Expel, CrowdStrike, Red Canary Dominate Forrester MDR Ranks

Cybersecurity behemoth CrowdStrike once again joined pure-play managed detection and response vendors Expel and Red Canary atop Forrester’s ranking of MDR vendors.

See Also: The Comprehensive Guide to Cloud Security and SOC Convergence

MDR providers historically focused on identifying and mitigating security threats in real time, but as competition intensified, they recognized the need to differentiate their offerings. One of the biggest developments is the adoption of detection as code, which enables faster, more scalable, and more precise threat detection by incorporating unit testing and automated validation of detection rules.

“MDR started out as a narrow set of capabilities that that were really effective for customers in terms of outcomes,” Forrester’s Jeff Pollard said. “We had detection, investigation, response, that was the core set of capabilities. But what all of them are dealing with is a little bit of that, ‘What do we offer next? How do we scale our business? How do we quit being reactive and instead go a little bit more proactive?'”

Internally, Pollard said many MDR vendors use generative AI for automating security tasks such as ticket reporting, summarizing security incidents and producing after-action reports, freeing up SOC analysts to focus on high-priority investigations. And AI is changing the way SOC analysts interact with security data, with AI-powered tools now analyzing, interpreting and translating complex malicious scripts, he said.

“The other big one, and this is a use case that I love, is allowing SOC analysts to use it to de-obfuscate code or translate scripts,” Pollard said. “Instead of trying to break up and Google each individual function, you toss the whole thing in there and it says, ‘Hey, this script comes from here. It does this, does that, then calls on this variable to do that.’ That’s a phenomenal use case. It saves a lot of time.”

Pollard said the continued success of Expel, CrowdStrike and Red Canary can be attributed to their deep understanding of both CISOs and SOC analysts, with the later engaging with MDR tools on a daily basis. The leading vendors have built MDR platforms that are user-friendly for SOC teams while still delivering clear executive-level value that CISOs can present to the board, according to Pollard.

“I think what each of those vendors has done a really good job of is understanding their user, which is a SOC analyst … but then also understanding that they have to be able to communicate the value of their capabilities at an executive level for CISOs to defend their purchase and expand it,” Pollard said.

Going forward, Pollard said AI agents may interact directly with each other analyzing security incidents and recommending actions with minimal human intervention. MDR teams focus on infrastructure and network-level threats today, but Pollard expects MDR providers to increasingly offer deeper visibility into application security telemetry to enable organizations to detect and respond to embedded threats.

“In 2027, there’s going to be an emphasis from some providers on really leaning into that AI agent capability, where it’s perhaps your agents in a SOC talking to their agents in a SOC and making some decisions,” Pollard said.

From a strength of offering perspective in the Forrester Wave for MDR vendors, Expel once again leads the pack, with CrowdStrike and Red Canary tying for the second-highest score and Binary Defense and eSentire tying for the fourth-highest score. That’s similar to spring 2023, when Expel got the highest score in current offering, Red Canary and Secureworks got the second-highest score, and CrowdStrike received the fourth-highest score.

As far as strategy is concerned, CrowdStrike once again got top marks, with ReliaQuest, Expel and Red Canary getting the second, third and fourth-highest scores, respectively. That’s similar to spring 2023, when CrowdStrike got the top score for strategy, Expel and Red Canary tied for the second-highest score, and Arctic Wolf received the fourth-highest score.

Outside of the leaders, here’s how Forrester sees the managed detection and response market:

• Strong Performers: ReliaQuest, Binary Defense, eSentire;
• Contenders: Arctic Wolf, Rapid7, Secureworks, SentinelOne.

Expel Prioritizes Ability to Work With Existing Security Bets

Expel prioritizes its ability to operationalize any security tool that customers use rather than promoting its own platform, evolving its services based on attacker behavior, security tools and the attack surface, said co-founder and CEO Dave Merkel. The company’s approach ensures customers don’t have to switch security vendors to benefit from its services, which is attractive to customers with existing cyber investments.

