The CF List: 2023's 20 Top XDR Security Providers You Should Know

Interest in extended detection and response (XDR) continues to grow, providing an abundance of opportunities for XDR providers.

XDR systems continually capture focused data and alerts from all the key systems connected to them. Then, they feed this data into a centralized repository, cleaning and normalizing it. In addition to computers, mobile devices and IoT, XDR also draws on data feeds from email security systems, network analysis and visibility tools, identity and access management (IAM) platforms, cloud workload protection systems and elsewhere.

This is our second CF List focusing on XDR. Analysts with Omdia, S&P Global Market Intelligence and Forrester weighed in on XDR market trends and what it takes to be a successful XDR provider.

XDR Providers Facing Steady Market Growth

Eric Parizo is managing principal analyst at Omdia, which shares a parent company with Channel Futures (Informa).

Omdia’s Eric Parizo

“The primary business driver for XDR remains the same: getting better, more consistent outcomes from the threat detection, investigation and response (TDIR) life cycle,” he said. “While traditional security information and event management (SIEM) and next generation-SIEM-based security operations center (SOC) architectures still play an important role, particularly as a data repository for both security and compliance business processes, enterprises increasingly are coming to understand that a solution purpose-built for TDIR is needed, given the speed, volume and complexity with which threats present themselves.”

Omdia forecasts steady XDR market growth, Parizo said.

“Omdia’s latest data indicates the global XDR market will reach $2.33 billion in 2027,” he said. “However, that is a reduction from our previous forecasts, in large part due to macroeconomic uncertainty, particularly in the tech and cybersecurity segments. While we believe demand will be strong over our five-year forecast period, short-term revenue could be uneven.”

XDR Remains New Market

Allie Mellen is security and risk analyst at Forrester.

Forrester’s Allie Mellen

“Thus far, the market is still so new that customer expectations have not evolved significantly,” she said. “XDR is the evolution of endpoint detection and response (EDR) to accept additional data sources for detection and response. It still limits the ecosystem to ensure high-quality detections generated by the vendor.”

Many security teams now understand what XDR is and are looking at how it will affect their current strategy with EDR, Mellen said.

“What will EDR look like as it transitions to XDR?” she said. “Is the EDR provider developing a strong XDR strategy? Security teams are looking for a way to simplify detection engineering and correlation – many have opted to use an managed detection and response (MDR) provider on their journey to XDR.”

XDR Technologies Continue Expanding

Scott Crawford is research director of information security at S&P Global Market Intelligence. He said the breadth of technologies across the broad theme of XDR continues to expand.

S&P Global Market Intelligence’s Scott Crawford

“Two of the more visible areas of expansion – at least in terms of identifying with the threat detection and response theme – have been cloud and identity,” he said. “Cloud detection and response focuses on the nature of threats to cloud-native environments and applications, how those threats can be detected, and how response can be mediated in and through those environments. Identity threat detection and response focuses on how identity and access controls can be exploited. This comes up frequently in contexts such as ransomware, where the compromise and exploit of user credentials is often a key factor along with gaps in access privilege management that can leave protected assets more exposed than an organization may realize.”

More recently, there’s been an increase in response platforms that integrate various aspects of incident response processes, Crawford said. That includes the involvement of insurers and insurance-related parties that may be involved in issues such as ransomware response.

We’ve compiled a list above of 20 top XDR providers based on analysts’ feedback and recent news reports. It’s in no particular order. The list, by no means complete, includes well-known providers. But it also features lesser-known providers making strikes in XDR.