Strengthened Security

Evidence and data. After implementing Deepwatch MDR, interviewees reported stronger detection accuracy, faster incident escalation, and improved visibility across hybrid environments. Deepwatch’s 24/7 monitoring and analyst‑driven triage helped their organizations reduce noise and surface high‑fidelity alerts, enabling teams to shift from reactive incident response to more proactive threat management. Interviewees also highlighted clearer guidance, more consistent prioritization, and improved readiness to support vulnerability management workflows. They said Deepwatch’s ongoing enhancements, including AI‑driven context and insight capabilities, further reinforced its focus on accelerating analysis and strengthening security outcomes over time.  

• Interviewees described the impact of Deepwatch MDR as a contributor to a stronger security posture, maturity, and risk reduction. They also noted that Deepwatch MDR helped vulnerability management efforts by adding threat context and prioritization on top of existing tools and IT service management (ITSM) systems. By surfacing exploitable exposures aligned to active threats and tracking them through remediation queues, Deepwatch helped reduce windows of exposure. Several interviewees emphasized that having expert eyes on their environments around the clock increased confidence that emerging risks were addressed quickly.

• Deepwatch provided the interviewees’ organizations with enhanced visibility into logging and telemetry, facilitating a shift to proactive security operations. The manager of technical services in manufacturing reported: “Once we onboarded with Deepwatch, our visibility into logging and telemetry was off the charts. … The alerting has become a lot clearer. They’re listing what we found, how we found it, how we can respond to it, and why we should respond to it. … It’s been very, very helpful on the [endpoint activity] side.”

• The CISO in life sciences said: “[Deepwatch] is a key component in our security staff now. … We certainly have heightened visibility into behaviors in our environment that we did not previously have.” The interviewee added, “We have been able to thwart a couple of bad actors through that process.”

• The deputy CISO in manufacturing reported: “They’ve remained below thresholds of significant materiality, [but] we have had true positives. … I credit that to the speed and detection capabilities that have been built up [with Deepwatch].”

Modeling and assumptions. Based on the interviews and Forrester Research, Forrester assumes the following about the composite organization:

• The total annual risk exposure to security breaches for the composite organization is $2,424,000.⁴

• The percentage of breaches originating from external attacks targeting organizations, external attacks targeting remote environments, and internal incidents is 77%.⁵

• The percentage of those attacks that are addressable with Deepwatch MDR is 70%. This reflects the portion of threats aligned to monitored controls and telemetry sources (e.g., endpoint, identity, cloud) with the remaining 30% attributable to factors outside direct coverage such as user error, misconfigurations, disconnected or unmanaged devices, or externally driven ecosystem failures.

• The reduced risk of exposure to breach costs from an addressable attack adjusted for the implementation maturity attributable to Deepwatch MDR is 30% in Year 1. This increases to 40% in Year 2 and 50% in Year 3. These improvement levels represent gradually increasing effectiveness as processes, integrations, and operational alignment mature over time.

Risks. The amount of this benefit can vary across organizations due to differences in:

• The organization’s threat profile and industry exposure.

• Baseline security maturity and tooling sophistication prior to adopting Deepwatch.

• The complexity, scale, and level of integration across the technology environment.

• The degree of adoption and consistent utilization of Deepwatch MDR processes, workflows, and recommendations.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.2 million.

Increased Operational Efficiency Of SecOps Team

Evidence and data. By automating alert triage, reducing false positives, and accelerating detection and response, Deepwatch MDR improved the operational efficiency of the interviewees’ organizations’ SecOps teams. Interviewees reported that analysts spent less time chasing alert noise and more time on higher-value activities, such as proactive threat hunting, security engineering, and strategic initiatives.

Deepwatch’s continuous monitoring, analyst‑validated detections, and structured escalation workflows operated on top of the interviewees’ organizations’ existing security tooling, reducing manual workload and improving alert quality and day-to-day investigation efficiency. These capabilities eliminated time previously spent sorting through low-confidence alerts and enabled the interviewees’ teams to operate with greater consistency and focus. Several interviewees also described increased operational maturity and upskilling through recurring collaboration with Deepwatch, who provided context, guidance, and tailored insights during regular touchpoints. In addition, continued platform enhancements — including AI‑driven context enrichment, agent‑assisted detection, and ticket analysis within its NEXA ecosystem — further strengthened visibility and decision‑making while easing operational burden over time.

