The Forrester Wave™: Managed Detection And Response, Q2 2023

Managed Detection and Response Vendor Product Comparisons 2023

Key features and pros and cons of top Managed Detection and Response products:

CrowdStrike - Leaders

Pros:

Extensive view of threat landscape and incident response services give advantage in threat intelligence and managed detection
Innovative approach to service delivery includes eliminating tiered SOC model, reducing likelihood of varying customer experiences
Superior threat intelligence
Extensive knowledge of threat actor behavior

Cons:

Limited API access
Depends on integrations for technologies outside the Falcon ecosystem
Gaps in cloud capabilities

Expel - Leaders

Pros:

Customer-obsessed service that delights practitioners
Simple onboarding process with deployment within hours
Platform designed to help customers make better decisions and improve operational workflows
Flawless roadmap execution
Consistent delivery of feature enhancements as promised
Consistent service delivery experiences

Cons:

One of the more expensive providers
Competitors embraced channel ecosystem long before Expel, provider faces competition catching up
Competitors go to market with bigger budgets and more reach

Red Canary - Leaders

Pros:

Superior threat-hunting and detection engineering capabilities
Expertise in making threat intelligence useful and driving detection-engineering efforts via threat hunting
Goes well beyond limits of what customer-supported technologies can detect
Superior detection library and high-fidelity detections
Vision includes offering comprehensive adversary profiles and tools like atomic red team to help customers prepare for incidents

Cons:

Needs to catch up on helping customers understand what changes to make to improve overall security posture
Less well-known in the market despite strong service delivery capabilities

Arctic Wolf - Strong Performers

Pros:

High-touch service delivery and concierge security team
Early entrant into MDR and pioneer of high-touch service delivery
Activates customers reasonably quickly creating quick time to value
Performs thorough threat hunts
Lightweight EDR agent
Strong threat intelligence

Cons:

Platform does not meaningfully differentiate from competitors
Struggles with analyst experience and case management
Portfolio sprawl risks progress with cluttered roadmap trying to satisfy non-MDR use cases like vulnerability management
Case management and resolution of issues are areas of weakness

Binary Defense - Strong Performers

Pros:

Strong technical expertise and practitioner-focused service
Rapid time to value
Threat-hunting expertise
Scripting engine built into platform enables customers to use Jupyter notebooks to interact with their data
Strong threat hunting
Detection reliability

Cons:

Platform needs work
Falls short in metrics and reporting
Metrics and event notification gaps

Rapid7 - Strong Performers

Pros:

Comprehensive amount of threat hunts performed
Comprehensive number of hypotheses and techniques used for threat hunting
Detailed forensics during investigative process to assist customers and accelerate incident response
Responsive personnel
Proactive alerts

Cons:

Future vision needs work and roadmap is unremarkable compared to past
Slow integrations
Limited support for other security tools

Secureworks - Strong Performers

Pros:

Service and platform shine
Recognizes time to value can make or break MDR relationship
Builds RACI matrix for customers explaining ownership of activities for service setup
Multiple decades delivering security services
Simple and transparent onboarding process

Cons:

Has yet to prove relevance in channel
Competitors have head start and longer history supporting channel programs
Uncertain whether provider will stay committed to channel after macroeconomic challenges end
Dashboards and reporting not as comprehensive as others
Some interface fields not available as customizable options when creating reports

SentinelOne - Strong Performers

Pros:

Storyline Active Response (STAR) and agent's ability to autonomously gather artifacts and incident-relevant activity
Moved early to channel which will benefit as other providers make same shift
Integrates acquisitions into service quickly
Ease of management of the agent
Overall product effectiveness
Excellent MSSP relationships

Cons:

Service delivery has fallen behind as provider added portfolio and product features
Planned enhancements to service have fallen behind
Need for stronger user community
Acquisitions have lower overall feature maturity level

eSentire - Strong Performers

Pros:

Understands customer base exceptionally well
Mixes business-relevant messaging with technical explanations
Offers comprehensive response actions without making automation mandatory
Interacts with customer environments like their own
History of delivering wide service portfolio

Cons:

Needs to make service delivery and platform as relevant as messaging
Dated interface that stands out negatively compared to competitors
Lacks own intellectual property giving competitors sizable head start
Dashboards, reporting, and current user interface are areas of weakness

BlueVoyant - Contenders

Pros:

Excels at Microsoft Sentinel
Innovates in focus on supply chain and third-party risk services
Stands out in generating and curating threat intelligence
Focus on case management shines compared to other providers
Responsiveness and processes

Cons:

Lags in pure-play MDR capabilities
Planned enhancements for pure-play MDR service seem to be lower priority
Dashboarding, identity-based investigations, and cloud visibility are weaknesses

Deepwatch - Contenders

Pros:

Masters Splunk as a platform
Emphasizes system criticality as important aspect of detection
Threat Probability Value (TPV) brings valuable context during detection, triage, investigation, and response
Overall approach to service delivery and integration with customer teams
Strong Splunk capabilities

Cons:

Non-Splunk capabilities don't match what it can do when SIEM solution is present
Service delivery features aspects of MDR and SOCaaS but leans more toward SOCaaS
Inconsistent service delivery
Overly generic threat intelligence

ReliaQuest - Contenders

Pros:

GreyMatter platform is far better as SOC platform
Recognized that interacting with federated data via APIs worked better than data ingest
Acquisition of Digital Shadows augmented threat intelligence capabilities
Feature-rich platform in MDR space
Platform and continuous innovation

Cons:

Inconsistent service delivery holds it back
Service delivery doesn't match quality of platform
Built business on direct sales model in large enterprise, now pivoting to channel which is not easy
Tuning rules, reporting, and speed of response are areas of weakness

IBM - Challengers

Pros:

Broad service portfolio
Global thought leadership
Established provider with global reach

Cons:

MDR offering falls short of others
Jumbled set of capabilities spanning multiple offerings
Siloed nature of technologies and service delivery
Fails to stand out in any specific aspect of MDR
Expertise gaps with service delivery personnel
Inconsistent communication
Unclear if acquisitions will coalesce as backbone of quality service

FAQs

Q: Which vendors are Leaders in 2023?

A: CrowdStrike, Expel, Red Canary

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave for Managed Detection and Response maintain exceptionally high rates of customer satisfaction, retain existing customers at unprecedented levels, and have growth rates that any maturing companies and startups would envy. Leaders deliver a stable of services that provide superior detection, comprehensive investigations, thorough response, and extraordinary customer engagement. They demonstrate commitment to customer obsession in a market with more competition, savvy buyers, budget constraints, and shareholder expectations.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Managed Detection and Response in 2023

Managed Detection and Response Vendor Product Comparisons 2023

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2023?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference