Improved Security

Evidence and data. The interviewees reported that using RevealX helped reduce breach likelihood by providing real-time network visibility and high-fidelity detection of malicious activity that often bypassed their traditional security tools. The interviewees detailed their specific security improvements, including:  

• Increased visibility into lateral movement with deep traffic analysis. Interviewees noted that RevealX analyzed both encrypted and unencrypted network traffic in real time to detect threats and anomalous behaviors used by attackers to move laterally across the network. By monitoring east-west traffic and decrypting protocols like TLS, RevealX helped the interviewees’ organizations eliminate blind spots and expose activities that traditional security tools may miss. The director of IT at a healthcare organization described the improvement: “With [RevealX]’s visibility into lateral movement, we’ve been able to better see and deal with credential attempts. We’re also able to see what is scanning the network and what is being accessed during these scans. … ExtraHop is stronger than its competition in terms of network visibility.”

• Faster MTTR from automated investigations and context. Interviewees shared that RevealX accelerated threat response by automatically triaging every detection with an attack timeline, risk score, and all necessary forensic data. This rapid context allowed the interviewees’ organizations to quickly scope and contain incidents, stopping a breach before major damage occurs. The CISO at a software company explained the benefit: “RevealX identifies security attacks that are traversing our network as quickly as possible, so that we can triage and guillotine them. It provides the business a reduction in expected losses from a data breach that occurs via the network.”
  The managing director at a financial services firm agreed that RevealX both saved employee time and reduced breach risk, noting, “With ExtraHop [RevealX], our mean time to resolution has improved by 60% to 65%.”

• RevealX dashboard capabilities that provide a unified view of network security operations. Interviewees reported that RevealX’s centralized console provided their organizations with real-time visibility into their network, including all assets, transactions, and workloads across multicloud and hybrid environments. They shared that the security dashboards use machine learning to flag high-fidelity alerts, allowing security teams to focus on the most critical threats and better track key security metrics. The head of portfolio management at a manufacturing organization described the effectiveness of RevealX dashboards: “[RevealX’s] GenAI dashboard gives us an overview of the number of incidents, the number of issues, resolutions, and identified risks. Because of that, our IT team is well aware before something happens, so they are able to mitigate the risk before any issue happens on the data breaches.”

• Reduction in risk. Each interviewee estimated their organization’s reduction in breach likelihood:

  • The head of portfolio management at a manufacturing firm stated, “It is around a 60% reduction in breach risk with ExtraHop RevealX.”
  • The managing director at a financial services firm noted, “We estimate that it is between a 50% to 70% reduction in the likelihood of a breach.”
  • The CISO at a software firm provided a similar estimate: “We estimate a 50% reduction in the annual loss expectancy of a data breach related to lateral movement within the network.”
  • The director of IT at a healthcare organization reported a 15% to 30% reduction in breach risk from using RevealX.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Based on Forrester’s 2025 security survey, an organization of the composite’s size expects $4.2 million of annual breach costs per year.² Furthermore, 54% of the breaches originate from external attacks targeting organizations and their remote environments.³

• With RevealX, the composite reduces the likelihood of a severe data breach caused by an external attack by 42% in Year 1. As the composite finetunes its deployment and security controls, the risk reduction climbs to 45% in Year 2 and 48% in Year 3.  

Risks. Improved security will vary depending on:

• An organization’s security posture and maturity prior to deploying RevealX.

• Other NDR, NPM, firewalls, or endpoint detection tools that the organization has in place.

• The likelihood and associated costs of security breaches each year.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.1 million.

Network Security Time Savings On Threat Response

Evidence and data. Interviewees shared that RevealX allowed their security teams to reduce the time spent manually investigating and triaging security events through its advanced visibility and threat detection capabilities. With machine learning-based detection and automated decryption, the interviewees’ organizations could immediately pinpoint true positive threats, while also accelerating investigation and response times by eliminating the need to manually stitch together fragmented data sources. The interviewees detailed specific efficiencies, including:

• Automated lateral movement investigation. The interviewees’ organizations were able to significantly cut down the manual labor involved in tracking sophisticated threats, particularly lateral movement across the network. This eliminated the need for analysts to manually piece together evidence from disparate logs and endpoint data, a process that some interviewees’ organizations had been performing with manual spreadsheets. The head of portfolio management at a manufacturing organization described the change: “Before RevealX, our teams were working manually using spreadsheets and homegrown templates. After having [RevealX], the process is automated and driven by AI features, so efficiency is improved drastically. … In total, our team spent around 25 employee hours investigating each lateral movement incident, but with RevealX it is now 3 to 4 hours.”
  The director of IT at a healthcare firm also reported significant time savings on investigating lateral movement: “On average, it used to take 4.5 hours to investigate an issue, and now it’s between 2 to 2.5 hours. … I think it’s going to get stronger and more efficient as we move along.”

• Faster forensics and evidence collection. With RevealX, the interviewees’ organizations gained definitive forensic information from the platform’s continuous packet capture and streamlined investigation workflow. The interviewees shared that RevealX provided access to transaction records and full-packet level forensic detail all from a single interface, eliminating the time-consuming process of stitching together evidence from multiple tools. The director of IT at a healthcare firm described how the forensics module streamlined their process, stating, “ExtraHop’s forensics module is stronger than any tool we had previously because [before], we might have had our own IT response teams or third-party cybersecurity vendor go in and have to figure out what is going on and write a report about what exactly took place.”

• Less time responding to false positives. By leveraging RevealX, the interviewees’ organizations were able to pick up more threats that they otherwise would have missed, while simultaneously bringing down the number of false positives. While the total number of alerts remained similar to their legacy environments, the RevealX alerts were higher fidelity. The managing director at a financial services firm noted the impact: “We’ve finetuned ExtraHop to distinguish between signal and noise in our alerts. … It was an iterative process over the first six or seven months, but we eliminated 60% to 70% of false positives.”
  The CISO at a software company agreed that their team spent less time responding to false positives, allowing them to more quickly address more critical alerts: “Our alert volume is less than what it was previously, and these alerts are high-fidelity. When it tells us something, something is happening. … It’s an 80% reduction in false positives [with RevealX].”

• Overall security team time savings. Interviewees expressed that using these capabilities from RevealX allowed them to avoid increasing security headcount and reallocate staff teams to new initiatives. The CISO at a software company estimated the impact: “It reduced network security work so we used that additional bandwidth to monitor additional alert types. If we had not repurposed our security team, we could have reduced them by 25%.”
  The managing director at a financial services firm estimated that RevealX boosted the efficiency of their organization’s 75-person SOC team by 40% to 60%.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization receives 12,000 network security alerts per year, 15% of which require a response from their security team.

• The composite dedicates 5 FTE hours to investigating and responding to each alert that requires action.

• With RevealX, the composite organization reduces the FTE time required for each alert investigation by 57% in Year 1. As the deployment becomes more mature and the composite gathers more historical alert data, the efficiency increases to 60% in Year 2 and 63% in Year 3.   

• The fully burdened hourly rate for a security FTE is $65.

• An 80% productivity recapture is applied since not all time savings are redeployed productively.

Risks. Threat response time savings will vary depending on:

• The volume of network alerts an organization has in its legacy environment.

• The number of FTE hours required for each alert response prior to deploying RevealX.

• The average fully burdened hourly rate for a security FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $626,000.

Auditing Time Savings

Evidence and data. When evaluating NDR vendors, the interviewees’ organizations sought a solution that could ensure compliance with their existing compliance regulations, such as SOC policies, NIST, and PCI DSS. Interviewees shared that RevealX allowed their organizations to maintain their existing compliance and streamline the process of manually collecting and parsing data for audits. RevealX provided their organizations with automated asset discovery and classification, full-scale network visibility, and a complete and untampered record of network activity, saving hours of employee time. Interviewees described a range of ways that RevealX made their internal audit teams more efficient:

• Interviewees reported that prior to using RevealX, it was very labor-intensive to pull network security data to prove their network security compliance. The CISO at a software firm stated: “We have a lot of audits, including seven SOC-1 audits. … It’s definitely reduced the amount of time that it takes for us to produce evidence of network security monitoring. Before, it was really difficult to get data from our network security tool to show the auditors that we were following our processes for alert triage for network security alerts. It’s reduced that time by about 30%.”

