Key Criteria for Evaluating XDR Solutionsv1.0

1. Summary

Enterprise cybersecurity is typically composed of multiple solutions from various vendors, combined with a security information and event management (SIEM) and/or security orchestration, automation and response (SOAR) product to help security analysts detect and respond to cyberattacks. Traditionally, most SIEM/SOAR solutions came with out-of-the-box threat detection capabilities; however, their effectiveness relied heavily on a human in the loop to fine-tune the systems for their environment. Any such solution was limited, therefore, by the knowledge of the available security staff and required extensive maintenance to keep up with the ever-changing threat landscape. This limitation resulted in less-than-intelligent detection and a crippling overabundance of alerts. Ultimately, when a solution is dependent on the knowledge of security staff, real threats are drowned out by noise and remain undetected.

Now, a newer kind of threat detection technology—extended detection and response (XDR)—distributes detection and response across the security stack to provide ubiquitous coverage from endpoint to cloud by delivering unified visibility, control, and protection. XDR collects telemetry and leverages artificial intelligence (AI), machine learning (ML), or other statistical analysis methods to correlate event logs and then evaluates them against intrusion response frameworks. Additionally, XDR systems integrate threat intelligence to enhance and improve threat detection capabilities. Having the full security stack telemetry funnel through an analytics engine enriched with up-to-date threat intel and measured against intrusion frameworks doesn’t provide a silver bullet for security, but it’s as close to “security in a bag” as you can get at this time.

XDR attempts to address the security skills gap by reducing the need for experienced security analysts and instead using AI, ML, and statistical methods to generate threat intelligence-driven analysis. It identifies connections between seemingly unrelated network activities to uncover sophisticated attacks. Further, automated remediation responses reduce the mean time to respond (MTTR) to a potential incident.

The GigaOm Key Criteria and Radar reports provide an overview of the XDR market, identify capabilities (table stakes, key criteria, and emerging technology) and evaluation metrics for selecting an XDR platform, and describe in detail those vendors and products that excel. These reports give prospective buyers an overview of the top vendors in this sector and will help decision makers evaluate solutions and decide where to invest.