The Forrester Wave™: Managed Detection And Response Services, Q1 2025

Managed Detection And Response Services Vendor Product Comparisons 2025

Key features and pros and cons of top Managed Detection And Response Services products:

CrowdStrike - Leaders

Pros:

Product- and platform-focused strategy that aligns well with customer needs and is poised to remain ahead of others in the cybersecurity industry
Successful bundling continues with Falcon Flex debut in 2024, allowing pricing and licensing flexibility that pure-play services competitors lack
Stands out in ability to detect across endpoint, extended, and identity detection surfaces
Excels at managed investigations and threat hunting - knows how to detect, investigate, and find adversaries well before they want to be discovered
Analyst experience continues to improve as provider uses internal service delivery personnel as feedback loop to improve products
Customers praise underlying quality and effectiveness of the Falcon Platform
Customers feel they always talk to an experienced practitioner when working with the Falcon Complete Next-Gen MDR team

Cons:

Falls short of some others in community engagement outside of its own blogs, webinars, and events

Expel - Leaders

Pros:

Strategy successfully strikes a balance between human delivery and software-enabled platforms that few in the cybersecurity market can replicate
Vision is to make its 1,000th customer feel like its first customer
Rapid onboarding and unmatched transparency for customers
Plans to expand access to customer data wherever it's stored
Detection across extended detection, cloud, and identity are areas of strength
Strong analyst experience
Offers customers flexibility and differentiates with comprehensive asset tagging in Workbench that can alter severity and alert workflows
Customers mention intimate knowledge of their environment, strong analyst experience, and competency of service delivery personnel
Advertises mean time to remediation of 20 minutes

Cons:

Remains one of the most expensive MDR providers but has made reductions in pricing and enhanced its packaging to bring it more in line with the rest of the market

Red Canary - Leaders

Pros:

Predicted early on the need to couple strong threat intelligence with detection-as-code detection-engineering philosophy to scale
Excels at detection as code and detection-engineering processes with mature lifecycle that results in novel detections minimizing noise and maximizing clarity
Stands out in endpoint, extended detection, managed response, and threat hunting
Service is flexible, adaptable, and tuned to the needs of customers, no matter how specialized or unique
Strong commitment to the cybersecurity community with contributions like Atomic Red Team and sizable presence on conference circuit
Customers praise responsiveness, pace of innovation, and platform flexibility
Customers mention high-fidelity nature of detections and response actions
Deep pedigree in threat intelligence as part of MDR offering

Cons:

Playing catch-up in other strategic areas with roadmap focused on expanding extended detection capabilities and making necessary improvements in partner ecosystem

Binary Defense - Strong Performers

Pros:

Strategy places huge emphasis on contributing to and using information from the broader cybersecurity community
Engages with community more actively and effectively than most other providers through open-source projects, blogs, and conference circuit
Use of managed deception capabilities on endpoint agent and patent-pending feature for malware disruption showcase clear understanding of where defenders can gain advantage
Uses open XDR approach to data ingest for SIEM compatibility, giving solid basis for interoperability with customer SIEM and security analytics platforms
Stands out when pairing in-house-developed endpoint detection and prevention technology with other EDR and EPP with no performance impact
Customers stress responsiveness to changing needs, adaptability, and ability to detect threats early
Deep understanding of how attackers operate to inform detection, investigation, and response approach

Cons:

Doesn't have the depth or breadth in partner ecosystem that others evaluated, preferring to work with smaller set of partners with tighter relationships
Behind on generative AI capabilities

eSentire - Strong Performers

Pros:

Robust partner ecosystem that satisfies needs of partners without sacrificing customers it delivers for
Shines with one of the broadest portfolios of available integrations in the MDR market
Managed response and security posture management are standout areas ahead of competitors
Security posture management includes initial posture assessment, ongoing continuous assessments, prioritized recommendations, and dashboards providing pragmatic path to improvement
Understands challenges that target customers (mostly midmarket organizations) face: defending against sophisticated adversaries with limited budgets and minimal security personnel
Customers stress thorough understanding of the challenges their company faces and focus on improving overall security posture

Cons:

Innovation and roadmap lag behind competitors with expected expansion of endpoint features, log ingest, automation, and asset management
Current analyst experience leaves something to be desired
Vision, pricing flexibility and community engagement are on par with rest of market

ReliaQuest - Strong Performers

Pros:

