Proactive Security Platforms

Forrester spent two years telling the market that attack surface management was a feature rather than a market. The evaluation that replaces it landed on 24 September 2026, and its customer-feedback data points somewhere the ranking does not.

The Forrester Wave: Proactive Security Platforms, Q3 2026 named two Leaders, Wiz and CrowdStrike. Neither carries a halo. The one vendor whose own reference customers rate it above average on the report's measures, strongly enough to earn the Customer Favorite designation, is TrendAI, and TrendAI is a Strong Performer.

That gap is the most useful thing in the report. A placement describes Forrester's assessment of a current offering and a strategy against twenty-one criteria. A halo describes what the vendor's reference customers said. They answer different questions, and this edition answers them differently for nearly every vendor on the chart.

The customers picked a band below the top

Forrester marks customer feedback with rings around a vendor's dot. A single ring means the vendor's customers rated it above average. Two rings mean it is a Customer Favorite. Of the twelve vendors plotted, exactly two carry a ring at all.

TrendAI carries two. Axonius carries one. Wiz, CrowdStrike, Qualys, Tenable, Rapid7, Microsoft, ServiceNow, XM Cyber, Palo Alto Networks and Tanium carry none.

So the vendor with the strongest customer signal in the evaluation is not a Leader, and the two Leaders have no customer signal above average at all. That is not a contradiction in the data. It is a statement about how narrow the top of this market is. A platform can score at the top of a twenty-one criterion model and still have customers who report an average experience of it, because the criteria measure capability rather than satisfaction.

The reverse is the more actionable half. TrendAI's customers rate it above average across the board, and Forrester still placed it in Strong Performers rather than Leaders. A buyer selecting on reference calls alone would reach a different shortlist than a buyer selecting on the criteria scores, and both would be reading the same report correctly.

What the Q3 2026 Forrester Wave for Proactive Security Platforms scored

The edition is dated Q3 2026 and carries the subtitle "The 12 Providers That Matter Most And How They Stack Up." Vendors published their placements on 24 September 2026. The analyst of record is Erik Nost, whose name sits on both predecessor evaluations and on the November 2025 blog that set up this one.

Twenty-one criteria produce the two axes. Forrester defines the market as a platform that consolidates assets and exposures with an organizational perspective, prioritizes the optimal remediations, and augments and orchestrates the remediation process. Under that definition sit three principles: asset discovery and visibility, contextual prioritization, and remediation orchestration.

The third principle is the one that decides this chart, and it is the one that took the longest to arrive. Forrester's own framing is that the market moved from attack surface management collecting visibility, to exposure management modernizing prioritization, to action as the next frontier. Vendors that could see everything and remediate nothing scored like vendors that could see everything and remediate nothing.

Two Leaders, seven Strong Performers, three Contenders

The full field, in the bands Forrester drew:

Wiz and CrowdStrike are the Leaders. Wiz sits at the top of the offering axis and reports the highest possible score of 5.0 out of 5.0 in eight of the twenty-one criteria. CrowdStrike sits furthest right on the strategy axis among the two.

Qualys, Axonius, TrendAI, Tenable, Rapid7, Microsoft and ServiceNow are the Strong Performers. XM Cyber, Palo Alto Networks and Tanium are the Contenders.

The chart draws no Challengers band. Its figure labels three zones and separates them with two curves, which makes this one of the small number of Wave editions where an entire tier goes unused. The practical effect is that the distance between the bottom of Contenders and the top of Leaders is shorter than the four-band layout buyers are used to reading, and the three vendors in Contenders are closer to the middle of the market than that label usually implies.

The attack surface management Leaders did not stay at the top

This is where the report gets interesting for anyone who read the 2024 edition.

The Forrester Wave: Attack Surface Management Solutions, Q3 2024 evaluated eleven vendors and named CrowdStrike, Palo Alto Networks and Trend Micro among its Leaders. Two years later, in the market that replaced it, CrowdStrike is still a Leader. Palo Alto Networks is a Contender. Trend Micro, now selling its enterprise security under the TrendAI brand, is a Strong Performer.

The vulnerability management vendors moved the other way. Qualys and Tenable were Strong Performers in the 2024 attack surface management evaluation, and Rapid7 was a Contender. All three are Strong Performers here. The vendors whose original strength was finding things that needed fixing gained ground on the vendors whose original strength was mapping what existed, which is what a market that has decided remediation is the frontier should do to its own rankings.

