Report:

The Forrester Wave™: Managed Detection And Response Services In Europe, Q4 2023

Top Vendor Products for Managed Detection and Response Services in Europe in 2023

• CrowdStrike
• Secureworks

Managed Detection and Response Services in Europe Vendor Product Comparisons 2023

• CrowdStrike - Leaders
  

  Pros:

  • Stellar MDR offering backed by advanced XDR capabilities and commitment to cybersecurity research
  • Deep expertise in threat intelligence and incident response with focus on robust telemetry and rapid analysis
  • Well-defined and repeatable onboarding process enabling customers to see value quickly
  • Strong communication during crisis with frequent, clear, concise, and contextual customer updates
  • Process repeatability, concrete recommendations, and follow-ups
  • Understanding of European data protection sensitivities with EU and UK hosting locations

  Cons:

  • Primary service delivery language is English only, which may be a dealbreaker for some European clients due to the region's multilingual nature
  • Limited integration capabilities, which has been an issue for long enough that it may not be an oversight


• Secureworks - Leaders
  

  Pros:

  • Quick time to value with speedy response defining cloud and OT capabilities
  • Simple pricing structure and speedy onboarding process
  • Cutting-edge threat hunting capabilities with commitment to talent
  • Robust threat intelligence and telemetry with analytics capabilities to make sense of data
  • Growing number of integrations with popular communication tools like Teams and Slack
  • Easy-to-use analyst dashboard providing useful contextual information to aid triage efforts
  • Support quality, response times, and frequent improvements and updates

  Cons:

  • Later to partner-first model than peers who have been in the market with it for longer
  • Hasty feature releases
  • Paucity of integrations


• Accenture - Strong Performers
  

  Pros:

  • Robust global delivery capabilities enabling wide range of services across Europe efficiently and effectively
  • Established MDR brand bringing consulting experience to clients
  • Strong cyber defense capabilities with several EU delivery options
  • Streamlined, repeatable approach to investigations leveraging threat intelligence
  • Process repeatability and professionalism

  Cons:

  • Hasn't demonstrated significant innovations in investigative and response capabilities
  • Threat hunts driven by automation without enough human-led component
  • Integrating non-ingested data needs improvements - significant weakness in the service
  • Telemetry beyond the SIEM isn't analyzed by default and requires ad hoc solutions development
  • Lack of 'outside-the-box thinking'


• eSentire - Strong Performers
  

  Pros:

  • Differentiates with detection capabilities enabled by robust threat intelligence
  • Quickly operationalizes threat intelligence to inform threat hunts and define new IOCs
  • Strong focus on diverse telemetry sources and speedy response process delivering value quickly
  • Pragmatic approach to partnerships with broad ecosystem including competition
  • Significant investments in machine learning and automation as tools to enable human-led threat hunting
  • Deep technical capabilities and clear strategic direction
  • Clear messaging and handholding during an incident

  Cons:

  • Overly confusing and complex pricing structure
  • Analyst dashboard/UI is difficult to use and delivers clumsy analyst experience - in process of needed UI/UX refresh
  • Analysts need external tools to decode common encoding formats which should be built in
  • Reduced responsiveness in recent times
  • Limited Azure integrations


• Sophos - Strong Performers
  

  Pros:

  • Good understanding of the SME market with easy-to-understand pricing structure
  • Draws on EDR capabilities and MSS experience to deliver no-frills solution that can be rapidly expanded
  • Strong channel strategy with deliberate strategic partnerships
  • Clear regional delivery model giving clients flexibility regarding where and when of service delivery
  • Responsive team

  Cons:

  • No clear opportunities for analysts to acquire skills outside their primary role
  • Training skewed toward depth - analysts may lack broader view required for more advanced customers
  • Yet to demonstrate unique security research and insights in innovation
  • Capability enhancements mostly driven by mergers and acquisitions
  • Interface complexity


• Kudelski Security - Contenders
  

  Pros:

  • Broad capabilities reflecting managed security experience
  • Consultative process to MDR prioritizing understanding over speed
  • Customer experience at center of MDR service with seamless customer journey
  • Simplicity and flexibility underpin pricing and delivery strategy
  • Practical case management and collaboration approach focused on adapting to customer and reducing friction
  • Clean, no-frills UI highlighting most relevant information
  • Team's broad technical capabilities

  Cons:

  • Needs to be bolder with innovation to keep up with nimbler peers
  • Threat hunting and investigative efforts geared toward identifying emerging or known threat activity, less likely to identify novel techniques
  • Reporting tools need improvement - lacks context and information richness for effective case management
  • Reporting focuses on basic trends analysis and JPEG exports
  • Detection engineering capabilities need improvement
  • Limited customization options


• NCC Group - Contenders
  

  Pros:

  • Strong detection capabilities and predictable service
  • Excellent customer relations reflecting dedication to client satisfaction and engagement
  • Significant traction in European market with expanded partner ecosystem
  • Offensive security lens to approach service delivery with deep understanding of threat actor methods
  • Invests in talent with well-rounded and efficient team
  • Analysts benefit from mentorship, cross training, and purple teaming opportunities
  • Strong local presence
  • Adaptive team
  • Interoperability

  Cons:

  • Response and mitigation efforts below par - centered around containment with forensics not a staple
  • Effective emergency response but not deliberate about working with customer beyond initial gap closure
  • Hasn't demonstrated using insights from resolved incidents to increase customer's overall maturity
  • Pricing depends on variables like 'onboarding effort' and can be confusing
  • Lukewarm threat hunting capabilities
  • Inflexible service offering


• WithSecure - Challengers
  

  Pros:

  • Understands European market and value of Europe-only offering
  • Leverages multiple geo-isolation models (storage, operation, or complete)
  • Investigation process gives client rich and information-filled picture
  • Uniform, stable rollout approach
  • Service orientation

  Cons:

  • Lacks emergency onboarding options that most peers offer
  • Response process needs improvement
  • Some forensics carried out during active incident but hasn't demonstrated continuation once fire is put out
  • Threat intelligence efforts skewed toward identifying known threat activity - intelligence gathering for novel threats needs improvements
  • Reporting simplified - more mature clients will find this wanting as dashboard isn't configurable
  • API features rudimentary with no access to extensible scripting engine
  • Roadmap will deliver features allowing catch-up with everyone else
  • UI needs improvement

Reference

• Forrester, The Forrester Wave™: Managed Detection And Response Services In Europe, Q4 2023, 03-Dec-2023, ID RES179851

View Market Definition
View Vendor Movements