As security leaders evaluate the vast array of tools available to combat ransomware attacks, endpoint and extended detection and response solutions still stand out as the best defense against emerging threats. How can an enterprise know which of these tools is the best though? Enterprise Management Associates (EMA) surveyed IT professionals, information security practitioners, and technology business leaders across all verticals to discover their attitudes and perspectives toward XDR solutions. The primary goal was to use survey responses and third-party interviews to create a comprehensive definition of “What is XDR?” for leaders to use as part of their solution evaluation process. Check out these research slides featuring Christopher Steffen, CISSP, CISA, and vice president of research at EMA, to discover the definition and get results from this research.

1. Why Should Organizations
Consider Extended Detection
and Response (XDR)?
Christopher M. Steffen, CISSP, CISA
Vice President – Research
Enterprise Management Associates (EMA)
csteffen@enterprisemanagement.com
Sponsored by . . .

2. 2
Watch the On-Demand Webinar
• Why Should Organizations Consider Extended Detection and
Response (XDR)? On-Demand Webinar:
https://info.enterprisemanagement.com/extended-detection-and-
response-xdr-webinar-ws
• Check out upcoming webinars from EMA here:
https://www.enterprisemanagement.com/freeResearch

3. | @ema_research
Featured Speaker
Chris brings over 25 years of industry experience as a noted
information security executive, researcher, and presenter, focusing
on IT management/leadership, cloud security, and regulatory
compliance. He also serves as the co-chair of the zero trust working
group for the Cloud Security Alliance (CSA)
Chris’s technical career started in the financial services vertical in
systems administration for a credit reporting company, eventually
building the Network Operations group, as well as the Information
Security practice and Technical Compliance practice for the
company before leaving as the Principal Technical Architect. He
has been the Director of Information for a manufacturing company
and the Chief Evangelist for several technical companies, focusing
on cloud security and cloud application transformation. He’s also
held the position of CIO of a financial services company,
overseeing the technology-related functions of the enterprise. Chris
currently leads the information security, risk and compliance
management practice for Enterprise Management Associates
(EMA), a leading industry analyst firm that provides deep insight
across the full spectrum of IT and data management technologies.
Chris holds several technical certifications, including Certified
Information Systems Security Professional (CISSP) and Certified
Information Systems Auditor (CISA), and was awarded the
Microsoft Most Valuable Professional Award five times for
virtualization and Cloud and Data Center Management (CDM). He
holds a Bachelor of Arts (Summa Cum Laude) from the
Metropolitan State College of Denver.
© 2023 Enterprise Management Associates, Inc. 3
Christopher Steffen
Vice President - Research
Information Security, Risk and Compliance Management
Enterprise Management Associates
| @ema_research

4. | @ema_research
Sponsors
© 2023 Enterprise Management Associates, Inc. 4
| @ema_research

5. Research
Methodologies and
Demographics

6. | @ema_research
Demographics & Methodology
6
Which of the following best describes your organization's primary industry?
Which of the following BEST describes your
specific role (IT Related)?
31.9%
17.1%
15.2%
10.0%
4.3%
2.9%
2.4%
2.4%
2.4%
1.9%
1.4%
1.4%
1.0%
1.0%
1.0%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
IT Director
CIO/CTO
IT Manager/Supervisor (or equivalent)
VP IT
IT Administrator/System Administrator
Chief Data Officer
CISO/CSO
VP Information Security
Information Security Director
IT Project/Program Manager
IT Service Manager/ITSM Team Leader
IT Business Analyst
Director of IT Audit/Compliance
Director of Cloud Computing/Cloud…
Programmer/Developer/Engineer
Chief Compliance Officer
Chief Privacy Officer
Director of Architecture
IT Director/Manager (other)
IT Auditor/Compliance Specialist
IT Architect
IT Consultant/Integrator
Help Desk/IT Support
14.4%
12.3%
11.9%
11.4%
7.2%
4.7%
4.2%
4.2%
4.2%
4.2%
3.4%
3.0%
2.1%
2.1%
1.7%
1.3%
1.3%
1.3%
1.3%
1.3%
1.3%
0.4%
0.4%
0.4%
Manufacturing
Computer/Technology Services (IaaS, SaaS, MSP, MSSP,…
Finance/Financial Services/Banking
Computer/Technology Software (mobile app, consumer,…
Retail/Wholesale/Distribution
Healthcare/Medical/Pharmaceutical
Computer/Technology Hardware (devices, chip,…
Computer/Technology: Other
Professional Services (non-technical)
Transportation/Airlines/Trucking/Rail
Telecommunications
Utilities/Energy
Business Services/Consulting
Insurance
Automotive
Ecommerce
Education (federal, state & local)
Gaming/Digital Entertainment
Government (federal, state & local)
Oil/Gas/Chemicals
Other
Aerospace/Defense
Nonprofit/Not for Profit
Travel/Hospitality/Recreation
© 2023 Enterprise Management Associates, Inc.

