0000-00

F r o s t R a d a r : M a n a g e d D e t e c t i o n a n d R e s p o n s e , 2 0 2 4

March 2024

A Benchmarking System to Spark Companies to Action - Innovation That Fuels New Deal Flow and Growth Pipelines

Authored by: Lucas Ferreyra

2

Strategic Imperative and Growth Environment

3

Strategic Imperative

Source: Frost & Sullivan

Factors Creating Pressure on Growth

• The dearth of cybersecurity professionals continues to shape the industry, becoming a thorn in global

organizations’ side as they try to secure their growing environments.

• Faced with a lack of access to professionals and an inability to protect their business-critical data

effectively, organizations are outsourcing to alleviate the issue.

• MDR service providers can offer top-tier security across the environment, delivered by experienced

professional teams that partner with and support organizations in establishing effective security

perimeters.

• In the next three years, organizations will continue investing in outsourced security through MDR

services as it enables them to focus personnel on the core business instead of building internal security

operations centers (SOCs).

• AI, ML, and automation have become increasingly integral to cybersecurity solutions. These

technologies enhance detection and response and allow SOC analysts to focus on what’s important

instead of chasing down false alerts.

4

Strategic Imperative

Source: Frost & Sullivan

Factors Creating Pressure on Growth

• But automation cannot replace human analysts just yet, as organizations cannot trust AI to handle

complex decision-making beyond detection and response.

• As organizations seek alternative ways to cope with the shortage of security analysts, they will adopt

solutions that leverage ML and AI in combination with the ever-important human factor.

• As a result, security services such as MDR will continue to thrive in the next three years while security

providers invest in developing and enhancing automated security assistants.

• Due to the sophisticated nature of the latest cyberattacks, the growing incidence of nation-state-

sponsored threats, and the increasing number of cybersecurity incidents, there’s an arms race between

threat actors, security solutions, and service providers.

• Organizations are caught in the middle, with the pressure to understand, invest in, and keep up with the

latest developments in the cybersecurity industry to protect their environments.

• As digital transformation continues and geopolitical conflicts around the globe progress, organizations

will continue to be targeted by complex cyberattacks and data breaches.

5

Strategic Imperative

Source: Frost & Sullivan

Factors Creating Pressure on Growth

• MDR’s promise to bolster an organization’s security posture with 24/7 monitoring, state-of-the-art

detection and response, and incident response capabilities will resonate with global organizations for

the foreseeable future.

6

Growth Environment

Source: Frost & Sullivan

• According to Frost & Sullivan’s 2023 Voice of the Enterprise Security Customer survey, 36% of

global organizations were using MDR at the beginning of 2023, with a further 26% of them

planning to invest in the service by 2024.

• MDR has witnessed widespread adoption in 2023, with a growth rate of 35.2% and a compound

annual growth rate (CAGR) of 25.3% expected from 2023 to 2026. MDR has made significant

waves in the cybersecurity industry thanks to its ability to address many of global organizations'

most pressing pain points.

• The dearth of security talent and the rapid increase in the number and sophistication of threats

generate the perfect conditions for MDR to thrive. These driving factors are not expected to

diminish soon and will continue to push organizations to outsource their security, either partially

or completely.

• The growth rate and customer adoption of MDR services will remain high for the foreseeable

future, as the platform’s drivers far outweigh its restraints and limitations.

https://protect.checkpoint.com/v2/___https://www.dropbox.com/scl/fi/ilxkm57lew0rgoae05p40/VOC-Sales-Deck_2023_v10Nov2023.pdf?rlkey=70kws4m3t9dejqf2oi066621b&dl=0___.YzJlOmNwYWxsOmM6bzo5MjhkNGQzNWFmMjkxNDZiYzE0Y2FlNTYxNDQxYjA5Njo2OjhhYjA6NmJlN2Q1OWE3Mzc2YjMyOTg5MTY2ZDA4ZTE5Y2Q5NDk2ODc3Zjk5OWVjY2NhZDY1NTA3NTE3MmJmOThmY2JhODpwOlQ

7

Growth Environment

Source: Frost & Sullivan

• The lion’s share of MDR revenue and adoption comes from North America, but Europe, the

Middle East, and Africa (EMEA) is a close second. These regions' higher maturity and

cybersecurity focus and increased government involvement in guiding organizations toward

effective security strategies and compliance make MDR a great option for businesses in both

regions. They will continue growing rapidly for the next three years and remain high-priority

investments for MDR providers.