Markel said the company’s security platform was built before Expel began offering services, ensuring the company could proactively develop solutions and scale effectively. While many MDR providers simply notify customers about a breach and leave it up to their internal teams to respond, Merkel said Expel takes action to contain and resolve threats, ensuring minimal disruption for customers.

“Whatever you buy, whatever you have chosen to invest in, we’re going to operationalize that for you,” Merkel told ISMG. “And that’s why we get so much enterprise business, like very significant brands, come to us, because they know what they’ve paid for already, we’re gonna make it work.”

Forrester critiqued Expel for being one of the most expensive MDR providers. Merkel defended the premium pricing, emphasizing that quality comes at a cost. Despite this, Merkel said Expel has recently introduced new pricing and packaging options to cater to smaller businesses, including a tiered pricing model that helps companies choose services based on their budget and needs, according to Merkel.

“I’ll say unapologetically, we are the premium brand,” Merkel said. “If you want it to work, if you actually want the breach to stop at 2 a.m. on Saturday, you pay me. I’m not too afraid to say, ‘Yeah, we’re more expensive, because it actually works.’ Now, that being said, we do want more and more businesses to be able to access Expel. Why? Because we are better, and we want to protect those companies.”

CrowdStrike Extends from First-Party to Third-Party MDR Data

CrowdStrike has improved its MDR offering by expanding beyond endpoint, cloud and identity data to include network, email and firewall data, which allows for better contextualization of security events and more accurate threat detection, said Chief Global Professional Services Officer Thomas Etheridge. Buying Humio fueled the development of a scalable and high-performance log ingestion system, he said.

The firm collaborates with customers and partners to provide detailed reports and ensure that security teams fully understand the benefits of CrowdStrike’s threat detection and response. The company is investing heavily in AI-powered automation to boost the analyst experience, with the goal of reducing the manual workload of security analysts and enabling them to respond faster to security threats.

“We’ve been working pretty hard, collaborating with customers and partners on making sure that organizations have transparency and actionable insights about the actions that the MDR service is providing, and the benefits that it’s providing to organizations from a responsive remediation perspective,” Etheridge told ISMG.

Forrester said that CrowdStrike could do more in terms of community engagement outside of its own blogs, webinars and events, but Etheridge said the company already has a strong presence at events such as RSA Conference and Black Hat. Improvements are also needed for analyst experience, Forrester said, Etheridge said the company is using automation to cut analyst workloads and improve experience.

“We do actually speak publicly at a lot of CrowdStrike events, and we do have representation at industry events like RSA and Black Hat and other security-focused events where we talk about what we do, how we do it, and we provide a lot of demo experiences,” Etheridge said.

Red Canary Extends Both Cloud, Identity to Platform Audit Data

Unlike traditional security approaches that rely on alerts from cloud and identity providers, CEO Brian Beyer said Red Canary collects all audit data from platforms like AWS, Azure, GCP and Okta, helping the firm see the big picture. With more than a decade of security data, Red Canary can train AI models to spot patterns and anomalies more effectively than traditional rule-based detection methods, Beyer said.

Beyer said Red Canary offers a cost-effective security data lake, helping clients store large volumes of security-relevant data at a lower cost than SIEM in a way that allows quick querying when needed while reducing expenses. Red Canary focuses on data collection and analytics to boost detection rates, and it supports a multi-platform security environments to aid enterprises using a mix of security tools.

“We go take that huge pile of data, and we apply all these techniques that we have to identify potential threats,” Beyer told ISMG. “We make those big bets, we bring in that data, we identify those threats, and we’re going to consistently detect four to five times more threats than what anybody else does using that data.”

Forrester criticized Red Canary for lacking extended detection capabilities and having a more limited partner ecosystem. Beyer said Red Canary prioritizes high-value integrations, focusing on the most important data sources for threat detection. Red Canary historically operated directly with customers, but over the past few years has expanded its partnerships to boost market reach and sales opportunities.

“There are many MDRs who’ve taken this approach of, ‘I want to integrate with as many products as possible and not necessarily provide a lot of value for those integrations and not go very deep with each of them,'” Beyer said. “Red Canary has taken an intelligence-led approach. We are going to understand what do adversaries do. How do they compromise organizations? How can we catch them?”