat intelligence according to reference customers

KPMG - Strong Performers

Pros:

Significant global presence and focus on global delivery
Accreditation program to ensure consistency
Global case management system with well-executed follow-the-sun handoffs
Expansive array of in-house supporting products and services including crisis communications
Proprietary case management system for right information to right ecosystem members
Thorough consultative approach with three-day workshop for retainer customers
Exceeds response time agreements
Strong manpower for 'boots on the ground' requirements
Environment restoration capabilities and iterative transformation services
Availability of senior executives
High-quality work product
Focus on privilege and professionalism

Cons:

Vision does little to differentiate from other Big Four consultancies
Runs squarely with the pack in cloud, OT/ICS, and threat intelligence

Kroll - Strong Performers

Pros:

Handles heavy volume of incidents
Innovation driven by high volume yielding efficient products, services, and processes
Crisis communications added in 2022
BEC tool launched for faster collection and analysis of unified audit logs
Tech agnostic approach with proprietary tools to streamline IR
Breach notification prompts added to executive tabletop exercises
Close working relationships with outside counsel at over 300 law firms globally
Litigation support including e-discovery, data mining, and expert testimony
Can quickly stand up and manage breach notification and identity monitoring programs globally
Strong incident readiness assessments and exercises
Clear reporting

Cons:

Lacks clear vision for itself in the market
More restrictive retainer structure for carrying over unused hours
Bench not deep for deeply technical and specialized work like code review according to reference customers

Palo Alto Networks - Leaders

Pros:

Expands reach and value to security leaders and executives
Global presence with innovative IR offerings under Unit 42
Arcade platform for IR client onboarding and retainer management
IR workshop, activation guides, and incident simulation during onboarding
Embedded threat intelligence analysts for each response
Dynamic battlecards for response/negotiation by specific threat actor
Free threat research reports on actors, vulnerabilities, and IOCs via social channels
Strong cloud IR expertise
Effective technology
Ease of use for Arcade platform
Invested in onboarding and readiness backed by actionable intelligence

Cons:

Still some wrinkles in IR paperwork process according to reference customers

PwC - Strong Performers

Pros:

Vision to be lead orchestrator and single line of communication to executives and boards
Global alliance partnership with Microsoft Incident Response
Global reach delivering local expertise across multiple regions
Thorough day-long onboarding workshop
Comprehensive and creative incident preparation and simulation services including board exercises
Proprietary Concourse platform for tracking IR and recovery process milestones

Cons:

Stops short of full-scale customer breach notification offerings
Ecosystem collaboration, litigation support, tech, threat intel, and talent capabilities are standard without standout services
Offers little to greater cybersecurity community beyond tactical threat intelligence bulletins to customers
Declined to participate in full Forrester Wave evaluation process

Verizon - Contenders

Pros:

Annual Data Breach Investigations Report (DBIR) as strong contribution to industry
Six digital forensics labs worldwide
In-house OT/ICS security and IR practice with expertise
Some cloud security and IR capabilities

Cons:

Small global footprint compared to other IR firms and consultancies
Unwilling to offer broader end-to-end IR services required by enterprise customers
Incident and crisis simulation lacking compared to others
Internal team training lacking
Ecosystem collaboration not a focus area
Declined to participate in full Forrester Wave evaluation process

FAQs

Q: Which vendors are Leaders in 2024?

A: Accenture, Aon, CrowdStrike, Google (Mandiant), Palo Alto Networks

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave are vendors that demonstrate the strongest current offering and strategy in the cybersecurity incident response services market. These providers excel across the incident response lifecycle - from readiness to recovery - with litigation-aware approaches backed by top threat intelligence, digital forensics, and IR tools and talent. Leaders show strength in closely collaborating on breach notification with working knowledge of regional regulations, clearly communicating at all stakeholder levels including boards and executives, and continuously creating efficiencies to handle high-volume incidents while meeting guaranteed response times.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Cybersecurity Incident Response Services in 2024

Cybersecurity Incident Response Services Vendor Product Comparisons 2024

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2024?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference