Analyst report
Gartner® Market Guide for Managed Detection and Response Services
Get the report
What’s inside this Market Guide?
This Gartner® Market Guide for Managed Detection and Response Services is for anyone considering MDR service providers.
According to Gartner, “By 2028, 50% of findings from managed detection and response providers will be focused on, or include detail on, threat exposures, up from 20% today.”
Wondering if you need the full report? Inside, you’ll find insights like:
- “Use MDR services to obtain 24/7, remotely delivered, human-driven security operations capabilities when there are no existing internal capabilities. MDR services should also be used when the organization needs to accelerate or augment existing security operations capabilities.”
- “Investigate whether the MDR provider’s service can align with your business-driven requirements by using RFPs and proofs of concept (POCs), and if necessary, by validating core, must-have requirements such as data residency requirements. Determine whether it can provide actionable findings that internal teams can successfully react to, rather than settling for recited technology outputs with no added analysis.”
What does Gartner look for in MDR services?
According to the 2025 report, Gartner identifies the following as core MDR requirements:
- 24×7 staffing with skills in threat monitoring, detection, threat hunting, and threat intelligence
- Availability of immediate remote mitigation, investigation, and containment, beyond alerting and notification
- Human-led service that engages daily with individual customer data
- Actionable findings aligned to business-focused risks, not just recited technology outputs
- Ability to align with business-driven requirements validated through RFPs and proofs of concept
Who is this report for?
This guide is written for security and risk management leaders evaluating MDR services, which are typically CISOs, security directors, and procurement teams building a vendor shortlist. It’s most useful for organizations that are new to MDR, expanding existing security operations, or reassessing their current provider.
Want Expel’s take on the 2025 findings? Read our analysis of what changed this year, and why Expel was recognized for the seventh consecutive time.
Gartner, Market Guide for Managed Detection and Response Services, Pete Shoard, Andrew Davies, Angel Berrios, 1 October, 2025.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and is used herein with permission. All rights reserved.
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Expel.
Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
The Gartner Market Guide for MDR Services is an annual research publication that defines the MDR category, identifies representative vendors, and establishes what security leaders should expect from a qualified MDR service. Unlike the Magic Quadrant, it doesn’t rank vendors—it maps the market and provides evaluation criteria.
According to the 2025 Gartner Market Guide for MDR Services, MDR providers must deliver: 24×7 human-led staffing with threat monitoring and hunting expertise, immediate remote mitigation and containment beyond alerting, daily engagement with individual customer data, and actionable findings aligned to business risk, not just technology outputs.
The report is written for security and risk management leaders evaluating MDR services—typically CISOs, security directors, and procurement teams building a vendor shortlist. It’s the most useful for organizations new to MDR, expanding security operations, or reassessing an existing provider.
Yes. Expel has been recognized as a Representative Vendor in the Gartner Market Guide for Managed Detection and Response Services for seven consecutive years, including the 2025 edition.