Sees where security operations needs to go next and is ahead of others in the market with strong strategy and vision
Plan to eliminate drudgery from tasks of security analysts
Continues to expand GreyMatter as platform to incorporate additional services like exposure management and asset management
Shines most in how it has added AI (generative and agentic) capabilities into GreyMatter to improve analyst experience and empower SOC analysts
Use of AI-prompted response actions based on customer behavior and incident details allows customers to perform on-the-fly calls without requiring previously built workflow
Customers stress ability to rapidly deploy GreyMatter, transition planning during migrations, and ability to work with internal personnel
GreyMatter normalizes data from security tools, provides threat detection, stitches data together from various log sources, and supports bidirectional integrations

Cons:

Current offering weaknesses include system criticality and vulnerability prioritization along with security posture management

Arctic Wolf - Contenders

Pros:

True highlight is expansive partner ecosystem in 100% channel model with ecosystem of 1,800 partners spanning alliances, insurers, MSPs, and OEMs
Stands apart from competitors in system criticality and vulnerability prioritization and posture management
Concierge Security Team approach provides real distinction with dedicated security advisor sharing tailored security guidance
Detection, investigation, and response capabilities largely on par with others evaluated
Customers state value of concierge security advisor was unparalleled and something they depended on
Customers praised provider's overall impact on their security posture

Cons:

Aggressive M&A strategy in recent years (Revelstoke for automation, Cylance for EDR and EPP) with vision, roadmap, and plans for innovation fallen behind other MDR competitors
Falls short in current deployment of generative AI, dashboards and reporting, and metrics available to customers
Some customers call Arctic Wolf's ability to work with more mature and sophisticated enterprises into question

Rapid7 - Contenders

Pros:

Longstanding contribution to open source deserves praise with Metasploit and Velociraptor as examples
Pricing flexibility is on par with rest of market
Can handle all phases of detection and response
Provides expected levels of flexibility in managed response and automation, system criticality and vulnerability prioritization, analyst experience, and dashboards and reporting
Customers indicated that Rapid7 felt like a true member of their team
Customers mentioned rapid release cycle for new features

Cons:

Innovation, partner ecosystem, and roadmap fall short
Plans include geographic expansion to open additional markets, additional services such as attack surface management, and enhancements to cloud detection and response
Fails to differentiate itself meaningfully in any single area
Lags competitors in detection surface (of all categories), detection engineering, and threat hunting
Releases and migrations are not always smooth, and provider lacks transparency when those things happened

Secureworks - Contenders

Pros:

On par with others evaluated in terms of partner ecosystem and pricing flexibility
On par in endpoint, identity, and cloud detection surfaces, managed investigations, detection engineering, integrations, threat hunting, and security posture management
Customers indicated that Secureworks is a true partner
Customers felt detection capabilities were strong compared to some other providers
Offers wide range of security services based on Taegis platform including ManagedXDR, vulnerability management (Taegis VDR), and incident response

Cons:

Has languished as it faced flat revenues, slowing growth, and hypercompetitive market
Unclear vision about where MDR will go
Roadmap includes things competitors have already launched like exposure management, generative AI, attack surface management, and incident readiness
Falls short of competitors in system criticality and vulnerability prioritization and analyst experience
Customers mention support falloff due to layoffs and impending anxiety about the Sophos takeover
Now enters next phase of journey as part of security vendor Sophos after years as publicly traded company

SentinelOne - Contenders

Pros:

Leverages broad partner ecosystem to go to market at global scale
Success in working with small to midsize MSPs and MSSPs stands out in the MDR market
Stands out with compelling analyst experience as Singularity tantalizes with flashy user experience
Delivers via patented Storyline technology that creates narrative timeline of events
Customers mention presence in the channel via MSP and MSSP partners as strong suit
Customers praise impressive user interface

Cons:

Roadmap, vision, and innovation plans leave it behind others evaluated
For all its promises of autonomous security operations, sells and delivers an MDR service staffed by human beings
Fails to deliver entirely autonomous security operations
Attempt to deliver autonomous operations makes it fall short in areas like managed investigation, detection engineering, and threat hunting where automation permits less customization and flexibility than other providers
Some organizations didn't like SentinelOne's reaction to the CrowdStrike outage, with some calling out the provider publicly for how it marketed off a crisis that end users were forced to deal with
Declined to participate in the full Forrester Wave evaluation process

FAQs

Q: Which vendors are Leaders in 2025?

A: CrowdStrike, Expel, Red Canary

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave demonstrate excellence in both current offering and strategy. They have strong detection, investigation, and response capabilities, differentiate through innovation such as detection-as-code engineering, and maintain a clear vision for the future of MDR services. Leaders balance human delivery with software-enabled platforms, provide superior customer experiences, and are ahead of the market in areas like security posture improvement and proactive defense. They receive outstanding or above-average customer feedback and are well-positioned to meet the evolving needs of enterprise customers.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Managed Detection And Response Services in 2025

Managed Detection And Response Services Vendor Product Comparisons 2025

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2025?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference