The Forrester Wave™: Extended Detection And Response Platforms, Q2 2024

Extended Detection and Response Platforms Vendor Product Comparisons 2024

Key features and pros and cons of top Extended Detection and Response Platforms products:

CrowdStrike - Leaders

Pros:

Latest major software release (Raptor) integrates Humio acquisition for unified native XDR and SIEM-replacement tool
Context-rich endpoint data and high-quality native and third-party detection surfaces
Unique collaboration capabilities in incident management with real-time visual collaboration, notes, incident assignment, and version history control
Built-in forensics capabilities and Falcon Fusion automation for building investigation and response workflows
Provides free native XDR for EDR customers on the Raptor release
Above-average percentage of R&D budget dedication by revenue

Cons:

Product is expensive according to reference customers

Microsoft - Leaders

Pros:

Most complete XDR offering in the market with the most data-rich endpoint information
Unique features like full timeline of activity on each endpoint useful for investigation
Suite enables response across integrated native tools (Defender for Cloud and Cloud Apps), search over data, and user-generated detections
Thorough sandboxing capability with built-in forensics and remote shell
Analyst experience provides significant context within alerts using progressive disclosure
High percentage of revenue devoted to R&D budget rivaling most innovative vendors in security
Online and in-person training resources available (some included, some for fee)

Cons:

Licensing model all but forces practitioners to adopt with the rest of the business, which is prospects' biggest frustration

Palo Alto Networks - Leaders

Pros:

Relentless, shrewd product team with disruption as first pillar in core values
Plethora of endpoint context within incidents with unique dissolvable agent feature for interrogating unmanaged hosts
Incorporates variety of native and third-party detection surfaces including firewall, ZTNA, and cloud
Differentiated remote shell with complete CLI and visual view of endpoint files for less-experienced practitioners
Chat feature for collaboration in incidents, sandboxing, and forensics capabilities
Array of threat-hunting methods from XQL to query builder with SPL to XQL conversion
Simple pricing model based on per-endpoint pricing plus data ingest
High-quality help center and variety of training options

Cons:

XDR product is expensive according to reference customers
Pricing model, while simple, can be costly

Bitdefender - Strong Performers

Pros:

Cleanest and most visually exceptional process tree of vendors in evaluation
Integrated endpoint prevention capability in same platform as XDR
Vast array of endpoint data available in incidents and for querying
High-quality additional detection surfaces including productivity suites, identity, and cloud
Built-in sandboxing and forensics capabilities with remote shell
Response actions can be automated and orchestrated, simplifying analyst experience
Simple pricing strategy with per-endpoint pricing plus integrations licensed by domain

Cons:

Does not have playbook builder for custom automation workflows
Limited training options compared to others in evaluation (some online and in-person available for fee in some languages)
Roadmap needs to address gaps in supported detection surfaces and response automation
Lower percentage of revenue allocated to R&D compared to peers

SentinelOne - Strong Performers

Pros:

Well-known AI-enabled EDR capabilities widely deployed in enterprises
Reference customers speak highly of EDR capabilities
Forensics capabilities and remote shell built in
Response actions can be taken on users or endpoints
All telemetry searchable via Singularity console for threat hunting
Simplicity of management and EDR user interface design

Cons:

Autonomous SOC vision is unrealistic in short term
Press releases have been incongruous with product updates, which frequently lag GA announcements
EDR platform and Singularity Data Lake lack integration demonstrated by other vendors
Additional detection surfaces not treated as equal citizens to endpoint in interface
Limited incident management with no capability to assign alerts to analysts
No built-in native sandboxing
XDR appears as separate tab in notes section rather than fully integrated

Trend Micro - Strong Performers

Pros:

Long history as security vendor with products that continue to evolve to meet customer needs
Plethora of relevant endpoint data for detection and investigation
Variety of additional detection surfaces including cloud, email, identity, and network
Incident management enables collaboration akin to chat feature
Remote shell with preconfigured commands for simplified access
Can build automation playbooks to improve workflows for investigation and response
Comprehensive analyst experience prioritizing analyst workflow with relevant context and visual differentiation
Flexible pricing with purchase by SKU or credit system for feature exploration without long-term lock-in
Commitment to community including regional executive meetups

Cons:

Lower percentage of revenue allocated to R&D compared to peers
Falls short on forensics capabilities (provided through monetary credit)
Roadmap needs to address workflows, third-party ecosystem, and identity/multicloud context
Instructor-led training available only for a fee

Cisco - Contenders

Pros:

