Spotlight

Report:

The Forrester Wave™: Managed Detection And Response Services, Q1 2025

How does Forrester define the Managed Detection And Response Services market in 2025?

MDR is an established market that helps security leaders and their teams detect, investigate, respond, and recover from attacks ranging from commoditized malware to sophisticated nation-state techniques. The market is evolving beyond reactive detection and response - providers must now become proactive partners that positively influence customer security posture. Key differentiators include detection engineering via detection as code, security posture improvement capabilities, and effective deployment of generative AI that benefits customers, not just provider efficiency.

Key Facts for The Forrester Wave™: Managed Detection And Response Services, Q1 2025 in 2025

How did the Managed Detection And Response Services market evolve in 2025?

What product features are required to be included in this year's evaluation?

What are the common features of top products in the Managed Detection And Response Services space?

No common features specified.

Scope Exclusions

Inclusion Criteria

Vendors must, among other requirements:

Offering Strengths — Relative Weighting

Strategy Strength — Relative Weighting

FAQs

Q: What does this research cover?

A: This research evaluates 10 MDR providers across current offering capabilities, strategy, and customer feedback. The evaluation focuses on detection engineering, security posture management, and the impact of generative AI on service delivery. Providers are assessed on their ability to detect across endpoint, extended detection, cloud, and identity surfaces, as well as their investigation, response, and threat hunting capabilities.

Q: Who should use this research?

A: Prospective MDR customers should use this evaluation to inform purchase decisions, particularly considering: 1) Providers that scale through detection-as-code engineering, 2) The importance of security posture improvement alongside detection and response, and 3) How generative AI delivers customer-facing improvements versus just provider efficiency gains. Security leaders and their teams seeking to select the right MDR provider for their specific needs should leverage this research.

Q: What are the mandatory features of vendors included in this market?

A: Vendors must offer comprehensive MDR services including 24/7 monitoring, threat detection across multiple surfaces (endpoint, extended detection, cloud, identity), managed investigation capabilities, both manual and automated response actions, threat hunting, and detection engineering with emphasis on detection as code. Providers must demonstrate ability to serve enterprise clients globally across NA, EMEA, and APAC regions with at least $100 million in MDR service revenue.

Q: What are some reasons for not being included in this report?

A:

  • Insufficient MDR service revenue (less than $100 million)
  • Limited geographic reach - not serving enterprise clients across NA, EMEA, and APAC
  • Incomplete core MDR capabilities - missing detection, investigation, response, threat hunting, or investigations
  • Lack of detection engineering emphasis
  • Insufficient Forrester client mindshare and engagement
  • Declining to participate or only partially participating in the evaluation process
  • Primary focus on products rather than managed services
  • Limited to specific verticals or use cases rather than broad enterprise applicability

Q: What should buyers consider when evaluating products in this market?

A:

  • Evaluate providers' detection engineering maturity, specifically their implementation of detection as code with software-driven processes and unit testing
  • Assess the provider's ability to improve security posture proactively, not just reactively detect and respond to threats
  • Consider how the provider delivers contextual understanding based on your technology stack, industry, and region
  • Examine whether generative AI implementations provide tangible customer benefits beyond just provider efficiency gains
  • Look for providers that can close program gaps and provide actionable benchmarks for security program improvement
  • Evaluate the provider's ability to scale while maintaining service quality and customer intimacy
  • Consider pricing models and whether efficiency gains from AI and automation are passed along to customers
  • Assess the breadth and depth of detection surfaces covered (endpoint, extended detection, cloud, identity)

Q: How has the Managed Detection And Response Services market evolved in 2025?

A:

  • Detection as code is now the primary method for MDR providers to scale and stay ahead of adversaries, requiring software-driven processes with unit testing for rapid, accurate deployment
  • Security posture improvement has become as important as detection and response, with customers demanding proactive security program enhancement
  • Contextual understanding of customers' technology stack, industry, and region is essential for providing meaningful benchmarks and comparisons
  • Generative AI is improving provider efficiency and service delivery, but customer-facing benefits remain less clear
  • Agentic AI is emerging as the next evolution to improve MDR service effectiveness
  • MDR providers are expanding beyond monitoring and responding to actively closing program gaps and improving overall security effectiveness

Q: What differentiates Strength of Offering vs. Strength of Strategy?

A: Strength of Offering (vertical axis) evaluates each vendor's current MDR capabilities including detection across multiple surfaces (endpoint, extended, cloud, identity), investigation, response, detection engineering, threat hunting, integrations, AI implementation, analyst experience, and posture management. Strength of Strategy (horizontal axis) assesses vendors' future direction including vision for market evolution, innovation plans, product roadmap, partner ecosystem breadth, pricing models, and community engagement.

Reference

View Leaders
View Vendor Movements