Report:
The Forrester Wave™: Extended Detection And Response Platforms, Q2 2024
How does Forrester define the Extended Detection and Response Platforms market in 2024?
XDR vendors have reached a tipping point where they can start to realize the SIEM replacement vision, even if XDR still can't compete for more niche SIEM use cases such as compliance, federated search, and heavy customization. In 2021, XDR vendors had offerings that were a jumble of features with a vision to replace SIEM. Now, many vendors have reached a point of integration and product capability where customers can realize this vision. Recent SIEM market upheaval creates an opportunity for XDR vendors to show customers what a new approach might look like. This evaluation assessed 11 providers using 22 criteria across current offering, strategy, and market presence.
Key Facts for The Forrester Wave™: Extended Detection And Response Platforms, Q2 2024 in 2024
- Publication Date: 02-Jun-2024
- Document ID:
- Summary: In our 22-criterion evaluation of extended detection and response platforms providers, we identified the most significant ones and researched, analyzed, and scored them. This report shows how each provider measures up and helps security professionals select the right one for their needs.
- Authors: Allie Mellen, Joseph Blankenship, Sarah Morana, Michael Belden
How did the Extended Detection and Response Platforms market evolve in 2024?
- XDR vendors have reached a tipping point to compete with SIEM as the principal technology in security operations centers
- Many vendors have achieved integration and product capability where customers can start to realize the SIEM replacement vision
- XDR still can't compete for niche SIEM use cases such as compliance, federated search, and heavy customization
- Recent SIEM market upheaval presents an opportunity for XDR vendors to show customers a new approach
- Vendors mentioned AI in vision, innovation, and roadmap criteria responses over 75 times across 11 participating vendors
- The evaluation assessed 11 providers using 22 criteria across current offering, strategy, and market presence
- Vendor categories include Leaders, Strong Performers, Contenders, and Challengers
What product features are required to be included in this year's evaluation?
- Basis in EDR. The offering is a cloud product that supports multitenancy and has a basis in EDR.
- Product focus. The vendor delivers the offering primarily as a product, as opposed to a managed service like MDR.
- Geographic focus. The vendor has a geographic focus on North America greater than 15%, with additional focus on other regions including EMEA or APAC.
- Forrester mindshare. To ensure relevance to Forrester clients and the quality of the references being provided, Forrester considers the level of interest from our clients based on inquiries, advisories, consulting engagements, and other interactions.
What are the common features of top products in the Extended Detection and Response Platforms space?
No common features specified.
Scope Exclusions
- Managed services like MDR - vendors must deliver offerings primarily as products
- On-premises only solutions - offerings must be cloud products supporting multitenancy
- Solutions without EDR foundation - basis in endpoint detection and response is required
- Vendors with less than 15% North America geographic focus
- Vendors with insufficient Forrester client mindshare
- Niche SIEM use cases such as compliance, federated search, and heavy customization
Inclusion Criteria
Vendors must, among other requirements:
- Basis in EDR - The offering is a cloud product that supports multitenancy and has a basis in EDR
- Product focus - The vendor delivers the offering primarily as a product, as opposed to a managed service like MDR
- Geographic focus - The vendor has a geographic focus on North America greater than 15%, with additional focus on other regions including EMEA or APAC
- Forrester mindshare - To ensure relevance to Forrester clients and the quality of the references being provided, Forrester considers the level of interest from our clients based on inquiries, advisories, consulting engagements, and other interactions
Offering Strengths — Relative Weighting
- Native detection surface: endpoint — 10%
- Additional detection surfaces — 10%
- Incident management — 8%
- Investigation — 5%
- Response — 10%
- Threat hunting — 10%
- Administrative controls — 5%
- Endpoint protection — 5%
- Analyst experience — 5%
- Artificial intelligence and machine learning — 5%
- Deployment model — 5%
- Customer support — 7%
- Training — 10%
- Product security — 5%
Strategy Strength — Relative Weighting
- Vision — 20%
- Innovation — 20%
- Roadmap — 20%
- Partner ecosystem — 15%
- Pricing flexibility and transparency — 10%
- Community — 15%
FAQs
Q: What does this research cover?
A: This research covers a 22-criterion evaluation of the most significant extended detection and response (XDR) platform providers. It evaluates vendors across current offering capabilities, strategy (including vision, innovation, and roadmap), and market presence. The report analyzes how XDR vendors are evolving to compete with SIEM solutions and provides detailed vendor profiles showing strengths and weaknesses of 11 participating providers.
Q: Who should use this research?
A: Security professionals evaluating XDR platforms should use this research to understand vendor positioning and select the right provider for their needs. The report is particularly valuable for organizations considering SIEM replacement or consolidation, those looking to improve detection and response capabilities across multiple surfaces (endpoint, identity, email, network, cloud), and teams seeking to understand how vendors differentiate on endpoint expertise, integration quality, analyst experience, and AI/automation capabilities.
Q: What are the mandatory features of vendors included in this market?
A: All vendors included must have: 1) A cloud-based XDR product with multitenancy that has its basis in EDR capabilities, 2) Primary product delivery model rather than managed service (MDR), 3) Geographic presence in North America of at least 15% with additional coverage in EMEA or APAC, and 4) Sufficient Forrester client mindshare demonstrated through inquiries, advisories, consulting engagements and other interactions.
Q: What are some reasons for not being included in this report?
A:
- Vendors delivering primarily managed services (MDR) rather than product offerings
- Solutions that are on-premises only or do not support cloud multitenancy
- Platforms without a foundation in endpoint detection and response (EDR)
- Vendors with North America presence below 15% threshold
- Vendors lacking sufficient Forrester client engagement and mindshare
- Vendors that declined to participate in the full evaluation process
- Vendors that only partially participated in the evaluation process
Q: What should buyers consider when evaluating products in this market?
A:
- Prioritize endpoint expertise and visualization - Vendors that continue to prioritize endpoint expertise with accurate, timely detections and better investigative workflows with endpoint context provide value in the face of increasing data volumes
- Target additional detection surfaces that provide more effective investigation - Vendors that limit additional detection surfaces to those most valuable (endpoint, identity, email) and treat that telemetry as useful in visualizations provide better analyst experience
- Treat vision, innovation, and roadmap as intertwined and symbiotic - Look for vendors with realistic roadmaps and adequate investment to achieve their stated vision, not just AI buzzwords without execution plans
Q: How has the Extended Detection and Response Platforms market evolved in 2024?
A:
- XDR vendors transitioning from endpoint-focused solutions to compete with SIEM as the principal SOC technology
- Increasing focus on endpoint expertise and visualization as data volumes grow
- Challenge of maintaining detection quality when integrating third-party telemetry sources
- Data normalization and prioritization becoming critical as vendors add detection surfaces
- Proliferation of AI mentions in vendor responses (over 75 times across vision, innovation, and roadmap)
- Need for realistic roadmaps backed by adequate investment to achieve AI and autonomous SOC visions
- SIEM market upheaval creating opportunities for XDR vendors to demonstrate alternative approaches
- Shift toward targeting specific high-value detection surfaces (endpoint, identity, email) rather than comprehensive coverage
Q: What differentiates Strength of Offering vs. Strength of Strategy?
A: Current Offering (vertical axis) measures the strength of a vendor's existing XDR platform capabilities across 14 criteria including detection surfaces, incident management, investigation, response, threat hunting, and analyst experience. It focuses on what the product can do today. Strategy (horizontal axis) measures forward-looking elements across 6 criteria including vision for market evolution, innovation investment, product roadmap, partner ecosystem, pricing models, and community engagement. It assesses where the vendor is headed and their ability to execute on future market needs.
Reference
- Forrester, The Forrester Wave™: Extended Detection And Response Platforms, Q2 2024, 02-Jun-2024, ID
View Leaders
View Vendor Movements