Contextualization for alerts with built-in threat activity tree
Normalizes, manages, and abstracts away EDR inputs, simplifying incident response
Single action response across different EDR providers
Supports multiple native and third-party detection surfaces
Better support service-level agreements (SLAs) than others in evaluation
Simple pricing model based on per-user model

Cons:

Doesn't enable users to generate detections, limiting actionability
EDR treated independently from XDR, casting doubts on detection quality
Reference customers note need to improve tuning
Sandboxing delivered via separate tool (Secure Malware Analytics)
Forensics and remote shell through another separate tool (Orbital)
IOC-based querying lacks depth of others in evaluation
Roadmap missing critical updates for detection, investigation, and response
Splunk acquisition expected to complement XDR despite customer concerns

Sophos - Contenders

Pros:

Integrated native detection surfaces including ZTNA, workload protection, firewall, email, and cloud
Prioritizes and includes integration with Microsoft ecosystem plus other third-party endpoint protection and Google Workspace for no additional fee
Add-on integrations available for additional third-party tools across firewall, network, identity, and email
Remote shell capabilities built in
Querying available for integrated detection surfaces
Simple per-user pricing model
Vision aligns with core SMB market focus (limited staff organizations)

Cons:

Lacks native sandboxing
Difficult to maintain detection quality as third-party detection surfaces are added
Analyst experience falls short with typical process tree that becomes cumbersome at scale
Lacks in-depth contextualization and progressive disclosure
Limited enterprise scale capabilities
Declined to participate in full Forrester Wave evaluation process

Trellix - Contenders

Pros:

Plethora of log collectors for ingest from other sources
Customers use Helix as SIEM platform
Sandboxing, forensics capabilities, and remote shell in platform
Querying for threat hunting uses Trellix Query Language and enables user-generated rules
Investment in R&D on par with peers
Flexibility of SIEM platform

Cons:

Vision does not align to customer needs in short and long term
Generative AI not a good fit for stated autonomous security goals
Roadmap does not address gaps in existing platform, particularly EDR technology integration level
EDR purchased separately with telemetry and alerts incorporated like any other detection surface
Customers cite offering requires tuning
Cumbersome incident management requiring several clicks to open and access
Analyst experience lacks measures to ensure detection quality
Limited context in alerts and missing correlation capabilities
Per-user per-year pricing with additional fees for third-party data ingest and EDR capabilities
Two years spent combining FireEye and McAfee Enterprise into unified offerings

Broadcom - Challengers

Pros:

Remote shell capability built in
Carbon Black EDR history and market presence

Cons:

Uncertain future for customers due to acquisition history (VMware 2019, then Broadcom 2023)
Recent announcement of Enterprise Security Group business unit merging Symantec portfolio with Carbon Black EDR
Broadcom's Symantec acquisition history suggests potential for slowed innovation and price hikes
Tumultuous product strategy changes have hindered forward progress
Heavily EDR focused with limited XDR capabilities
Lacks correlation capabilities between endpoints
Limited incident management capabilities that are cumbersome to use
Response capabilities limited on per-endpoint basis
Stagnant design with archaic-looking process tree and popup views that crowd console
Declined to participate in full Forrester Wave evaluation process

Fortinet - Challengers

Pros:

Reference customers cite value of Fortinet Security Fabric
Some playbook capabilities available
100% channel focus

Cons:

FortiClient remains separate product from FortiEDR despite market consolidation
Product features fall short of stated vision for unified security operations platform
UX is most glaring gap yet relegated to last priority on roadmap
Below average revenue dedication to R&D by percentage
100% channel focus makes it difficult for customers to forecast costs
To enable Security Fabric, must purchase FortiAnalyzer separately
Traditional endpoint protection features (host firewall, disk encryption) missing
Largely table-driven UI with alerts separated into three busy views on one screen
Incident management requires multiple clicks and doesn't allow analyst assignment
Sandboxing gives limited information and forensics capabilities not demonstrated
Playbook capabilities more limited and cumbersome than others in evaluation
Remains host focused with events organized by machine
Roadmap focused on AI features but missing critical UX improvements

FAQs

Q: Which vendors are Leaders in 2024?

A: CrowdStrike, Microsoft, Palo Alto Networks

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in Forrester Wave evaluations demonstrate the strongest current offering and strategy in the market. They have reached a point of integration and product capability where customers can start to realize their vision. In this XDR evaluation, Leaders prioritize endpoint expertise and visualization, target additional detection surfaces that provide effective investigation, and have a vision backed by actionable roadmap steps and adequate investment to achieve their stated goals.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Extended Detection and Response Platforms in 2024

Extended Detection and Response Platforms Vendor Product Comparisons 2024

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2024?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference