Time to Contain

Rankings by buyer type

The same scores under five sets of weights. Each ranking is recomputed in code, and the weights sum to 100.

5rankings

Five buyer types

Regulated financial
Banks, insurers and asset managers whose security team must show a reviewer what an automated action did, on what evidence and who approved it, and whose data may not leave a named region. Leader: D3 Security, 7.51.
Lean team
A security team of one to five people with no engineer to build and maintain playbooks, who needs the platform to work from published pricing and direct detection sources. Leader: D3 Security, 6.73.
MSSP
A managed security provider running response for many customers on different tool stacks, who needs breadth of integrations, per-customer separation and a defensible record for each client. Leader: D3 Security, 7.21.
Microsoft estate
A team whose endpoints, identity, email and cloud sit mostly in Microsoft Defender, Entra ID, Exchange Online and Azure, and whose containment actions run against those products. Leader: D3 Security, 6.91.
CrowdStrike estate
A team that runs CrowdStrike Falcon for endpoint and identity, and wants containment actions to run against Falcon, with other tools as secondary. Leader: D3 Security, 7.01.