MDR, EDR Markets See Wave of M&A as Competition Intensifies

A changing competitive landscape, economic pressures and evolving customer needs for security have driven a wave of acquisitions between EDR and MDR vendors, experts said.

See Also: A Modern Approach to Data Security

Cybersecurity historically was divided between vendors that build security products such as firewalls and anti-virus software and service providers who managed security on behalf of businesses, but the once-distinct roles have blurred, said Forrester Vice President and Principal Analyst Jeff Pollard. This prompted firms such as CrowdStrike to begin offering managed services themselves rather than depending on third parties.

“What happened is that the product vendors said, ‘Why are we giving this money away?'” Pollard told Information Security Media Group. “And the services vendor said, ‘Well, uh oh, looks like we need our own stuff because they’re no longer going to be someone that we can partner with and won’t be competing with us.’ And that’s really what got us to where we are now.”

As a result, managed detection and response providers that historically focused on managing other companies’ technology recognized the need to develop their own intellectual property to remain competitive, he said. As more and more MSSPs, endpoint security vendors and incident response firms enter the MDR market, Pollard said vendors are increasingly turning to M&A as a means of survival and expansion (see: Expel, CrowdStrike, Red Canary Dominate MDR Forrester Wave).

“You’ve got a lot of competition for what is a successful market,” Pollard said. “But whenever you get that much competition, it’s going to mean M&A happens, because you just need to consolidate.”

The M&A spree kicked off earlier this month when endpoint security vendor Sophos made the largest acquisition in its four-decade history, scooping up MDR provider Secureworks for $859 million to boost its threat intelligence, detection and response. Days after the deal closed, Sophos laid off 6% of its staff, citing a desire to streamline duplicative roles and eliminate positions tied to Secureworks being public (see: Sophos Fortifies XDR Muscle With $859M Secureworks Purchase).

“Think of the components that go into a really effective and efficient MDR offering,” Sophos CEO Joe Levy told ISMG. “You need to have a great XDR platform, so being able to own the technology and own the roadmap of that technology, that’s something that this split model between an independent service provider and an independent technology provider, you just don’t have that kind of predictability.”

That same day, MDR provider Arctic Wolf bought the beleaguered Cylance endpoint security business from BlackBerry for $160 million to evolve from a services-based strategy to a more product-centric one. And in November, struggling EDR provider Cybereason and MDR provider Trustwave announced plans to join forces to create a more formidable managed security provider with more robust service capabilities (see: Arctic Wolf to Buy Cylance for $160M to Boost AI-Driven XDR).

“More and more customers are saying, ‘Hey, I get so much from Arctic Wolf via my security operation. I’d love to leverage an Arctic Wolf technology for prevention and endpoint detection and response in conjunction with everything that you’re doing for me in overall security operations,'” Arctic Wolf CEO Nick Schneider told ISMG.

Why Standalone EDR, MDR No Longer Meet the Moment

Organizations traditionally relied on managed security services for log monitoring and basic alerting. MDR took this a step further by offering real-time threat detection, investigation and response. At the same time, vendors came to realize that endpoint visibility alone through EDR was insufficient, leading to XDR, which integrates signals from multiple layers, including cloud, network and identity systems.

“It’s complicated to learn the skills to be able to operate these kinds of platforms really efficiently, and it’s even more challenging to be able to do it 24/7/365,” Levy said. “Most organizations simply aren’t equipped to be able to run a global SOC with multiple shifts.”

While XDR expanded detection capabilities, Levy said it also introduced operational complexities, with most companies lacking the expertise and resources to manage a sophisticated security platform 24/7, leading to the rise of MDR as a fully managed security service. True MDR should go beyond the endpoint and include threat detection across cloud environments, networks and identity systems, Schneider said.

“Once partners get engaged and really see the value in managed EDR, the conversation immediately goes to, ‘Can you do the same thing for my firewalls? Can you do the same thing for my NDR solution? Can you do the same thing for my identity solution?'” WatchGuard Chief Product Officer Andrew Young told ISMG. “And so they are looking more and more to outsource.”

As managed security solutions go beyond endpoint protection and cover the entire IT infrastructure, Levy said customers want a single vendor that can provide both the EDR technology and MDR service rather than juggling multiple contracts and support teams. With cyberthreats evolving rapidly, firms need a solution that not only detects attacks but also proactively manages and responds to them.