• Other interviewees praised RevealX’s dashboards, which helped them gather data for their compliance tasks faster. The head of portfolio management at a manufacturing firm reported: “When we have a half-yearly audit by third parties, they refer to the dashboard available on ExtraHop. They are able to reduce the physical audit time to go to each of the functional areas.”
  This interviewee went on to say that: “We also monitor the compliance initiatives on a monthly and quarterly basis, which we report to government agencies to meet our target audit requirements. Since the process got automated with ExtraHop [RevealX], we are able to save around 40% of our time on measuring compliance, regulatory, and sustainability requirements.”

• The managing director at a financial services firm agreed that RevealX made it easier for them to prove their security posture for auditors: “Every month, we have to generate reports on how many types of network alerts we got, and the auditors will do their own analysis on our security posture and reputational risk. Without ExtraHop [RevealX], our internal audit team would have to spend 20% to 30% more time gathering that information and validating it. With all the dashboards and details we have, they’re saving all that time.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has 12 internal employees involved in network security audits. Each of these 12 employees dedicate 25 hours per month to these audits.

• With RevealX, these employees complete network security auditing tasks, such as asset discovery and data gathering, 30% faster than with their legacy toolset.

• The fully burdened hourly rate for an employee involved in network security auditing is $65.

• A productivity recapture of 80% is applied to account for the fact that not all hours saved are redeployed productively.

Risks. Audit time savings will vary depending on:

• Specific audit and compliance regulations that an organization is required to meet.

• The number of internal staff involved in the audit process.

• The fully burdened hourly wage of FTEs involved in auditing.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $126K.

Legacy System And Cloud Cost Savings

Evidence and data. Interviewees reported that implementing RevealX allowed their organizations to retire some of their existing security tools, including legacy NDR tools and open-source threat detection tools. Those interviewees’ organizations that implemented RevealX alongside ExtraHop’s NPM module were also able to retire legacy NPM tools. In addition, interviewees shared that RevealX optimized cloud costs by providing full network visibility to identify unauthorized, runaway, or misconfigured workloads that drive unnecessary consumption and compute charges.

• The director of IT at a healthcare organization described how their organization uncovered net savings from replacing some of its legacy tools with RevealX: “We have been able to consolidate the number of tools we have. The cost with our previous solution was $250,000 higher than our ExtraHop costs. It is around a 35% savings than had we scaled out our legacy solution.”

• In addition to legacy security software, the CISO at a software firm shared that RevealX helped their organization optimize its cloud spend: “RevealX helps us identify network flows that are more cost-effective. At times, it helped us identify that we’ve got traffic flowing from this cloud to this on-premises location with expensive network egress costs, so we moved those application to the cloud or on-premises. It’s hundreds of thousands in savings from decreasing our egress costs.” The interviewee went on to estimate that the annual cloud cost savings were at least $750,000 and expected them to grow.

• The managing director at a financial services firm described how scaling out RevealX led to their organization uncovering cost savings: “On a yearly basis, we go through our stack of vendors and we ramp some down. With RevealX, we ramped down two vendors. It was easily over $500,000 in annual cost savings.” The managing director went on to add that RevealX contributed to hundreds of thousands of dollars in additional cloud cost savings.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization begins retiring its previous tools in Year 1 and can fully retire those tools by Year 2, with $500,000 of tool costs avoided in both Year 2 and Year 3.

• The composite also uses RevealX to optimize its cloud egress spend, leading to $750,000 of cloud costs being eliminated in Year 1. As the composite’s deployment becomes more mature, the composite’s annual cloud savings increases to $900,000 in Year 2 and $1.08 million in Year 3.