• As with most high-end cybersecurity solutions and services, Latin America (LATAM) and Asia-

Pacific (APAC) account for smaller contributions to MDR revenue. Nonetheless, these regions

have a higher potential for growth, as the CAGR is higher for the 2023–2026 period, showing

that adoption is expected to ramp up for local organizations. The new MDR message, with

extended incident response and adjacent services that increase maturity and awareness,

resonates with regional companies. Highly involved MDR partners could leverage their

competitive differentiators to expand into these regions in the next few years.

8

Growth Environment

Source: Frost & Sullivan

• Organizations across various company sizes consider MDR a worthwhile option to secure their

business-critical assets. While enterprises with more than 10,000 employees account for less

revenue and growth, it is to be expected from companies that have already invested in their

SOCs and have experienced analysts working with them.

• The highest-spending industry verticals for MDR are finance, government, manufacturing, and

technology & telecommunications. Overall, adoption is high across every sector, with every MDR

provider focusing on different integrations, providing visibility into distinct environments, and

delivering multiple adjacent services. Such specialization means most organizations can find an

MDR partner that meets their needs and use cases.

9

Frost Radar Managed Detection and Response, 2024

10

Frost Radar : Managed Detection and Response, 2024

Source: Frost & Sullivan

11

Frost Radar Competitive Environment

Source: Frost & Sullivan

• In a rapidly growing field of more than 150 industry participants with revenue greater than $1

million, Frost & Sullivan independently plotted 22 growth and innovation leaders in the MDR

space in this Frost Radar analysis.

• Over the last few years, MDR providers have developed solutions to deliver extensive visibility

over the environment, advanced detection of the most pervasive threats, and a veteran team of

expert security analysts supported by AI, ML, and automation capabilities. MDR has become the

primary way of delivering SOC services, unifying capabilities such as detection and response,

investigation, threat hunting, and more under a single platform.

• Because of this, the MDR sector will continue to see an influx of new competitors from very

different spaces, including endpoint detection and response (EDR) and extended detection and

response (XDR) vendors, players with extensive coverage and portfolios, and managed security

services providers (MSSPs) wanting to leverage their ample service offerings.

12

Frost Radar Competitive Environment

Source: Frost & Sullivan

• MDR providers will face fierce competition from XDR vendors and MSSPs that do not provide

managed XDR or an MDR platform. These spaces seek to provide organizations with

comprehensive and centralized security that enables and empowers the customers’ analysts via

many of the same features.

• The most significant innovations of highly successful MDR platforms and services include

implementing threat detection across a wide range of environments to address multiple use

cases, leveraging world-class threat intelligence and ML features to empower analysts, providing

a synergistic portfolio of complementary managed and professional services to multiply the

value of the MDR service; integrating third-party telemetry sources to augment flexibility; and

developing and implementing large language models (LLM) tools and generative AI security

assistants to ramp up the effectiveness of new analysts and facilitate the lives of experienced

ones.

13

Frost Radar Competitive Environment

Source: Frost & Sullivan

• Check Point Software has developed innovative MDR platforms with excellent detection and

response, threat hunting, and analyst-enabling capabilities. These service providers are among

the most innovative in this space, leading several development trends in the technology and

service aspects of the MDR sector. In the short term, they will see their innovation excellence

translated into growth opportunities.

14

Companies to Action: Companies to Be Considered First for Investment, Partnerships, or Benchmarking

15

Company to Action: Check Point

• Check Point Infinity MDR/MPR provides 24/7 monitoring over the entire customer infrastructure,

including endpoints, networks, emails, cloud, and IoT devices. The service is complemented by

incident investigation and response, proactive threat hunts, threat intelligence, and MITRE ATT&CK

techniques. Customers can access an intuitive web portal that provides full visibility into incidents,

investigations, and recommendations.

• The service supports Check Point and third-party products to provide customers with operational and

strategic benefits. Furthermore, Check Point Infinity MDR/MPR leverages federated search to allow

customers to decide whether to draw the raw data lines within each product or send the raw data

logs to Check Point Software for analysis. This helps the company deliver flexibility for customers with

various use cases, needs, and budgets.

• Check Point Software continuously adds new integrations across different cybersecurity vendors to its

MDR service, increasing the platform’s flexibility. Over the last year, Check Point Software has added

MSSP support through multitenancy, full integration into the Check Point Infinity Portal Infrastructure

(a unified platform that consolidates the management of the entire IT infrastructure, including

network, cloud, IoT, mobile, and endpoints), and other features to simplify the work of analysts.

Innovation

Source: Frost & Sullivan

16

Company to Action: Check Point

• With a dedicated MDR innovation team, the provider will continue platform enhancements with additional

vendor integrations, a customer ticketing system, raw log analysis, storage, and alerts, as well as supporting

native monitoring of alerts from both Check Point and non-Check Point vendors.