“It provides one throat to choke for customers and partners, which I think is something that’s very, very beneficial for consumers, rather than ending up in a situation where there is uncertainty of accountability or ownership,” Levy said.

While the MDR market has seen massive growth, it is also extremely crowded, with more than 150 vendors claiming to offer some form of managed security services, Pollard said. But only 50-to-75 of these companies have a significant business footprint, according to Pollard.

“It is an enormously fragmented market. It is one that is absolutely ripe for consolidation. Some companies absolutely need to come together,” Pollard said. “In fact, I’d say that’s what’s keeping a lot of MDR players small at this point is that they’re all sort of competing with each other.”

The endpoint security market is increasingly owned by a few players, with Microsoft and CrowdStrike now controlling nearly 44% of this $12.6 billion space, with both companies growing considerably faster than the market as a whole. One of the biggest challenges comes from Microsoft providing built-in security tools with its enterprise software, making it challenging for standalone security vendors to justify their costs.

Many organizations choose Microsoft’s security solutions simply because they are already included in their enterprise licensing agreements, which Pollard said leaves little room for independent vendors to differentiate themselves. Meanwhile, Pollard said CrowdStrike’s dominance in endpoint security makes it difficult for smaller vendors to break through, particularly in the enterprise market.

“If you’re an endpoint player and you’re going after the same kind of markets that a CrowdStrike or Microsoft goes after, that’s going to be really, really hard to boot them out,” Pollard said. “When you look at each one of those, you’ve got to sit there and say, ‘Well, we can keep fighting the good fight. Or if there’s an opportunity to make an exit, let’s go for it.'”

How Organizations Can Bring MDR, EDR Technology Together

Many MDR providers still rely on third-party EDR solutions, which Young said can lead to delays in threat detection and response because of inefficient data sharing between vendors. Companies that own both their EDR and MDR technology can optimize telemetry, streamline security workflows and reduce response times, which Young said makes acquisitions more appealing than continuing to depend on partnerships.

“When it’s a third-party vendor, the third party is collecting the telemetry, and the MDR vendor is collecting the telemetry,” Young said. “So, you’re inherently going to have higher costs when you’re managing an open environment. A lot of that is storage and processing, all the modeling and machine learning around that, and you just can’t optimize that the same way when it’s two vendors versus one.”

When an MDR provider acquires an endpoint security solution, Levy said it must invest heavily in data correlation, automation and analytics to ensure the combined offering provides meaningful security outcomes. Companies that fail to integrate their newly acquired technologies properly may end up with a fragmented security solution, ultimately undermining the value they intended to provide.

“When you see MDR coming from a vendor like Sophos, you’re going to get the best expert operation of that platform,” Levy said. “You’re going to get these really tight feedback loops between the evolution of the underlying technology and the expertise and efficiency with which it can be operated.”

Standalone EDR vendors are likely to become less relevant as the market shifts toward platforms that encompass endpoint, cloud, identity and network security, Schneider predicted. MDR providers that fail to expand beyond endpoint detection will likely struggle to remain competitive as cloud and identity security become the next big focus areas, according to Schneider.

Gartner Vice President and Team Manager Travis Lee expects the next phase of MDR will incorporate preemptive security measures such as deception technologies and attack surface obfuscation to anticipate and prevent attacks before they happen. In this evolving landscape, Lee said vendors that can offer holistic security solutions with AI-driven automation will have the upper hand.

“It’s predicted that we’re going to get even further to the left in coming years around preemptive activity related to obfuscation of the network and the IT environments, actual deception technologies that will make it more difficult for attackers to be able to determine what is real or what is not, utilizing the AI capabilities to bring autonomous deception techniques,” Lee told ISMG.

Organizations are increasingly prioritizing simplicity and efficiency in their cybersecurity investments and are looking for integrated solutions that provide comprehensive protection across all attack surfaces. Customers no longer want to buy separate tools for every security need, Levy said, instead preferring a unified approach where detection, response and prevention are managed within a single platform.

“Those folks that don’t have that marriage of capability, tool and platform, it will be tough sledding,” Schneider said. “Customers want to be able to work with a vendor that can help them on their security operation more holistically, not in individual silos.”