Extended Detection And Response Platforms

The third edition of this Wave shrank the field from fourteen vendors to seven and added identity and cloud as detection surfaces. The name says detection and response. The scorecard now scores platform replacement.

The Forrester Wave: Extended Detection And Response Platforms, Q2 2026 published in June 2026, the third iteration after 2021 and 2024.

The field that shrank to seven

Fourteen vendors in 2021. Eleven in 2024. Seven in 2026. The market was not shrinking. It was consolidating into platforms.

Principal analyst Allie Mellen announced the edition on June 25, 2026 and said the smaller list was deliberate: the evaluation prioritized "the vendors that have the most significant traction and differentiation in this year's evaluation."

The seven: Bitdefender, CrowdStrike, Elastic, Microsoft, Palo Alto Networks, SentinelOne, and TrendAI.

Read the absence list against 2024. The 2024 Challengers, Broadcom and Fortinet, are gone. The 2024 Contenders, Cisco, Sophos, and Trellix, are gone. Seven vendors is a shortlist pretending to be a market, or a market that has become a shortlist. Either way, the entry bar is now a platform, not a product.

The report under the name: The Forrester Wave: Extended Detection And Response Platforms, Q2 2026

Mellen's blog title is "Platformization, AI, and … AI," and the two words carry the edition. XDR vendors are "definitively building detection and response platforms to cover more domains with more specificity in detection capabilities than has been done before."

The criteria changed in three ways that read like a list of where attacks were being missed. Identity became its own detection surface. Cloud became its own detection surface. Threat intelligence became its own criterion, driven in part by geopolitical change. And AI agents and agentic systems were split out of the machine learning criterion entirely, because Mellen's view is that "the value of AI in security operations is picking up speed through AI agents" in SOC triage and investigation.

One sentence in the post records the market's biggest shift without drama: "Microsoft has now merged Defender XDR and Sentinel into one unified analyst experience." SIEM replacement, experimental two years ago, is now a scored reality. The XDR Wave has quietly become the SIEM replacement Wave.

The criteria that redrew the market

The new detection surfaces are not cosmetic. Mellen frames identity and cloud as "two of the most important domains" for catching attacks that would otherwise be missed, and she names Palo Alto Networks consolidating Prisma Cloud into its Cortex platform as the vendor motion that matches.

Threat intelligence as a native criterion is the second tell. XDR vendors are "rightly prioritizing timely, accurate, and native threat intelligence more than ever," which is analyst phrasing for: the data you feed the platform now decides the score.

The AI split is the third, and the sharpest. Machine learning and AI agents are scored separately, and the report's stated differentiator is not the agent's capabilities. It is "the testing and validation strategies that vendors use." A separate AI criterion is the scorecard saying the demo is over and the validation is the product.

The two placements the field confirmed

Two of the seven placements have surfaced publicly, and they happen to be the two halves of this market's argument.

CrowdStrike announced a Leader placement with the highest Current Offering score of all vendors and maximum scores in Innovation and Community. Forrester called its AI agents "a clear differentiator" in the analyst experience. CrowdStrike is also running its AIDR business as its own category, reporting two hundred fifty percent sequential ARR growth in under two quarters, and its acquisitions, SGNL for identity security and Seraphic for browser runtime security, map exactly onto the new detection surfaces.

Elastic announced a Strong Performer placement, with Forrester's citation reading like the open-alternative answer: "Elastic's SIEM-replacement features are strong as it ingests a wide-range telemetry at scale." The differentiation is openness: Elastic Common Schema, OCSF, and OpenTelemetry, plus AI features like Automatic Migration and Attack Discovery.

The remaining five placements have not surfaced publicly, and this article assigns no tiers the public record does not support.

How the podium moved from 2024

The 2024 edition was a completeness contest, and it was close. Microsoft took first place on the highest scores in strategy, current offering, and market presence, top across fifteen of twenty two criteria, with Forrester calling Defender XDR "the most complete XDR offering in the market today," embedded Copilot for Security included. Palo Alto Networks took second on two hundred plus data sources and thirty six billion daily events, cutting average protection time from a day to roughly ten seconds. CrowdStrike took third on its LogScale migration, seven plus petabytes of data per day.

Trend Micro, Bitdefender, and SentinelOne filled the Strong Performer band. Cisco, Sophos, and Trellix were Contenders. Broadcom and Fortinet were Challengers.

Two years later, the podium moved. CrowdStrike now holds the highest Current Offering score, and the movement is the story: the 2024 podium was won on completeness, the 2026 one on agents. Completeness got commoditized. Agentic triage, identity, and cloud are the new coin.

Three questions for the shortlist the market became

Are you buying detection or platform replacement? The scorecard now scores SIEM replacement as a live capability. If your SIEM stays, half this scorecard may not describe your purchase. Decide which half before you weight the tiers.

Which detection surfaces are yours: identity, cloud, or endpoint? The new criteria exist because attacks were missed in those domains. Match your highest-risk surface to the vendor's maximum scores, not to the vendor's tier.

What validates the AI agents? The stated differentiator is testing and validation strategy, not capability claims. Ask for the validation evidence behind triage and investigation agents on your own telemetry, and treat silence as a score.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.

A close neighbor in Forrester's own coverage is Managed Detection And Response, where forrester's third installment of this Wave ran every finalist through four live attack scenarios, insider threat, SaaS account takeover, help desk social engineering, and supply chain poisoning, and told buyers to use the same four as their own proof of concept.