Frost Radar™: Global
Managed Detection
and Response Market,2022
A Benchmarking Systemto Spark Companies toAction - Innovation ThatFuels New Deal Flow andGrowth Pipelines
Global Security Research Team at
Frost & Sullivan
0000-00

Strategic Imperativeand GrowthEnvironment2Strategic Imperative• The lack of security professionals is becoming more pronounced with each passing year. In the US alone,nearly half a million cybersecurity jobs were unfilled by August 2021.
• Lacking access to professionals and unable to effectively protect their businesses, organizations turn to managed
services to cover their security needs. MDR service providers have experienced professional teams that cansupport organizations in the form of threat detection and response.
• Organizations seeking to upgrade their threat detection and response capabilities will increasingly make use ofMDR services, relying on the service providers’ vast knowledge, expertise, and monitoring capabilities. Due tothis, they will be able to allocate their resources to other, more strategic tasks.
• In the next five years, as the Everything-as-a-service model spreads further, organizations will escalateinvestment and deployment of MDR services.
• In light of the shortage of cybersecurity professionals, organizations are looking for ways to automate the processof threat detection and response. The new generation of solutions and services promises to deploy machinelearning and artificial intelligence, automating decision-making to improve the overall performance of thesecurity stack.
• But meaningful automation is still in the early stages of development. Organizations are aware that technologies
provide limited benefits right now, and seek alternative paths to success.
• Organizations looking to boost the limited capacities of current automation technologies can lean into MDR for
their needs. Highly trained security professionals can complement machine learning algorithms and AI for
unmatched incident response.
• In the next five years, while MDR providers continue to develop and perfect meaningful automation, security
services and solutions that provide a combination of human teams and automation will thrive in the market.
Source: The Washington Post; Frost & Sullivan

K6FE-743Strategic Imperative (continued)• Over the past decade, security incidents have increased in frequency and sophistication. An increasing number ofcyberattacks are sponsored by nation-states, while the attack surface continues to expand in a time of rapid
digitalization.

• Due to the sophisticated nature of the threats, organizations find it increasingly difficult to keep up to date withnew developments in cybersecurity and to secure their business assets efficiently relying on in-house experts.
• On February 24th, 2022, Russia began an invasion of Ukraine with a wide-ranging attack on multiple fronts.
The destruction of the country’s infrastructure, devastating loss of life of both military personnel and civilians,
as well as the displacement of millions of people will have long-lasting consequences at a global scale.

• A new divide between West and East will bring about a profoundly different global geopolitical context, and thiswill have implications for the cybersecurity industry as a whole. Attacks sponsored by nation-states were alreadyon the rise. After the economical and political sanctions that the US and the EU (backed by the majority of theworld’s nations) are imposing on Russia, these types of attacks may increase.
• A silver lining for the cybersecurity industry, organizations will need security solutions and services to provide
comprehensive protection of their environments. MDR’s 24/7 monitoring, threat hunting, incident response, andprofessional guidance will be essential for both large enterprises and SMBs of all regions looking for an edge overthe new threat. MDR’s promise will resonate with organizations for the foreseeable future.

Source: The Guardian; Frost & Sullivan

K6FE-744

Growth Environment• MDR is a relatively new solution in the cybersecurity market. While some vendors have been providing services
similar to MDR in the form of SOC-as-a-service or various MSS offerings, the inception of MDR goes back to 2018
for the earliest competitors. The novelty of the solution means that the market is just passing the early adopters
stage – MDR is starting to be picked up by an early majority of customers in 2021.
• Growth rates for the market show a decrease, from 79.8% growth in 2020 to 60.8% in 2021. However, the CAGR
is still very high at 34.0%. There is ample room for growth across all regions, and in every industry vertical orcompany size.
• The MDR market is currently receiving an influx of new competitors. Some are pure-play cybersecurity
companies, coming from the XDR or EDR space, adding a managed component to turn the solution into a service.
MSSPs have also developed their own MDR services, looking to establish a long-lasting relationship with theircustomers, and deepening the threat detection and response they can provide. Furthermore, there are also
professional services firms, and other security vendors jumping at the opportunity to increase their alreadybroad portfolios with an MDR offering.
• In the long term, the scarcity of cybersecurity professionals will boost the MDR market growth, as the issue
will persist (and possibly deepen) for the rest of the forecast period. MDR currently offers a solution to themost pressing limitations and complications with the cybersecurity industry, and Frost & Sullivan expects thiswill ensure the success of the service in the next three years.
• Additionally, the market may grow due to an even larger influx from XDR vendors. Frost & Sullivan’s study on
XDR uncovered the three promises of XDR. The most underdelivered of these promises is that of meaningful
automation. The managed component of MDR and managed XDR allows vendors to bypass the need for true
automation. As more vendors try to carve out a niche in the market, they may resort to turning their solution into
a service in this way.
Source: Frost & Sullivan

K6FE-745

Frost Radar™
Managed Detectionand Response6Frost Radar™: Global MDR Market
FROST RADARTM

Key: AT&T Cybersecurity appears as AT&T in the image; Booz Allen Hamilton appears as BAH in the image.

Source: Frost & Sullivan

K6FE-747

WithSecure (formerly F-Secure Business)
INNOVATIONGROWTHFROST PERSPECTIVE• WithSecure provides MDR services through its• WithSecure will outpace average market• While WithSecure already has business inCountercept platform. The service’s utmost
goal is True Partnership – to act as anextension of the client’s security team.
• Even when there are no alerts to report,
WithSecure aims to deliver peacetime value

growth by a large margin for the next threeyears, positioning itself as one of thegrowth leaders in MDR.
• WithSecure’s Countercept works in
Windows, macOS, or Linux operating

via telemetry-driven insights to increase
security posture and improve the customers’
readiness.

systems. This makes it more broadly
appealing and gives it a reach advantage
over other competitors.