Innovation

Source: Frost & Sullivan

17

Company to Action: Check Point

• Since its soft launch in 2021, Check Point Infinity MDR/MPR has grown significantly faster than the

market average.

• Check Point Software focuses on the mid-market, although it also delivers its services to small and

large businesses. The company provides MDR for organizations across the globe, with a higher

proportion of its revenue coming from North America and EMEA but with a significant presence in

LATAM and APAC.

• Check Point delivers its MDR services entirely through channel partners and has devised an effective

growth strategy to expand its reach. Together with the MSSP support and the multitenancy

architecture, the company provides co-branded and white-label options for channel partners. This

unlocks growth opportunities for both parties, as it allows distributors to build their own endpoint

and email security solutions and teams to cross-sell and upsell MDR services, providing brands

effectively and extending the reach of Check Point Infinity MDR/MPR to a muse its endpoint and

email security solutions and teams to cross-sell and upsell MDR services, providing MDR to multiple

markets.

Growth

Source: Frost & Sullivan

18

Company to Action: Check Point

• Check Point Software can use its endpoint and email security solutions and teams to cross-sell and

upsell MDR services, providing an advantage over pure-play MDR vendors.

Growth

Source: Frost & Sullivan

19

Company to Action: Check Point

• Check Point Infinity MDR/MPR integration of third-party products enables customers to leverage

their existing security solutions. These capabilities, combined to Check Point Infinity MDR/MPR

multitenancy architecture, demonstrate Check Point’s effective channel distribution strategy and

MSSP focus. These features provide much-needed flexibility for the service, easily extending Check

Point Software’s presence across different markets and regions.

• Given these features and the significant presence that the provider has in LATAM and APAC, Check

Point Software should make further investments to capitalize on its unique position. LATAM and APAC

have lower MDR adoption overall. Still, a higher growth rate, and as more organizations in these

regions go through digital transformation, partnering with MDR providers will become increasingly

essential to keep their environments secure.

• Check Point Software’s roadmap is promising, and the company should continue its innovation and

development in those areas. Additionally, it should consider investing more in AI/ML features

(including automation, detection, and large language models to train personnel) that will enable

augmented scalability.

Frost Perspective

Source: Frost & Sullivan

20

Key Takeaways

XXXX-XX 21

Key Takeaways

MDR can benefit any organization and enjoys high adoption across many industry verticals; it

caters to the needs of diverse global organizations with different use cases and maturity levels. 11

Source: Frost & Sullivan

Frost & Sullivan’s 2023 Voice of the Enterprise Security Customer survey revealed that 1in 2

organizations that spend money on security services, such as managed security services (MSS),

professional security services (PSS), MDR, threat intelligence services, and SOC monitoring, used

MDR in early 2023. A further 36% of these enterprises plan to add MDR by 2024.

12

The percentage of MDR adopters out of all organizations is also significant, with 36% using it by

2023 and 26% planning to deploy it by 2024. 13

XXXX-XX 22

Key Takeaways

Collaboration or outsourcing: MDR providers have different approaches as to how the service

should be delivered. Some are at their best when collaborating with customer security teams,

increasing their maturity over time and performing threat hunting and investigations as a unified

group. Other providers prefer to take care of everything themselves, sending periodic reports to

customers and allowing them to focus their resources elsewhere. MDR can completely replace or

assist and empower your cybersecurity team and everything.

14

Source: Frost & Sullivan

Environment visibility: Top-tier MDR players can provide visibility across various environments,

from the classic trio of endpoint, network, and cloud to email, identity, containers, OT and IoT

devices, and others. However, focus can also be a good choice. If your organization only needs to

cover a few specific environments, looking for a specialized vendor that provides the deepest

visibility across fewer security controls is better.

15

XXXX-XX 23

Key Takeaways

Source: Frost & Sullivan

Adjacent service offering: A comprehensive portfolio of additional synergistic tools and services

will make MDR a more flexible solution than it already is, empowering your organization with

additional capabilities at a fraction of the cost. Those tools, however, are as varied as MDR

providers. MSSPs with cutting-edge MDR solutions can usually provide a wider set of adjacent

managed tools and professional services. However, leading pure-play vendors are heavily investing

in providing these as well. If you seek to advance your organization’s security maturity and

develop your security team, consulting engagements, assessments, and penetration tests can be a

worthy addition to MDR.

16

24

Frost Radar Analytics

25

Frost Radar : Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform

VERTICAL AXIS

Growth Index (GI) is a measure of a company’s growth performance

and track record, along with its ability to develop and execute a fully aligned growth strategy and vision; a robust growth pipeline system; and effective market,

competitor, and end-user focused sales and marketing strategies.

