Table of Contents
- Summary
- Market Categories and Deployment Types
- Key Criteria Comparison
- GigaOm Radar
- Vendor Insights
- Analyst’s Take
- Methodology
- About Chris Ray
- About GigaOm
- Copyright
1. Summary
Enterprise cybersecurity is typically composed of multiple security solutions from various vendors combined with a security information and event management (SIEM) and/or security orchestration automation and response (SOAR) product to allow security analysts to correlate events across the network in an effort to detect and respond to cyberattacks. Most SIEM/SOAR solutions in use today originally came with out-of-the-box threat detection; however, their effectiveness relied heavily on human involvement to fine-tune these systems for their environment. Clearly, therefore, any such solution was limited by the knowledge of the available security staff and required extensive maintenance to keep up with the ever-changing threat landscape. This limitation resulted in less-than-intelligent detection and a crippling overabundance of alerts. Ultimately, when a solution is dependent on the knowledge of the security staff, real threats are drowned out by the noise and remain undetected.
In contrast, extended detection and response (XDR) solutions distribute detection and response across the security stack to provide ubiquitous coverage from endpoint to cloud by delivering unified visibility, control, and protection. XDR collects telemetry and leverages artificial intelligence (AI), machine learning (ML), or other statistical analysis methods to correlate event logs, and then evaluates them against intrusion response frameworks. Additionally, XDR systems integrate threat intelligence to enhance and improve threat detection capabilities. Though having the full security stack telemetry funnel through an analytics engine that’s enriched with up-to-date threat intel and measured against intrusion frameworks doesn’t provide a “silver bullet” for security, it’s as close to “security in a bag” as you can get at this time.
XDR attempts to address the security skills gap by reducing the need for experienced security analysts and instead using AI, ML, and statistical methods to provide threat intelligence-driven analysis. Not only does it identify connections between seemingly unrelated network activities to uncover sophisticated attacks, automated remediation procedures reduce the mean time to respond (MTTR) to a potential incident.
The GigaOm Key Criteria and Radar reports provide an overview of the XDR market, identify capabilities (table stakes, key criteria, and emerging technology) and evaluation factors for selecting an XDR platform, and describe in detail those vendors and products that excel. These reports will give prospective buyers an overview of the top vendors in this sector and will help decision makers evaluate solutions and decide where to invest.
How to Read this Report
This GigaOm report is one of a series of documents that helps IT organizations assess competing solutions in the context of well-defined features and criteria. For a fuller understanding, consider reviewing the following reports:
Key Criteria report: A detailed market sector analysis that assesses the impact that key product features and criteria have on top-line solution characteristics—such as scalability, performance, and TCO—that drive purchase decisions.
GigaOm Radar report: A forward-looking analysis that plots the relative value and progression of vendor solutions along multiple axes based on strategy and execution. The Radar report includes a breakdown of each vendor’s offering in the sector.
Solution Profile: An in-depth vendor analysis that builds on the framework developed in the Key Criteria and Radar reports to assess a company’s engagement within a technology sector. This analysis includes forward-looking guidance around both strategy and product.