One caution on that reading. The criteria changed when the category changed, so a vendor's movement between the two charts describes how the market was redefined as much as how any product improved. Fast-moving vendors also chose their own moment to move. Forrester noted in November 2025 that many vendors had rebranded their proactive security offerings into exposure management, naming CyCognito and Trend Micro, and that Axonius had gone as far as declaring attack surface management dead.

Forrester retired the market and renamed the successor

The retraction was explicit and worth quoting, because it explains the shape of everything above. In a blog post on 13 November 2025, Nost wrote that attack surface management "is still an important feature, but it is dead as a standalone market because it doesn't address all three proactive security principles." The post is titled Proactive Security Platforms Will Cumulate Visibility, Prioritization, And Remediation.

The interval between that sentence and the 2024 Wave is about thirteen months, from 8 October 2024 to 13 November 2025. It is short for a category to be declared dead and replaced, and the speed is the point: the three-principle definition Forrester settled on was already the framework it was using when it scored attack surface management, and the 2024 edition simply did not carry remediation as a scored requirement. What changed in 2026 was not the thesis. It was that the thesis finally had a chart that tested all of it.

The lineage is now three evaluations deep. Attack surface management in Q3 2024, unified vulnerability management in Q3 2025 with Tenable and Armis as its Leaders, and proactive security platforms here. Between the 2024 edition and this one, Forrester also published a Landscape in Q1 2026 that mapped forty-two vendors without scoring any of them. The eleven vendors that made the 2024 chart, the ten that made the 2025 chart and the forty-two that made the Landscape have collapsed into twelve that were scored.

ServiceNow bought its way into the category

Armis was a Leader in the 2025 unified vulnerability management Wave. It does not appear among the twelve vendors here. ServiceNow does, as a Strong Performer.

The connection between those two facts is public. On 14 January 2026, Forrester reported that ServiceNow had agreed to acquire Armis in a cash deal valued at 7.75 billion dollars, with the deal expected to close in late 2026. Nost and Paddy Harrington wrote at the time that Armis brought visibility across asset classes ServiceNow's own Vulnerability Response product did not cover, notably operational technology and IoT, and that ServiceNow had already bought remediation capability through its 2025 acquisition of Silk Security.

The same post left the open question standing, which is whether ServiceNow folds Armis into its platform or runs it separately. That question is still open on the evidence of this chart, and it matters to a buyer because the two answers produce different products. A purchased capability that gets refactored into a native platform arrives on the platform's roadmap. A purchased capability that stays separate arrives as another console.

What the evaluation does not say is why Armis is absent. A vendor can be missing from a Wave because it did not meet the inclusion criteria, because it declined to participate, or because it was evaluated without being plotted. Forrester does not explain the absence, and nothing about Armis's standing should be inferred from it.

What to ask before you buy the platform

Which of the three principles does the platform actually own? Every vendor on this chart will describe itself as covering visibility, prioritization and remediation. The report's own history says remediation is where products historically fell short, and ServiceNow's acquisition of Armis was in part a purchase of the gap. Ask which of the three is native and which is an integration.

Ask for the halo status separately from the placement. Two of twelve vendors have above-average customer feedback and ten do not. That measure comes from reference customers the vendor supplied, so it is not neutral, but it is the only customer-side signal in the report and its absence is information.

Ask what the absence of a Challengers band means for the shortlist. Three bands over this chart compress the field. A vendor in Contenders here is not in the position that word usually describes, and treating the label as a ceiling will drop vendors that a 2024 reading would have placed higher.

Ask what happened to the vendor you were evaluating two years ago. Two of the three Leaders in the 2024 attack surface management Wave are no longer Leaders in the market that replaced it, and the reason is a change in what is scored, not necessarily a change in the product. If a platform was shortlisted on the old criteria, the shortlist is out of date.

Ask what the acquisition means for the roadmap. ServiceNow is not the only vendor in this market that has bought capability rather than built it. For any platform assembled from acquisitions, the question is not what the parts do today but whether they will still be sold separately in two years.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.

A close neighbor in Forrester's own coverage is Data Security Platforms, where forrester's current evaluation names AI and quantum computing as the forces shaping this category. Quantum is unusual to find in a buying decision made this year, because data encrypted today is a decision about a risk that arrives later.