Gartner® Magic Quadrant™ for SIEM

How Gartner Evaluates the Vendors

Vendors are recognized as Niche Players, Challengers, Visionaries, and Leaders. 

• Niche Players focus successfully on a small segment, or are unfocused and do not out-innovate or outperform others. 
• Challengers execute well today or may dominate a large segment, but do not demonstrate an understanding of market direction. 
• Visionaries understand where the market is going or have a vision for changing market rules, but do not yet execute well. 
• Leaders execute well against their current vision and are well positioned for tomorrow.

A vendor's appearance in a Magic Quadrant one year and not the next does not necessarily indicate that Gartner has changed its opinion of that vendor. It may be a reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.

Evaluation Criteria from 2022 Gartner Magic Quadrant for SIEM

Completeness of Vision 

• Market understanding: This criterion evaluates a vendor’s ability to understand buyers’ emerging needs and how to communicate solutions effectively. SIEM vendors that show the highest degree of market understanding can identify how technology and changes in ways of working will translate into modern security operations requirements, while also meeting the business risk and ROI reporting needs of organizations.
• Market strategy: This criterion evaluates a vendor's ability to communicate the value and competitiveness differentiation of its SIEM offering. 
• Sales strategy: This criterion evaluates a vendor's use of direct and indirect sales, marketing, service, and communications affiliates to extend the scope and depth of its market reach. 
• Offering (product) strategy: This criterion evaluates a vendor's approach to product development and delivery, with an emphasis on how well functionalities and features correspond to current requirements. Development plans during the next 12 to 18 months are also evaluated. The SIEM market is mature – there is little differentiation between most vendors in areas such as support for common network devices, security devices, operating systems, and consolidated administration capabilities. Gartner assigns higher weightings to coverage of emerging event sources, such as IaaS and SaaS, and environmental context.
• Business Model: Despite vendors’ focus on expanding their capabilities, Gartner continues to value speed and simplicity of deployment and breadth of platform support. Users, especially those with limited IT and security resources, still value this attribute over breadth of coverage beyond basic use cases. SIEM products are complex and tend to become more so as vendors extend their capabilities. Vendors able to provide effective products that users can successfully use as a service — or deploy, configure, and manage with limited resources — will be the most successful. Gartner evaluates options for co-managed or hybrid deployments of SIEM technology and supporting services because growing numbers of Gartner clients are anticipating or requesting vendor-delivered service wrappers (VDSW) or security service provider partner support for monitoring or managing their SIEM technology deployments.
• Vertical/industry strategy: This criterion evaluates a vendor's strategy to support SIEM requirements specific to industries, like operational technology (OT) environments. 
• Innovation: This criterion evaluates vendors' development and delivery of SIEM technology that is differentiated from its competitors in a way that uniquely meets critical customer requirements. Product capabilities and customer use in areas such as application layer monitoring, identity-oriented monitoring, and incident investigation are evaluated. This is in addition to other product-specific capabilities needed and deployed by customers. Heavy weightings are assigned to capabilities needed for advanced threat detection and incident response: user, data, and application monitoring; ad hoc queries; visualization; orchestration and incorporation of context to investigate incidents; and workflow/case-management features.
• Geographic strategy: This criterion takes account of the fact that, although the North American and Europe, Middle East, and African (EMEA) markets produce the most SIEM revenue, Latin America and Asia/Pacific are growth markets for SIEM, and their growth is driven primarily by demand for threat management (and secondarily by compliance requirements). Gartner’s overall evaluation of vendors in this Magic Quadrant includes an evaluation of their sales and support strategies for those regions as well as product features to support local and regional compliance requirements for data residency and privacy.

Ability to Execute

• Product/service: This criterion evaluates a vendor’s ability to provide product functions in core SIEM areas such as the ability to create, modify, and maintain threat detection use cases, provide case management, support incident response activities, and generate reports to support business, compliance, and audit needs.
• Overall financial viability (business unit, financial, strategy, organization): Viability includes an assessment of the vendor's customer traction as well as the financial and practical success of its SaaS SIEM business, and indicators that it will continue to invest in SIEM technology.
• Sales execution/pricing: This criterion evaluates the technology provider's success in the SIEM market and its capabilities in presales activities. Considerations include the size of its cloud-native/SaaS SIEM revenue and installed base, flexibility of pricing models, presales support, and the distribution and inclusivity of its sales channel. The level of interest and reviewed experiences from Gartner clients is also considered.
• Market responsiveness and track record: This criterion evaluates the delivered features and alignment to client demand for adjacent SIEM capabilities and modern deployment methods as well as the track record of delivering new and differentiated functions in line with the changing needs of the market. Considerations include support for multi-cloud monitoring, cloud-native or SaaS business focus, and industry-specific support within areas such as OT.
• Marketing execution: This criterion evaluates a vendor’s SIEM market messaging in light of Gartner’s understanding of customer needs. It also identifies particular vendor-identified variations by industry or geographic segment.
• Customer experience: This criterion evaluates product function and service experience in production environments. Included are operations, administration, and vendor-support capabilities. This criterion assesses areas such as, available support and training, customization of user interfaces, and takes into account interactions with Gartner clients that are using, or have completed competitive evaluations of, a vendor’s SIEM offering.
• Operations: This criterion evaluates a vendor’s service, support, and sales capabilities. It includes an assessment of these capabilities across multiple geographies.

Rapid7's Understanding of the Gartner Magic Quadrant for SIEM

With proper context, it's possible to view a Gartner Magic Quadrant through a specific lens, providing high-impact additional perspectives by key industry, region, and company size.

The report helps to understand how a market’s technology providers are competitively positioned and the strategies they are using to compete for end-user business. It also clarifies how to compare a technology provider’s strengths and challenges with your specific needs.

Gartner also says that focusing on the Leaders quadrant isn’t always the best course of action. Market challengers, visionaries, and niche players may better support an organization’s needs versus a market leader. It all depends on how the provider aligns with the organization’s business goals.

Gartner’s interactive Magic Quadrant features enable you to create a view of the Magic Quadrant to reflect your own business goals, needs, and priorities. Most significantly, the interactive features enable you to adjust the weightings applied to each of the evaluation criteria to generate a new, client-specific Magic Quadrant graphic for that market.

Read More

Gartner Magic Quadrant: Positioning technology players within a specific market

Gartner, Magic Quadrant for Security Information and Event Management, Pete Shoard, Andrew Davies, 10 October 2022

GARTNER is a registered trademark and service mark of Gartner and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.