• Every level of the Countercept subscription
includes Incident Response days, which the• The vendor’s maxim of providing
peacetime value fundamentally changes

customer can freely exchange for Incident
Readiness at will.

the value proposition of WithSecure.
It forces customers to face the fact thatcybersecurity is not a cost center,but a business enabler. WithSecure• WithSecure also provides extra services ormodules that increase the value of theirportfolio, such as penetration testing or Cloud
Security Posture Management. This service
identifies dangerous misconfigurations within
the customer’s cloud platforms to prevent
easily avoided breaches, and help thecustomer learn more about their ownenvironment.

acknowledges that alertness and readinessfor future threats and breaches areinvaluable. Thus, it offers flexible options
for customers with Incident Response days.
• Based in Helsinki, Finland, WithSecure’s
mostly European customer base will growfaster than average in the next three years.

North America, the vendor should consider
partnering with MSSPs or resellers in theregion to carve out a bigger niche in thatmarket. North America will continue to be
the biggest contributor to global MDR
revenue for the foreseeable future, andWithSecure should take advantage of theregion’s largely greenfield nature.
• WithSecure can use a similar strategy inAPAC and Latin America, where thevendor’s peacetime value and approach tocybersecurity will attract organizations on
their digital journey.
• WithSecure should increase the amount ofintegrations that its MDR and XDR platform
can offer. As cyber threats continue toevolve, customers will increasingly needand demand more telemetry to secure theirgrowing perimeters. Endpoints, network,cloud, OT, IoT, and more coverage will berequired.
Source: Frost & Sullivan

K6FE-748

Frost Radar™
Analytics

9

Frost Radar™: Benchmarking Future Growth Potential
2 Major Indices, 10 Analytical Ingredients, 1 Platform
GROWTH INDEX ELEMENTSVERTICAL AXIS
Growth Index (GI) is a measure ofa company’s growth performanceand track record, along with its
ability to develop and execute afully aligned growth strategy andvision; a robust growth pipeline™
system; and effective market,competitor, and end-user focusedsales and marketing strategies.

• GI1: MARKET SHARE (PREVIOUS 3 YEARS)This is a comparison of a company’s market share relative to its
competitors in a given market space for the previous 3 years.

• GI2: REVENUE GROWTH (PREVIOUS 3 YEARS)This is a look at a company’s revenue growth rate for the previous 3 years
in the market/industry/category that forms the context for the given
Frost RadarTM.

• GI3: GROWTH PIPELINE™
This is an evaluation of the strength and leverage of a company’s growth
pipeline™ system to continuously capture, analyze, and prioritize its
universe of growth opportunities.

• GI4: VISION AND STRATEGYThis is an assessment of how well a company’s growth strategy is alignedwith its vision. Are the investments that a company is making in newproducts and markets consistent with the stated vision?

• GI5: SALES AND MARKETING
This is a measure of the effectiveness of a company’s sales and marketing
efforts in helping it drive demand and achieve its growth objectives.
K6FE-74

10Frost Radar™: Benchmarking Future Growth Potential
2 Major Indices, 10 Analytical Ingredients, 1 Platform
INNOVATION INDEX ELEMENTS
HORIZONTAL AXIS
Innovation Index (II) is a measureof a company’s ability to develop
products/services/solutions (witha clear understanding ofdisruptive Mega Trends) that are
globally applicable, are able toevolve and expand to serve
multiple markets, and are alignedto customers’ changing needs.

• II1: INNOVATION SCALABILITY
This determines whether an organization’s innovations are globally
scalable and applicable in both developing and mature markets, and also
in adjacent and non-adjacent industry verticals.

• II2: RESEARCH AND DEVELOPMENT
This is a measure of the efficacy of a company’s R&D strategy, as
determined by the size of its R&D investment and how it feeds theinnovation pipeline.

• II3: PRODUCT PORTFOLIOThis is a measure of a company’s product portfolio, focusing on therelative contribution of new products to its annual revenue.

• II4: MEGA TRENDS LEVERAGE
This is an assessment of a company’s proactive leverage of evolving,long-term opportunities and new business models, as the foundation ofits innovation pipeline. An explanation of Mega Trends can be found here.

• II5: CUSTOMER ALIGNMENTThis evaluates the applicability of a company’s
products/services/solutions to current and potential customers, as well as
how its innovation strategy is influenced by evolving customer needs.
K6FE-74

11Legal Disclaimer
Frost & Sullivan is not responsible for any incorrect information supplied by companies or users.
Quantitative market information is based primarily on interviews and therefore is subject tofluctuation. Frost & Sullivan research services are limited publications containing valuable market
information provided to a select group of customers. Customers acknowledge, when ordering or
downloading, that Frost & Sullivan research services are for internal use and not for generalpublication or disclosure to third parties. No part of this research service may be given, lent, resold, ordisclosed to noncustomers without written permission. Furthermore, no part may be reproduced,
stored in a retrieval system, or transmitted in any form or by any means—electronic, mechanical,photocopying, recording, or otherwise—without the permission of the publisher.
For information regarding permission, write to:
Frost & Sullivan
3211 Scott Blvd., Suite 203
Santa Clara, CA 95054© 2022 Frost & Sullivan. All rights reserved. This document contains highly confidential information and is the sole property of Frost & Sullivan.
No part of it may be circulated, quoted, copied, or otherwise reproduced without the written approval of Frost & Sullivan.

K6FE-74

12