Spotlight

Report:

The Forrester Wave™: Managed Detection And Response Services In Europe, Q4 2023

How does Forrester define the Managed Detection and Response Services in Europe market in 2023?

European organizations from finance to manufacturing have shown increased interest in purchasing managed detection and response (MDR) services, with security and risk professionals demonstrating willingness to allow vendors to take more unsupervised/automated response actions. Leading providers evaluate alerts and incidents holistically rather than as isolated events, use analytics to form hypotheses and inform threat hunts supported by automation, and have implemented technical controls and service delivery capabilities across Europe to satisfy local data privacy and sovereignty requirements. The evaluation assessed eight significant MDR providers in Europe using 22 criteria.

Key Facts for The Forrester Wave™: Managed Detection And Response Services In Europe, Q4 2023 in 2023

How did the Managed Detection and Response Services in Europe market evolve in 2023?

What product features are required to be included in this year's evaluation?

What are the common features of top products in the Managed Detection and Response Services in Europe space?

No common features specified.

Scope Exclusions

Inclusion Criteria

Vendors must, among other requirements:

Offering Strengths — Relative Weighting

Strategy Strength — Relative Weighting

FAQs

Q: What does this research cover?

A: This research covers a comprehensive evaluation of eight major MDR service providers operating in Europe, assessed across 22 criteria including investigative capabilities, threat hunting, response capabilities, case management, analytics, pricing, innovation, and global delivery strategy. The evaluation focuses specifically on providers serving the EU member states, EEA, UK, and Switzerland markets.

Q: Who should use this research?

A: Security and risk professionals in Europe should use this research when selecting an MDR service provider. It helps identify providers that can mature security programs, demonstrate offensive security and threat hunting capabilities, and contribute meaningfully to the cybersecurity ecosystem. The research is particularly valuable for organizations looking to understand vendor strengths and weaknesses across detection, response, and investigation capabilities.

Q: What are the mandatory features of vendors included in this market?

A: Vendors must have EDR (Endpoint Detection and Response), threat hunting capabilities, and any two additional capabilities from core business scenarios as defined in the MDR Services Landscape report. Additionally, providers offering insider threat management must have analytics and threat detection as a core focus. All vendors must have at least $20 million in annual MDR services revenue in Europe and demonstrate sufficient Forrester mindshare.

Q: What are some reasons for not being included in this report?

A:

  • Annual MDR services revenue below $20 million in the European market
  • Missing core service delivery capabilities (EDR, threat hunting, or two core business scenario capabilities)
  • Insufficient Forrester mindshare or client relevance
  • For insider threat management providers: lack of analytics and threat detection as core focus
  • Declined to participate in the evaluation process
  • Only partial participation in the evaluation process

Q: What should buyers consider when evaluating products in this market?

A:

  • Use their insights to mature your security program and stop the bleeding - look for providers that understand your industry, peers, and unique business processes in recovery and improvement efforts
  • Demonstrate offensive security and threat hunting capabilities - providers should show understanding of threat actor techniques and motives with human-led threat hunts, reasonable hypotheses, understanding of evasion techniques, and testing of detection methods
  • Contribute to the ecosystem beyond press releases and recycled LinkedIn posts - prioritize providers with tangible outputs like CVEs, open-source contributions, and expertise-sharing blog posts demonstrating commitment to industry collaboration

Q: How has the Managed Detection and Response Services in Europe market evolved in 2023?

A:

  • Increased demand for MDR services from European organizations across industries
  • Growing willingness to allow unsupervised/automated response actions
  • Shift from isolated event evaluation to holistic picture building
  • Advanced analytics used to form hypotheses and inform threat hunts supported by automation
  • Implementation of technical controls and service delivery capabilities to address European data privacy and sovereignty concerns
  • Need to move beyond marketing buzzwords to solve specific user challenges
  • Emphasis on using insights to mature security programs beyond incident response
  • Importance of offensive security and human-led threat hunting capabilities
  • Value of tangible ecosystem contributions (CVEs, open-source contributions, expertise sharing)

Q: What differentiates Strength of Offering vs. Strength of Strategy?

A: Current Offering evaluates each vendor's position on the vertical axis and indicates the strength of their current service capabilities including time to value, threat hunting, threat intelligence, case management, analyst experience, analytics, XDR, managed detection/investigations/response, dashboards, scripting, security, and platform capabilities. Strategy evaluates placement on the horizontal axis and indicates the strength of vendors' strategic direction including their vision, innovation, partner ecosystem, pricing flexibility and transparency, talent strategy, and global delivery strategy.

Reference

View Leaders
View Vendor Movements