Introduction: a maturing market sector
In the nearly three years since the first market
guide for MDR was published by Bloor Research,a great deal has changed. At that point, themarket was extremely muddied. A whole hostof vendors in the detection and response space
were touting the services that they offered,many based on their own technology offerings
that were largely focused on endpoint detection
and response (EDR). They cited the complexityof detection and response technologies, theinability to hire and retain skilled security staff
and the need for speed in tackling ever moresophisticated security incidents.

At that time, Bloor Research split the vendors
into EDR vendors offering services on top of
their offerings versus those that were pure-play,technology-agnostic versus managed service
providers that were trying to break into the MDR
market. Today, many of the EDR vendors havemorphed into extended detection and response(XDR) vendors, extending the telemetry that they
investigate beyond endpoints. Yet, many still basetheir services around their own technology.
This market guide focuses on technologyagnostic MDR providers. Those selected for thisresearch are the most often cited by end users
and rival providers as being the leading service
providers in this market.

Figure 1:
The highest scoring companies are nearest thecentre. The analyst then defines a benchmark
score for a domain leading company from theiroverall ratings and all those above that are in
the champions segment. Those that remain areplaced in the Innovator or Challenger segments,depending on their innovation score. The exact
position in each segment is calculated based on
their combined innovation and overall score.

MarketUpdate

MDR market update 2023
…a maturing market

Champion
Orange Cyberdefense
BlueVoyantMandiantExpel

Fortra’s
Alert Logic
KudelskiSecurity

KrollRapid7
eSentireSophos

WithSecure
Arctic Wolfervanong

Inlle

torCha© 2023 Bloor		1

Expanding telemetry
All the vendors included in this report have taken,
or are moving towards, a multivendor approach
to offer the best combination of technologies
and to ensure that organisations can continue tobenefit from investments that they have alreadymade. Telemetry from multiple sources is key toprovide visibility across the entire network andto expand available attack surface management.
Most providers are focusing on expanding theintegrations that they offer.
Endpoints are still important, more so given theincrease in remote working over the past coupleof years, but most have expanded to include moretelemetry from the network in an XDR approachfor detection and response. SIEM is seeing aresurgence alongside network feeds, providing
good capabilities for detection when feeds aresent to such systems, although it is less suited forinvestigations. Inclusion of operational technology
and internet of things devices are expanding.
Major focus on cloud services
Cloud services are growing massively inimportance, with take up being driven by
a number of factors, including the remote
workforce. Expanding their cloud offerings is a
key focus of development for most MDR providers
and they are looking to support demand forhybrid and multicloud deployments among end
user organisations. This is a recent development
for some that had been focusing on providing
MDR support for offerings from different cloudproviders.
Expansion of identity management services
Managing identities and associated privileges isessential and getting more so. Credentials area prime target for many attackers, especially interms of social engineering attacks, with someproviders beginning to offer managed security
awareness services. The number of partnerships
with identity management vendors is growing andis set to continue to do so.
Identities are also a key attack vector
in the cloud, with less exploitation of cloudservices themselves than identity. DevOps andKubernetes deployments are mainstream, withExpel estimating that some 70% of organisations© 2023 Bloor		are using Kubernetes. There is a pressing needto monitor what is going on inside containers
in order to limit threats. Many service providers
are adopting a zero trust approach where noentitlements greater than needed are granted
and can be provided on an as-needed basis, thenremoved once the task for which they are granted
has been completed.
Much greater emphasis on incident response
Yes perhaps one of the most importantdevelopments being seen in the MDR market isthe development of more robust incident response
capabilities. This is an area that many felt waslacking, with threat detection having been agreater area of focus. Response is seen as thehardest part for end user organisations and is anarea where they are looking for more help.
MDR providers are responding by ramping
up their capabilities. This includes increasing
automation, especially for mundane tasks. Many
MDR providers are expanding their playbook
offerings, which offer a guided response fordifferent types of incidents, including steps thatshould be followed.
However, human expertise is still essential,
so organisations looking to take MDR services
should look closely at what the provider offers
and their level of in-house expertise. Intelligenceis key, both in terms of threat intelligence from awide range of sources, which can greatly help to
inform threat hunting activities, as well as that
intelligence gathered through detections andprevious experience. Most services have machinelearning and advanced analytics built into theirofferings. Those that provide visibility into
ongoing investigations via interactive dashboards
are particularly popular.
Many providers are developing a strong
knowledge of attacker groups and the tools,techniques and processes that they use throughadversary research and intelligence. Knowledge
at a local or regional level is sought after insome jurisdictions, with georestrictions very
important in some geographies, as is a local touch.
Accordingly, those service providers withouta strong international presence are looking at
expansion into new regions.