GROWTH INDEX ELEMENTS

• GI1: MARKET SHARE (PREVIOUS 3 YEARS) This is a comparison of a company’s market share relative to its competitors in a given market space for the previous 3 years.

• GI2: REVENUE GROWTH (PREVIOUS 3 YEARS) This is a look at a company’s revenue growth rate for the previous 3 years in the market/industry/category that forms the context for the given Frost Radar .

• GI3: GROWTH PIPELINE This is an evaluation of the strength and leverage of a company’s growth pipeline system to continuously capture, analyze, and prioritize its universe of growth opportunities.

• GI4: VISION AND STRATEGY This is an assessment of how well a company’s growth strategy is aligned with its vision. Are the investments that a company is making in new products and markets consistent with the stated vision?

• GI5: SALES AND MARKETING

• This is a measure of the effectiveness of a company’s sales and marketing efforts in helping it drive demand and achieve its growth objectives.

26

Frost Radar : Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform

HORIZONTAL AXIS

Innovation Index (II) is a measure of a company’s ability to develop products/services/solutions (with

a clear understanding of disruptive Mega Trends) that are globally applicable, are able to

evolve and expand to serve multiple markets, and are aligned

to customers’ changing needs.

INNOVATION INDEX ELEMENTS

• II1: INNOVATION SCALABILITY This determines whether an organization’s innovations are globally scalable and applicable in both developing and mature markets, and also in adjacent and non-adjacent industry verticals.

• II2: RESEARCH AND DEVELOPMENT This is a measure of the efficacy of a company’s R&D strategy, as determined by the size of its R&D investment and how it feeds the innovation pipeline.

• II3: PRODUCT PORTFOLIO This is a measure of a company’s product portfolio, focusing on the relative contribution of new products to its annual revenue.

• II4: MEGA TRENDS LEVERAGE This is an assessment of a company’s proactive leverage of evolving, long- term opportunities and new business models, as the foundation of its innovation pipeline. An explanation of Mega Trends can be found here.

• II5: CUSTOMER ALIGNMENT This evaluates the applicability of a company’s products/services/solutions to current and potential customers, as well as how its innovation strategy is influenced by evolving customer needs.

https://protect.checkpoint.com/v2/___https://ww2.frost.com/research/visionary-innovation/___.YzJlOmNwYWxsOmM6bzo5MjhkNGQzNWFmMjkxNDZiYzE0Y2FlNTYxNDQxYjA5Njo2OjkyNDk6OTdkNGViODkwZWUzMWVjYWNmMmMwMGZkMTFiZTRmODkzZGI0ZTljZmFhNGJkNGNiM2UyMDg1NjkyYTFjYWQzYTpwOlQ

27

Legal Disclaimer

Frost & Sullivan is not responsible for any incorrect information supplied by companies or users. Quantitative market information is based primarily on interviews and therefore is subject to fluctuation. Frost & Sullivan research services are limited publications containing valuable market information provided to a select group of customers. Customers acknowledge, when ordering or downloading, that Frost & Sullivan research services are for internal use and not for general publication or disclosure to third parties. No part of this research service may be given, lent, resold, or disclosed to noncustomers without written permission. Furthermore, no part may be reproduced, stored in a retrieval system, or transmitted in any form or by any means—electronic, mechanical, photocopying, recording, or otherwise— without the permission of the publisher.

For information regarding permission, write to: permission@frost.com

© 2023 Frost & Sullivan. All rights reserved. This document contains highly confidential information and is the sole property of Frost & Sullivan. No part of it may be circulated, quoted, copied, or otherwise reproduced without the written approval of Frost & Sullivan.

mailto:permission@frost.com

Slide 1 Slide 2 Slide 3: Strategic Imperative Slide 4: Strategic Imperative Slide 5: Strategic Imperative Slide 6: Growth Environment Slide 7: Growth Environment Slide 8: Growth Environment Slide 9 Slide 10: Frost Radar™: Managed Detection and Response, 2024 Slide 11: Frost Radar™ Competitive Environment Slide 12: Frost Radar™ Competitive Environment Slide 13: Frost Radar™ Competitive Environment Slide 14: Companies to Action: Companies to Be Considered First for Investment, Partnerships, or Benchmarking Slide 15: Company to Action: Check Point Slide 16: Company to Action: Check Point Slide 17: Company to Action: Check Point Slide 18: Company to Action: Check Point Slide 19: Company to Action: Check Point Slide 20 Slide 21: Key Takeaways Slide 22: Key Takeaways Slide 23: Key Takeaways Slide 24 Slide 25: Frost Radar™: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform Slide 26: Frost Radar™: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform Slide 27: Legal Disclaimer