The 10 Coolest XDR Security Companies To Know In 2021

From dramatically reducing alerts and improving the productivity of security teams to facilitating automated incident response, here’s a look at 10 XDR security companies looking to dominate this emerging market.

The Brains Of The Operation

Extended detection and response (XDR) centralizes security data by combining security information and event management (SIEM); security orchestration, automation, and response (SOAR), network traffic analysis (NTA), and endpoint detection and response (EDR). Obtaining visibility across networks, cloud and endpoint and correlating threat intelligence across security products boosts detection and response.

An XDR system must have centralized incident response capability that can change the state of individual security products as part of the remediation process, according to research firm Gartner. The primary goal of an XDR platform is to increase detection accuracy by corelating threat intelligence and signals across multiple security offerings, and improving security operations efficiency and productivity, Gartner said.

XDR offerings will appeal to pragmatic midsize enterprise buyers that do not have the resources and skills to integrate a portfolio of best-of-breed security products, according to Gartner. Advanced XDR vendors are focusing up the stack by integrating with identity, data protection, cloud access security brokers, and the secure access service edge to get closer to the business value of the incident.

From dramatically reducing alerts and improving the productivity of security teams to facilitating automated incident response and protecting users, applications and data, here’s a look at 10 XDR security companies fighting for a leadership position in this emerging market.

Cisco Systems

Cisco has included XDR capabilities as part of each security product’s existing subscription since 2018, with more than 11,000 customers adopting SecureX threat response as part of their daily security operations to be more productive. The company in 2020 simplified breach defense by natively connecting detection to response with capabilities integrated within each other’s product consoles.

The company’s network detection and response and endpoint detection and response technologies have been natively integrated before XDR was even coined, containing 70 percent more malicious intent and risk exposure by connecting many types of machine learning-enhanced analytics. Cisco said it can also reduce detection time by 95 percent with proactive threat hunting and vulnerability management.

Cisco Secure Endpoint can reduce incident response time by up to 85 percent by accelerating the detection and automating the response to threats, according to the company. And Cisco Secure Network Analytics reduces false positives by enabling behavioral detection with agentless visibility across the network and cloud.

CrowdStrike

CrowdStrike’s XDR strategy is rooted in combining endpoint events with network visibility, account and identity insight, and massive telemetry from all workloads, regardless of where they are—on-premises, in the cloud or even deployed in a container. The company can correlate telemetry from all types of workloads together with identity and asset information, according to CrowdStrike.

The company bought Humio for $400 million in March to better ingest and analyze both unstructured and semi-structured data to address challenges within increasingly sophisticated DevOps and DevSecOps environments. Combining CrowdStrike’s real-time analytics and smart filtering with Humio’s quick log management and index-free data ingestion will further accelerate XDR, CrowdStrike said.

Endpoint security telemetry from CrowdStrike Falcon can also be contextualized and correlated with other existing data sources and security tools on cloud, network and SaaS applications, CrowdStrike said. The company will be able to enrich native applications in the CrowdStrike Store to leverage intelligence and insight for full XDR and automated workflow, enabling partners to take autonomous actions.

Cybereason

Cybereason XDR launched in November 2020 and fuses endpoint telemetry with behavioral analytics to empower global enterprises to swiftly detect and thwart cyberattacks anywhere on their networks. The product makes it possible for defenders to pinpoint, understand and end any malicious operations across the entire IT stack regardless of if it’s on-premises, mobile or in the cloud.

The product automatically surfaces anomalous network behavior and makes it easy to understand the full story behind any incident by tracking, analyzing and remediating every single action the attacker takes. Cybereason XDR correlates all attack activity and presents the intelligence as an intuitive malicious operations visualization that significantly decreases investigation and remediation periods.

Cybereason XDR recognizes the most subtle signs of compromise derived from across the whole of an organization’s network and delivers enhanced correlations across both Indicators of Compromise and Indicators of Behavior. The product also reduces mean time to respond with automated and guided one-click mitigation from a single console across all networks without the need to craft complex queries.

Fortinet

Fortinet’s FortiXDR debuted in January 2021 to reduce complexity, speed detection and coordinate response to cyberattacks across the organization, leveraging artificial intelligence for the investigation effort critical to incident response. The tool can fully automate security operations processes typically handled by experienced security analysts to mitigate threats faster across the broad attack surface.

The offering starts by leveraging the diverse security information shared across the Fortinet Security Fabric for correlation and analysis, converting them into high-fidelity security incidents. These incidents are then investigated by the artificial intelligence engine to come to a final threat classification and scope, according to Fortinet.

Finally, the best possible contextual responses are defined and can be automatically implemented by FortiXDR to quickly remediate confirmed incidents. FortiXDR also enables organizations to reduce the risk of missing potentially crippling cyberattacks like ransomware and phishing by ingesting telemetry that increases the chance of detecting and properly classifying attacks, according to Fortinet.

McAfee

McAfee MVision XDR debuted in October and offers cloud-based advanced threat management with coverage across the attack life cycle, prioritization to protect what matters, easy orchestration and efficient response. MVision XDR improves security operations centers’ effectiveness with quick risk mitigation and delivers total cost of ownership for threat response with proactive threat analytics.