MarketUpdateDevelopmentsin the MDR market

2More focus on risk management
Digital risk management and resilience is anotherarea where developments are being seen. In part,
this is driven by the expansion of digital footprints
from external sources and the need for greater
visibility of third-party risk as supply chain attacks
continue to grow. Organisations are increasingly
deploying more network and collaboration tools,
which must be effectively controlled to manage
overall risk. There is a corresponding increasein the offer of more ancillary services, including
offensive security such as red teaming, pen testingand in terms of vulnerability assessments andmanagement. Overall, there is increasing demand
for more end-to-end MDR.

© 2023 Bloor		

Vendor landscape:
MDR is a very dynamic growth area
The MDR service providers included in this report
are all seeing high levels of growth as threat
detection and response is coming to be seen as
a must-have by the majority of organisations.
Several are valued at more than $1 billion. There
have been a flurry of acquisitions: Alert Logic wasacquired by HelpSystems in April 2022, which has
now been renamed Fortra, Redscan by Kroll inMarch 2021, Mandiant by Google for $4.5 billion
in September 2022 and Sophos by Thoma Bravo
in February 2020. In July 2022, F-Secure split out
its enterprise business to form WithSecure. Two ofthe providers featured here, Orange Cybersecurity
and Rapid7, are public companies. Some havereceived substantial funding over the past coupleof years, including Arctic Wolf, BlueVoyant andExpel. This dynamism is expected to continue forthe foreseeable future.

MarketUpdate

More providers catering for the midmarket
Another key area of development in the MDR
services market is a greater focus on themidmarket, where very high levels of growth
are being seen. Many are tailoring their services
to the needs of this market sector, with somebringing out special offerings on a SaaS basisthat remove some of the pain in onboarding andongoing management of such services for smallerorganisations that often have fewer capabilities
themselves than larger enterprises. Some areoffering to manage entire security operation
centres on behalf of their customers. Many cite
the increasing uptake of MDR capabilities fromMicrosoft, which is seeing growth that is fourfold
and uptake is high in the midmarket. In particular,
Office 365 is seen as a particular risk and manyorganisations are looking for help with theirdeployments of Microsoft Defender.

3

MDR services can vastly help organisations toimprove their security postures, shield themfrom threats and mitigate incidents that occur.
The service provider will monitor feeds from anorganisation’s technology estate, including the useof external services such as those in the cloud.
Whilst automation is on the rise, especially for
mundane tasks, the expertise of the provider’sstaff is essential for providing the best outcomes.
Any of the vendors included here is a viablechoice, although offerings vary.

© 2023 Bloor		MarketUpdate

Summary and conclusions

4FRAN HOWARTH
Practice Leader, Security

ran Howarth specialises in
the field of security, primarily
information security, but with akeen interest in physical security and how
the two are converging. Fran’s other mainareas of interest are new delivery models,such as cloud computing, information
governance, web, network and application
security, identity and access management,and encryption.
Fran focuses on the business needs
for security technologies, looking at thebenefits they gain from their use and howorganisations can defend themselves
against the threats that they face in anever-changing landscape.

F© 2023 Bloor		For more than 20 years, Fran has
worked in an advisory capacity as ananalyst, consultant and writer. She writes
regularly for a number of publications,
including Silicon, Computer Weekly,
Computer Reseller News, IT-Analysis andComputing Magazine. Fran is also a regularcontributor to Security Management
Practices of the Faulkner Information
Services division of InfoToday.

MarketUpdate

About the author

5Technology is enabling rapid business evolution. The opportunities are immense
but if you do not adapt then you will not survive. So in the age of Mutable business
Evolution is Essential to your success.
We’ll show you the future and help you deliver it.
Bloor brings fresh technological thinking to help you navigate complex business situations,converting challenges into new opportunities for real growth, profitability and impact.
We provide actionable strategic insight through our innovative independent
technology research, advisory and consulting services. We assist companies
throughout their transformation journeys to stay relevant, bringing fresh thinking tocomplex business situations and turning challenges into new opportunities for realgrowth and profitability.
For over 25 years, Bloor has assisted companies to intelligently evolve: by embracing
technology to adjust their strategies and achieve the best possible outcomes. At Bloor,
we will help you challenge assumptions to consistently improve and succeed.

Copyright and disclaimer

This document is copyright ©2023 Bloor. No part of this publication may be
reproduced by any method whatsoever without the prior consent of Bloor Research.
Due to the nature of this material, numerous hardware and software products have been
mentioned by name. In the majority, if not all, of the cases, these product names areclaimed as trademarks by the companies that manufacture the products. It is not Bloor
Research’s intent to claim these names or trademarks as our own. Likewise, company
logos, graphics or screen shots have been reproduced with the consent of the owner andare subject to that owner’s copyright.
Whilst every care has been taken in the preparation of this document to ensure thatthe information is correct, the publishers cannot accept responsibility for any errors oromissions.

© 2023 Bloor		MarketUpdate

Bloor overview

6Bloor Research International Ltd
20–22 Wenlock RoadLONDON N1 7GU
United Kingdom
tel: +44 (0)1494 291 992
web: www.Bloorresearch.com
email: info@Bloorresearch.com