7. XDR in the Enterprise
7

8. | @ema_research
© 2023 Enterprise Management Associates, Inc.
Do you envision an XDR solution or some other security tool/solution replacing your
SIEM solution your organization is currently using?
81.1%
18.9%
Yes
No
Is your organization currently using/evaluating an extended
detection and response (XDR) solution?
59.7%
26.3%
8.1%
3.8%
2.1%
Yes - currently using within our organization
Yes - currently evaluating, with funding approved to purchase in the next 3
months
Yes - currently evaluating to purchase in the next budget year
Yes - soliciting vendors/proof of concept, but no immediate plans to
purchase
No - not currently using/evaluating

9. | @ema_research
© 2023 Enterprise Management Associates, Inc.
Which technologies/products do you
expect in an XDR platform?
24.1%
20.5%
13.6%
12.6%
9.7%
8.9%
8.5%
2.0%
SIEM
EDR
Email Security
Threat Detection
NDR
ASM
SOAR
UBA

10. | @ema_research
© 2023 Enterprise Management Associates, Inc.
What is the primary use case you
are looking to solve with XDR?
60.6%
17.8%
6.8%
11.4%
1.7%
1.7%
Improve detection of advanced threats
Provide automated analyst response
Prioritize alert
Tool consolidation
EDR replacement
Alert correlation across tools

11. | @ema_research
© 2023 Enterprise Management Associates, Inc.
What are the most important orchestration capabilities
of an XDR solution?
3.34
3.16
2.95
2.78
2.76
Enrichment
Provisioning and deprovisioning
Customization (playbooks)
Visualizations
Collaboration (email, slack, tickets, etc.)
What are the most important automation
capabilities of an XDR solution?
3.44
3.36
3.04
2.85
2.31
Repetitive Task
Reporting
Low-code automation
Visualization
Alert Automation

12. | @ema_research
© 2023 Enterprise Management Associates, Inc.
Assuming XDR is the evolution of EDR beyond endpoints, which XDR capabilities
appeal to you most?
25.5%
21.5%
20.6%
19.0%
13.4%
Advanced analytics
Simplified visualization of complex attacks
Correlation and enrichment of security data from multiple security
controls
Automated cross-response capabilities
Reduction in the number of escalations to higher-skilled security
analysts

13. | @ema_research
© 2023 Enterprise Management Associates, Inc.
When considering the functions and capabilities of an XDR solution, which of the
following functions / capabilities are the most important?
8.69
8.66
8.66
8.64
8.62
8.61
8.61
8.61
8.6
8.58
8.55
8.55
Ease of Use / Management
Attack understanding/intelligence
Automated detection of zero-day attacks
Unified Threat Hunting Capabilities
Provide Automated Detection of Complex Threats with…
Enable More Threat Hunting
Imrpove Mean Time to Response (MTTR)
Integrate Visibly with Existing Tools and Data Sources
Rapid Time to Value / Ease of Deployment
Improve Mean Time to Detection (MTTD)
End-user Support from Vendor
Ingest Multiple Data Sources

14. Conclusions

15. | @ema_research
Conclusions
© 2022 Enterprise Management Associates, Inc.
XDR solutions are in line to replace
underperforming legacy security
solutions. But it isn’t always
because a solution is
underperforming, solution
complexity, deployment and
maintenance, and resource
requirements are important
factors. If an XDR solution can
easily supplant these solutions and
about 1/3 of the annual cost,
security leaders are forced to pay
attention.
.
| @ema_research
Technology leaders are looking for
in a XDR solution mimic the
capabilities of the solutions that
they are ,looking to replace,
namely SIEM and SOAR solutions.
XDR takes the core capabilities of
SIEM and SOAR solutions and
provides those insights in a simple
and easy manner to digest. For
many organizations, having a
simpler and less expensive XDR
solution to achieve those same
capabilities is likely the right
decision.
It is not enough to just point out
threats and low-level attacks:
organizations are looking to their
XDR solution to provide advanced
insights into the threat landscape..
Organizations looking to evaluate
and deploy an XDR solution would
do well to make the vendor prove
these core capabilities – not just as
a point in time, but from a tactical
and long-term perspective.
Organizations are always updating
their security tools and are looking
to XDR to help with this process
SIEM, SOAR and threat detection
are the most important capabilities
Ease of use, zero-day threat
detection, better reporting attacks,
complex analytics, and
automated reporting

16. | @ema_research
Conclusions
© 2023 Enterprise Management Associates, Inc.
Extended detection and response, or XDR, is a cybersecurity solution that:
• Integrates with existing and future security and operations tools
• Provides in-depth insights and reporting to technicians and decisionmakers
• Streamlines security operations across users, endpoints, data, networks, cloud
resources, applications and other workloads
• Applies analytics and automation to detect, analyze, hunt, and mitigate threats.
| @ema_research
Taking these considerations, functions and capabilities to create a unified
definition of “XDR”, EMA proposes the following definition:

17. | @ema_research
Get the Report
Learn more and download
https://bit.ly/3rLfcaZ
© 2022 Enterprise Management Associates, Inc. 17
| @ema_research