Risks. The avoided legacy costs will vary depending on:

• The specific network security tools that an organization has in its legacy suite.

• The speed at which an organization can retire its legacy costs and right size its cloud spend.

• An organization’s legacy cloud deployment and total cloud spend.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.9 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Further efficiencies from RevealX’s AI capabilities. Interviewees said RevealX enhanced the operational efficiency of their organizations’ SOC by integrating sophisticated AI and ML capabilities, yielding substantial gains in time savings and overall risk reduction. The platform’s Smart Triage feature intelligently prioritized alerts for the interviewees’ organizations by correlating events and calculating a risk score, effectively filtering out noise and combating alert fatigue. Furthermore, the AI Search Assistant empowered the interviewees’ organizations’ analysts to perform rapid threat hunting using natural language queries rather than specialized coding. These integrated AI tools collectively accelerated the entire security workflow, from detection and prioritization to deep investigation.

• Enhanced cyber insurance process. According to interviewees, RevealX streamlined their organizations’ cyber insurance procurement and renewal processes by offering objective evidence of their network security posture. Consequently, the interviewees noted their organizations could more easily satisfy insurer requirements, enabling them to secure new policies, retain existing coverage without excessive scrutiny, and potentially mitigate drastic premium increases because the documented risk profile was demonstrably lower. The director of IT at a healthcare organization reported how RevealX has improved their insurance process: “We’re able to show ExtraHop RevealX to our cyber insurance risk agency and say, ‘Hey, we have these new controls in place and we’re following best practices now.’ So, in theory, we can save some dollars off of the total cost that goes into our insurance plan.”

The managing director at a financial services firm added, “We aim to increase our security posture and decrease our cyber insurance premiums, and RevealX is one of the key ingredients in that.”

• Easier integration process, simplifying M&A activity. RevealX significantly accelerated and derisked the interviewees’ organizations’ M&A processes by instantly providing deep visibility across the merging IT environments. Instead of relying on slow, incomplete reports from the acquired entity, the interviewees said their organizations used RevealX to achieve rapid asset discovery and inventory for every connected device in both networks. The director of IT at a healthcare firm described how this applied to their own organization’s M&A activity: “Another benefit is ExtraHop’s ability to connect different data. Being in an M&A environment, hospitals and clinics are typically siloed from each other, but not from the enterprise. The time it takes to gather the information we need for either pre-M&A or post-M&A tasks has improved with ExtraHop.”

Flexibility

The value of flexibility is unique to each customer. There are certain scenarios in which a customer might implement RevealX and later realize additional uses and business opportunities, including:

• Using the RevealX NDR module alongside additional modules, such as NPM, to reduce internal and customer-impacting downtime. Interviewees reported that their organizations used ExtraHop’s NPM to unify security and operations visibility and significantly decrease downtime. The integrated platform monitored all network and application activity in real time, allowing their IT teams to instantly pinpoint the root cause of performance issues — whether it was a slow application, a misconfigured network device, or a security attack — without having to switch between disparate tools.

The head of portfolio management at a manufacturing firm described the impact of the broader ExtraHop suite on improving reliability: “Previously, the networks would go down as well as our network performance monitoring solution. Our network detection and response module would go down, and the communication from our ERP [enterprise resource planning] to our different finance systems, supply chain systems, and manufacturing systems would not work. … If I compare our prior situation of having ExtraHop and our current situation, there is a 10-to-12-hour reduction in downtime per month. Per hour, our downtime costs $65,000.”

Prior to implementing ExtraHop, the CISO from the software firm said they dealt with rare but extremely costly customer-facing downtime. They reported a marked reduction, partially driven by the implementation of RevealX: “We also use ExtraHop’s network performance management module, which helps reduce network downtime. Our overall network downtime has come down about 35% since implementing the network performance monitoring piece. … Our [customer-impacting] downtime costs approximately $1.2 million a minute, so those minutes are meaningful.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).