1 Executive Summary

XDR has emerged to become a leading cybersecurity tool set sought after by a range of different kinds of organizations. How does it differ from Endpoint Protection Detection & Response (EPDR) and Network Detection & Response (NDR)? XDR encompasses both EPDR and NDR, as well as security tools focused on cloud environments. For details and evaluations on EPDR and NDR, please refer to our Leadership Compasses on those subjects.

XDR is for organizations that want comprehensive observability and remediation capabilities across both endpoints and networks. One might think that XDR would subsume its EPDR and NDR rivals, except that these technical solutions are not in competition with one another. Vendors report that large enterprises still often go for a best-of-breed approach, leveraging their relationships with multiple security products that cover specific areas. Small-to-medium (SMB) sized businesses and organizations, on the other hand, are looking for that all-in-one type of tool that reduces costs, complexity, and the number of vendor contracts to manage.

What is driving interest and adoption of XDR? In a word, ransomware. Initial stages of a ransomware attack can be difficult to detect. EPDR alone may miss the signs, especially if attackers use compromised credentials rather than malware to gain a foothold in a victim organization. Attackers can often cover their tracks by wiping logs on endpoints and servers. The one place it is difficult to remove evidence from is the network; thus, having NDR capabilities installed can close the observability gap. Why not just add NDR to your EPDR; why go for XDR? Because having all the functions in a single solution is more efficient from the perspective of SMBs and mid-market sized organizations.

XDR solutions are security tools that are designed to consolidate multiple point solutions such as Endpoint Protection Detection & Response (EPDR), Network Detection & Response (NDR), Cloud Workload Protection Platform (CWPP), Cloud Security Posture Management (CSPM), Intrusion Detection Systems (IDS) & Intrusion Prevention Systems (IPS), Distributed Deception Platforms (DDP), and Unified Endpoint Management (UEM). XDR solutions also need to draw on telemetry from IAM systems, particularly User Behavioral Analytics (UBA) and Identity Governance and Administration. In our definition and view, XDR must encompass endpoint, network, and cloud aspects. This means that XDR solutions must have agents for endpoints, sensors for networks, and agents for cloud instances and containers.

The MITRE ATT&CK Framework is a comprehensive approach that addresses all the various TTPs that malicious actors use to compromise systems for the purpose of data exfiltration. Many security vendors contribute to MITRE ATT&CK, and many of their tools map detections to the various steps and techniques to facilitate analysis within their product interfaces.

As a fairly new product offering, XDR is characterized by its use of AI/ML technologies for detecting malware and analyzing behavior. XDR solutions are characterized by cloud-first technologies, with all vendors offering SaaS-hosted management consoles. Some offer cloud-hosting for customer data as well.

XDR is gaining prominence in North America, and we expect other regions to rapidly start adopting XDR as well. XDR is suitable for all organization types. It is generally a cloud-first deployment technology for its common interfaces, although on-premises components are required for endpoints and network sensors. Although the XDR term has only been around for a few years, it is catching on and is even mainstream. We are past the early adoption phase, and the XDR solutions we will review are mature product/service offerings.

For an understanding of our research approach, please see KuppingerCole Leadership Compass Methodology.

1.1 Key Findings

• XDR solutions are increasing in popularity for mid-market size organizations.
• XDR solutions simplify security architectures by combining endpoint, network, and cloud security into a single product.
• SIEMs and SOARs are not needed for XDR, although most XDR solutions retain interoperability with them.
• Data storage costs can be reduced with XDR vs. point solutions with SIEM/SOAR model.
• XDR is not an alternative to SIEM/SOAR, especially in cases where compliance reporting is required since XDR is focused on security.
• The most effective XDR solutions provide direct network sensing capabilities and do not rely on endpoint agents or logs from other devices for this function.
• As with EPDR and NDR, XDR solutions have manual and automated response features, but most organizations choose to keep a human analyst in the loop to trigger responses.
• Single vendor solutions are more tightly integrated and potentially cost-effective, but “open” XDR solutions exist that are geared toward strong interoperability with other products.
• The union of EPDR and NDR in XDR makes it easier to detect early signs of malware-less cyberattacks, where perpetrators use compromised credentials or insiders to steal data and extort victims.
• XDR solutions should encompass cloud environments, allowing for detection of threats to customers’ cloud-hosted infrastructure and data, obviating the need for a plethora of cloud security point solutions.