Spotlight

Report:

The Forrester Wave™: Managed Detection And Response, Q2 2023

How does Forrester define the Managed Detection and Response market in 2023?

Managed detection and response (MDR) brought disruption to the managed security services market over the last decade. As providers mature, they must maintain commitment to customer obsession while delivering superior detection, comprehensive investigations, thorough response, and extraordinary customer engagement. The market now features more competition, savvy buyers, budget constraints, and shareholder expectations. MDR providers maintain exceptionally high customer satisfaction rates, unprecedented retention levels, and enviable growth rates.

Key Facts for The Forrester Wave™: Managed Detection And Response, Q2 2023 in 2023

How did the Managed Detection and Response market evolve in 2023?

What product features are required to be included in this year's evaluation?

What are the common features of top products in the Managed Detection and Response space?

No common features specified.

Scope Exclusions

Inclusion Criteria

Vendors must, among other requirements:

Offering Strengths — Relative Weighting

Strategy Strength — Relative Weighting

FAQs

Q: What does this research cover?

A: This research covers a 23-criterion evaluation of 13 managed detection and response (MDR) providers. It evaluates providers across current offering capabilities (50% weighting), strategy (50% weighting), and market presence. Key evaluation areas include time to value, threat hunting, threat intelligence, case management, analyst experience, analytics, XDR, managed detection/investigations/response, dashboards, reporting, metrics, scripting engines, product security, and platform capabilities. The report identifies Leaders, Strong Performers, Contenders, and Challengers in the MDR market as of Q2 2023.

Q: Who should use this research?

A: This research should be used by security professionals and security leaders who are evaluating MDR providers for their organizations. It helps buyers understand how each provider measures up across critical capabilities and strategic positioning. The research is particularly valuable for organizations looking to select an MDR provider that performs actual response without requiring automation, conducts comprehensive threat hunting with clear success criteria, and supports data federation capabilities. Buyers can use the accompanying Excel-based vendor comparison tool to adapt criteria weightings to their specific needs and compare providers based on their unique requirements.

Q: What are the mandatory features of vendors included in this market?

A: To be included in this Forrester Wave evaluation, MDR providers must: 1) Have sufficient Forrester mindshare demonstrated through client inquiries, advisories, and consulting engagements; 2) Generate at least $20 million in MDR service revenue; 3) Offer core MDR capabilities including EDR, XDR, and SOAR with human-led, hypothesis-driven threat hunting as core use cases.

Q: What are some reasons for not being included in this report?

A:

  • Insufficient service revenue (less than $20 million in MDR revenue)
  • Lack of core service delivery capabilities (missing EDR, XDR, or SOAR capabilities)
  • Absence of human-led, hypothesis-driven threat hunting
  • Insufficient Forrester mindshare or client interest
  • Services do not meet completeness-of-offering criteria (e.g., Microsoft)
  • Vendor declined to participate or contributed only partially to the evaluation

Q: What should buyers consider when evaluating products in this market?

A:

  • Perform actual response without requiring automation - some providers now require automation for any vendor-performed response action
  • Conduct threat hunts with clear success criteria across a wide range of data sources using systematic, formal methodology
  • Expect data ingest but request data federation - ability to interact with data without needing to ingest it
  • Evaluate provider's commitment to customer obsession and service quality as they scale
  • Consider provider's roadmap and vision for future capabilities
  • Assess channel ecosystem and partner relationships if relevant to your organization

Q: How has the Managed Detection and Response market evolved in 2023?

A:

  • MDR providers entering next stage of maturity, scaling from hundreds to thousands of customers
  • Shift from requiring automation for vendor-performed response actions
  • Evolution toward human-led, hypothesis-driven threat hunting with clear success criteria
  • Innovation in data federation - interacting with data without ingesting it
  • Channel-first go-to-market strategies becoming dominant
  • Integration of threat intelligence into meaningful detections
  • Comprehensive customer engagement and service delivery models

Q: What differentiates Strength of Offering vs. Strength of Strategy?

A: Current Offering (vertical axis) evaluates the strength of each vendor's current MDR service capabilities including technical features like threat hunting, analytics, detection, investigation, response, and platform capabilities. Strategy (horizontal axis) evaluates forward-looking elements including product vision, market approach, adoption rates, planned enhancements, partner ecosystem development, and commercial model sustainability.

Reference

View Leaders
View Vendor Movements