Magic Quadrant for Network Detection and Response
Vendors or products added in this year’s report may indicate a change in the market, change in evaluation criteria, or change of focus by the vendor.
Vendors or products dropped from one year to the next may indicate a change in the market, change in evaluation criteria, or change of focus by the vendor.
The NDR market continues to grow by double-digit percentages, registering a year-over-year increase of 17% in 2025. Vendors in the NDR market run the gamut from small startups to some of the largest network security providers. The foundation of NDR is detecting malicious activity in network traffic, yet vendors are quickly adding key capabilities including signature-based detections, asset visibility, forensic analysis, threat hunting, attack path identification, and regulatory compliance support. Many NDR offerings have expanded to capture new categories of events and analyze additional traffic patterns, including third-party integrations (primarily with EDR), standard detection techniques, managed NDR services, evolving architecture, enhanced visibility, CPS/OT use cases, AI analysis, MCP analysis, larger sensors supporting up to 400 Gbps ingestion, and attack path prediction capabilities.
A: We review and adjust our inclusion criteria for Magic Quadrants as markets change. As a result of these adjustments, the mix of vendors in any Magic Quadrant may change over time. A vendor's appearance in a Magic Quadrant one year and not the next does not necessarily indicate that we have changed our opinion of that vendor. It may be a reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.