• Several interviewees noted that Deepwatch’s integration with ITSM platforms, improved end-to-end visibility, streamlined workflows, and reduced operational friction, resulting in accelerated ticketing and reduced errors in incident management.

• Interviewees also described SIEM-related workflow support from Deepwatch, such as improving how log data was organized and interpreted, tuning detections and alerts, and helping refine dashboards, which contributed to clearer visibility and fewer nonactionable alerts reaching internal teams.

• Interviewees reported a significant decrease in false positives — estimated at 60% to 75% — and faster escalation of true threats. This improvement allowed their analysts to focus on meaningful investigations rather than chasing noise. The VP and CISO in manufacturing said: “We do see a good, solid SLA. After three years of running the solution, our rate of true positives — the things that get escalated to us and increasingly require our attention — has improved dramatically. I would credit that to the speed and detection capabilities that have been built up [in Deepwatch MDR].”

• Deepwatch’s automation and expert triage reduced the manual workload for internal teams at the interviewees’ organizations. The CISO in life sciences summarized the impact: “Deepwatch’s expertise saves us significant time. They filter through massive volumes of SOC alerts we couldn’t handle with our current resources. Their platform intelligence and team insights make this possible.”

• The same CISO noted that intelligent automation removed the need to hire two extra FTEs to manage alert noise and incident response, stating, “[Our organization] could never get two qualified FTEs for what we pay for Deepwatch.”

• The manager of technical services in manufacturing added they would need to add eight to 10 additional people to replicate the efficiencies gained with Deepwatch.

• The deputy CISO in manufacturing reported, “If we didn’t have Deepwatch, I would estimate that we would need another 20 FTEs to do [what] Deepwatch is doing.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Eight SecOps personnel experience a net operational efficiency gain of 25% in Year 1 driven by reductions in manual investigation time, fewer false positives, improved alert prioritization, and the introduction of more structured workflows with Deepwatch’s solution. These gains reflect an initial productivity lift as the team transitions away from manual triage and begins leveraging continuous monitoring and analyst‑supported escalation.

• The net efficiency gain increases to 35% in Year 2 and 40% in Year 3 as the composite organization benefits from a full year of operational familiarity, deeper integration with internal systems, more consistent adoption of recommended workflows, and the use of additional automation and AI‑supported capabilities introduced over time. These gains represent natural maturation effects rather than step‑function changes.

• The average fully burdened annual salary for a SecOps team member is $156,000.

• The SecOps team redirects 80% of the efficiency gains toward other value-added activities, such as process improvement, engineering work, threat hunting, and enhancements to governance and automation.

Risks. The amount of this benefit can vary across organizations due to differences in:

• Baseline security maturity and tooling sophistication prior to adopting Deepwatch.

• Team size, skill level, and allocation of responsibilities.

• Level of integration with existing security tools and systems.

• Extent of adoption of processes and procedures provided by Deepwatch.

Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $775,000.

Employee Productivity Gains From Reduced Security-Related Incidents And Remediation Activities

Evidence and data. Interviewees described how Deepwatch MDR reduced the frequency and severity of employee‑facing security disruptions, including compromised accounts, phishing attempts, malware‑related slowdowns, and other issues that previously interrupted daily work. By identifying threats earlier and escalating them through automated workflows, Deepwatch helped prevent user-impacting issues and reduced time employees spent noticing problems, troubleshooting, submitting tickets, or waiting for IT to remediate them. Integrations with IT service management tools further minimized manual handoffs at the interviewees’ organizations, accelerating ticket resolution and reducing the back‑and‑forth that often delayed employees from returning to full productivity. The interviewees’ organizations benefited from more consistent detection of user‑impacting issues, helping staff stay focused on their work with fewer interruptions.

