What comes up in conversations on endpoint detection and response (EDR) lately? A slightly different *DR.
It’s impossible to deny that extended detection and response (XDR) has taken hold of the security market as the successor to EDR. In the debut Forrester report on XDR, we even described EDR as “dead” — but perhaps a better phrase would be “mostly dead.”
EDR still serves its original purpose of detecting threats on enterprise servers and workstations, but the lines between EDR and XDR disappear as practitioners integrate additional security technologies into EDR. EDR is a stepping stone to better protection, detection, and response in the security operations center (SOC), but it’s not the first in the chain — that would be endpoint security software — nor the latest — extended detection and response. Forrester defines EDR technologies as:
Detection, investigation, and response technology that collects security-relevant telemetry from endpoints, performs anomaly detection, enables analysts to investigate from collected telemetry, and facilitates response by analysts on affected endpoints.
Today, I am happy to announce the release of Forrester’s latest Now Tech: Endpoint Detection And Response, Q4 2021. This research gives a market overview of the endpoint detection and response market, including 28 different vendors. The report segments vendors by market presence (small, medium, and large) and functionality (agent analytics, cloud analytics, and endpoint forensics and management).
Why Do This Research?
I have received a number of questions as to why I’m doing research into EDR just after doing a New Tech and a Forrester New Wave™ evaluation on XDR. The short answer is that the XDR market had a lot of macro nuances that needed to be uncovered, such as the most important driver of security team adoption, what integrations were available with what product, and whether there was something to differentiate XDR offerings that didn’t exist with their EDR origins. In contrast, the EDR market has a lot of micro nuances that need to be resurfaced — nuances that I get as questions from practitioners like you every day, such as “How does coverage differ between Windows and Linux, and what auto-remediation capabilities exist?” So long as the market continues to show growth and differentiation, and so long as enterprise client interest holds, Forrester’s Now Techs and Wave evaluations wil help us help you.
What The Research Means
Practitioners are looking to buy EDR, while EDR vendors are being pulled in two different directions: prevention and XDR. The overwhelming message that showed throughout this research is that, though EDR may have been single as a Pringle just a few years ago, it is no longer a stand-alone offering. It has transitioned to a suite of tools, requiring a prevention offering, an EDR offering, and an XDR offering to remain relevant. This is validated by the most recent MITRE ATT&CK Evaluation, which incorporated an evaluation of prevention capabilities.
Coming at it from the opposite direction, managed detection and response providers and security analytics platforms are beginning to offer their own endpoint agents, as well — further commoditizing visibility on the endpoint. It no longer matters whether you have the footprint; it matters what you do with it. This is a benefit for security pros — they have more options available to them now when it comes to endpoint telemetry collection than ever. It is also, however, driving EDR vendors to refine aspects where they can truly differentiate, such as by strengthening detection with context, automating investigation, and recommending response actions — all things that push EDR further to XDR.
As XDR picks up steam with security pros outside of the vendor echo chamber, and EDR vendors look to differentiate themselves by focusing on XDR features, EDR will continue to fade … until it actually is dead. Until then, end users will continue to look for leading EDR providers as they continue their journey to better detection and response in the SOC.
Read the report here, and get ready for a new Forrester Wave evaluation on the endpoint detection and response offerings space in Q1 of 2022!
Blog courtesy of Forrester Research and authored by Allie Mellen, analyst at Forrester Research. Read more contributed blogs from Forrester here.