The product helps organizations proactively act on external threats by allowing them to prioritize threats, predict if countermeasures will work and prescribe corrective actions. MVision XDR’s unified visibility and control across the endpoint, network and cloud makes it possible for analysts of any experience level to speed threat triage with their choice of automatic or AI-guided investigations.

MVision XDR’s unique data awareness allows for automatic prioritization of threats based on the risk and impact to the organization, with incidents assessed based on user, data classification, device, vulnerability and threat intelligence. The open and cloud-delivered security platform also simplifies integrations with external threat intelligence as well as existing SOC tools like ticketing systems.

Microsoft

Microsoft Defender prevents, detects and responds to threats across identities, endpoints, applications, email, IoT, infrastructure and cloud platforms. The company added new capabilities in September 2020, including additional support for Google Cloud and Amazon Web Services as well as support for Windows, Max, Linux, Android and iOS platforms, according to Microsoft.

Microsoft 365 Defender delivers XDR for identities, endpoints, cloud apps, email and documents, using artificial intelligence to reduce the SOC’s work items and fully automate remediation more than 70 percent of the time. Priority account protection will help security teams focus on securing users who have access to the most critical and privileged information from phishing attacks, Microsoft said.

Meanwhile, Azure Defender delivers XDR capabilities to protect multi-cloud and hybrid workloads, including virtual machines, databases, containers and IoT. The tool offers added protection for SQL servers on-premises and in multi-cloud environments as well as virtual machines in other clouds, as well as more protections for containers and continuous scanning of container images in container registries.

Palo Alto Networks

Palo Alto Networks Cortex XDR integrates endpoint, network and cloud data to stop sophisticated attacks, unifying prevention, detection, investigation and response in one platform for security and operational efficiency. Combined with Palo Alto Networks’ Managed Threat Hunting service, Cortex XDR gives users around-the-clock protection and coverage against common attack techniques.

The platform’s agent protects endpoints from malware, exploits and fileless attacks with local analysis and behavior-based protection, stopping never-before-seen issues with a single cloud-delivered agent for endpoint protection, detection and response. The agent shares protections across network and cloud security offerings from Palo Alto Networks to provide consistent security across the enterprise.

Cortex XDR identifies evasive threats by continuously profiling user and endpoint behavior with analytics, probing data from Palo Alto Networks and third-party sources to uncover stealthy attacks targeting managed and unmanaged devices. It also accelerates investigations by providing a complete picture of every threat and automatically revealing the root cause, according to Palo Alto Networks.

SentinelOne

SentinelOne Singularity seamlessly fuses together the data, access, control and integration planes of its endpoint protection, endpoint detection and response, IoT security and cloud workload protection into a centralized platform. With Singularity, organizations gain access to back-end data across the company, providing a cohesive view of their network and assets by adding a real-time autonomous security layer.

Singularity detects, responds and hunts in the context of all enterprise assets, allowing organizations to see what has never been seen before and control the unknown. SentinelOne was the first vendor to incorporate IoT and cloud workload protection into an XDR platform, providing advanced threat hunting and complete visibility across every device, virtual or physical, on-premises or in the cloud.

Then in February, SentinelOne acquired cloud-native data analytics platform Scalyr for $155 million to ingest, correlate and search data from any source and deliver real-time threat mitigation across the enterprise and cloud. By axing data schema rules from the ingestion process and index limitations from querying, Scalyr can ingest massive amounts of machine and application data in real time.

Trend Micro

Trend Micro Vision One provides deep and broad XDR capabilities that collect and automatically correlate data across email, endpoints, servers, cloud workloads and networks. Native sensors and protection points—coupled with the XDR capabilities that stitch together threat activity across layers— allow for the quick detection of complex attacks that bypass prevention.

This provides an unmatched understanding of the activity data in a customer’s environment and a balanced approach to security, as teams can quickly see the story of an attack and respond faster and more confidently. The platform offers a single place for investigators to quickly visualize the entire chain of events across security layers or drill down into an execution profile or network traffic analysis.

Meanwhile, managed XDR provides around-the-clock alert monitoring and prioritization, incident investigation and threat hunting to Trend Micro customers as a managed service. This service provides teams with efficient alert monitoring, in-depth investigations into advanced threats, and threat hunting via proprietary techniques, according to Trend Micro.

VMware

VMware for XDR provides a unified security incident detection and response platform that takes advantage of comprehensive visibility and rich context across a customer’s entire infrastructure. It automatically collects and correlates multiple sources of telemetry and enforces multiple types of control points to reduce noise and enable faster threat detection and more sophisticated response.

The platform makes it possible to evolve beyond EDR and extend sources of telemetry, analytics and enforcement across endpoints, networks and the cloud to provide automated security. VMware for XDR identifies threats leveraging legitimate applications and credentials with behavioral detection, and also enables security to extend outside the corporate network to support a distributed team.

VMware for XDR helps customers understand the full timeline of an attack campaign to remediate and harden all impacted domains, and accelerates the time it takes to resolve a threat by using automation throughout security processes. It limits operational impact when remediating threats, and gives security teams context from other domains to enable them to make informed decisions when probing a threat.