• Interviewees explained that by reducing security‑related disruptions and unplanned investigations, Deepwatch MDR helped improve day‑to‑day operational stability for IT teams. With fewer urgent security escalations pulling staff away from planned work, interviewees’ organizations were able to execute projects more consistently and advance initiatives more quickly. The CISO in life sciences summarized the impact this way: “We are definitely not facing as many disruptions as we had previously. … IT has been able to advance different projects faster than they would have had we not had this implemented because the environment was a lot less stable prior to implementation.”

• Several interviewees articulated that Deepwatch’s automated alerting and ticketing processes ensured issues could be escalated and addressed before they became user-facing problems and enabled IT teams to proactively address vulnerabilities or suspicious activity before employees were impacted. This proactive approach helped prevent lockouts, outages, and performance slowdowns, reducing the time employees spent waiting for IT to resolve issues.

• Interviewees reported a reduction in compromised accounts and phishing-related disruptions. This improvement not only reduced the time their IT teams spent on remediation but also prevented employees from being locked out of applications and accounts. The manager of technical services in manufacturing said: “We used to have a couple of those [phishing compromises] a month. … We rarely see that now — maybe a couple of times a year.”

• The deputy CISO in manufacturing explained how integrations with other tools reduced time to identify and remediate issues, stating, “[Deepwatch is] directly connected and integrated with [our ITSM solution] and that saves a ton of time. There aren’t any handoffs. … It increases speed and also improves overall quality and end-to-end visibility of what’s going on in the environment.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to the deployment of Deepwatch MDR, 20% of the composite organization’s 5,000 employees experience some form of disruption due to inconsistent coverage and manual security processes that expose them to issues such as account lockouts, phishing attempts, access delays, system slowdowns, or delays caused by extra safeguard steps meant to compensate for limited visibility.

• The disrupted employees save 1 hour per year from the reduction of security-related incidents and remediation activities enabled by Deepwatch MDR.

• The fully burdened average hourly rate for a disrupted employee is $50.

• Employees recapture 50% of the time saved for other value-added activities.

Risks. The amount of this benefit can vary across organizations due to differences in:

• Baseline security maturity and tooling sophistication prior to adopting Deepwatch.

• Volume and type of end-user security incidents experienced by the organization.

• Variability in employee roles, workflows, and reliance on technology.

• Internal IT support processes and response models.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $56,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved analyst morale. Interviewees described morale improvements tied to reduced noise, clearer escalations, and fewer manual investigations. Analysts were able to focus more on meaningful work, such as tuning detections, strengthening engineering practices, and improving internal processes, rather than chasing false positives or managing alert fatigue.

• Improved cyber insurance qualification and reduced premiums. Some interviewees reported that Deepwatch MDR helped their organizations satisfy cyber insurance requirements for SOC monitoring, incident response, and logging visibility. The manager of technical services in manufacturing noted that Deepwatch “checked a bunch of those boxes,” and that their cyber insurance rates “have gone down as a result,” estimating roughly an 8% reduction.

• Improved communications with key stakeholders. Interviewees mentioned that Deepwatch’s dashboards, reporting tools, and structured escalation processes made it easier to communicate security posture and SOC activity to executives, CIOs, and boards. For the global manufacturing enterprise, leadership expressed confidence after Deepwatch benchmarked the organization’s security maturity. These improvements enhanced transparency and supported more informed decision‑making.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement MDR and later realize additional uses and business opportunities, including:

• Scaling detection coverage and alert tuning over time. Interviewees described how Deepwatch’s rule sets and tuning capabilities evolved with their environments, supporting new log sources, detections, and architectural changes over time. Interviewees noted that Deepwatch continuously refined escalations, reducing noise and improving true‑positive accuracy as their organizations’ environments grew more complex. This adaptability enabled their organizations to maintain effective detection coverage even as they expanded cloud workloads, device footprints, and security tooling.

• Integrating with existing security and IT operations tools. Deepwatch’s ability to work within existing SIEM, ITSM, and endpoint detection and response (EDR) ecosystems provided deployment flexibility and avoided disruptions to established workflows. Interviewees highlighted that Deepwatch MDR overlays — rather than replaces — existing investments, allowing the interviewees’ organizations to continue expanding or modernizing their security stack without operational or architectural constraints. Several interviewees valued that Deepwatch worked natively with their organizations’ SIEM and ITSM systems, avoiding costly reinstrumentation.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).