[CONTENT]
€
Euro
Total Economic Impact
Cost Savings And Business Benefits Enabled By XDR AI PLATFORM
A FORRESTER TOTAL ECONOMIC IMPACT STUDY COMMISSIONED BY TEHTRIS, September 2025
Total Economic Impact
A FORRESTER TOTAL ECONOMIC IMPACT STUDY COMMISSIONED BY TEHTRIS, September 2025
As businesses digitally transform and adopt new tools and technologies, the type, nature, and sources of data they need to run their daily operations changes continuously, exposing them to new and expanded cyberthreats. In this predicament, CISOs and cybersecurity teams need to augment cybersecurity response speed, gain flexibility and adaptability to ever-evolving threats, and lay the foundation for rapid scaling of cybersecurity operations. The TEHTRIS XDR AI PLATFORM, powered by proprietary AI, offers real-time, autonomous threat detection and response and hyperautomation, ensuring Zero Trust protection across endpoint, cloud, mobile, and operational technology (OT) environments.
TEHTRIS is a European-based cybersecurity publisher offering AI-driven extended detection and response (XDR) solutions to protect organizations from cyber threats across their digital infrastructure. Its XDR AI PLATFORM is an automated cybersecurity solution that integrates multiple security technologies to provide real-time threat detection and neutralization; automated incident response; unified visibility across endpoints, networks, servers, mobile devices, and cloud environments; and AI-driven analytics.
TEHTRIS commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying XDR AI PLATFORM.1 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of XDR AI PLATFORM on their organizations.
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed a decision-maker who has experience using XDR AI PLATFORM at their organization. Forrester used this experience to project a three-year financial analysis.
The interviewee indicated that prior to adopting XDR AI PLATFORM, their organization depended on antivirus software for threat detection and response, as well as on solutions that offered limited log management and security information and event management (SIEM) capabilities. The CISO recognized that given the rapidly evolving and increasingly complex business and technology landscape essential for achieving the organization’s strategic objectives, traditional antivirus solutions were no longer sufficient for managing security operations effectively. These solutions demonstrated limited detection capabilities, lacked adequate ransomware protection, and provided insufficient visibility across endpoints, the network, the cloud, and identity-based threats. Furthermore, they did not facilitate automated incident response and required significant time and effort to ensure regulatory compliance across multiple tools. These limitations contributed to inefficient and ineffective security operations, leading to a fragmented understanding of security and an unnecessary increase in workflows.
After the investment in the TEHTRIS XDR AI PLATFORM, the interviewee’s organization gained a centralized, holistic view of security events across endpoints, networks, servers, and cloud workloads. The centralized view enabled it to widen its threat detection scope, correlate signals from multiple sources, automate critical threat prioritization, and improve compliance. Key results from the investment include reduced mean time to investigate (MTTI) and mean time to respond (MTTR), improved productivity of the security operations center (SOC) team, and reduced risk of a breach, all resulting from consolidating data, streamlining workflows, and automating threat detection.
Quantified benefits. Three-year, risk-adjusted present value (PV) quantified benefits for the interviewee’s organization include:
Reduced MTTI and MTTR by up to 70%. The consolidation of all data from endpoints, networks, servers, and cloud workflows into a centralized dashboard enabled better visibility into potential threats, and the automated response workflows allowed the platform to manage responses automatically with minimal human intervention, reducing MTTI by 70%. Assuming an organization has 10,000 endpoints that generate 10.9 billion security events in one year, but only 99 require deeper investigation by a human analyst, the result is inefficient MTTI (44 days) and MTTR (46 days) prior to deploying the solution. In reducing the MTTI and MTTR by up to 70% using XDR AI PLATFORM, the organization saves €3.9 million over three years.
Enhanced SOC team productivity by 25% and avoided a head count of five. The solution enabled the interviewee’s organization to reach its target enhanced security posture without adding head count to the SOC team and increased existing cybersecurity staff productivity by 25% due to data consolidation and workflow streamlining. Assuming there are 35 security professionals on the existing SOC team and that it would need to add five additional professionals to reach the desired security posture, the savings over three years is worth €3.7 million to the organization.
Reduced risk of breach savings. The enhanced security posture enabled by the solution also allowed better ransomware attack detection and elimination, further reducing the risk of a breach by 20%. Assuming three data breaches per year and an average total recovery cost of €2.6 million, the savings from the reduced risk of a breach over three years are worth €1.1 million to the organization.
Unquantified benefits. Benefits that are not quantified for this study include:
Enhanced compliance and reduced regulatory pressure. Being based in Europe and providing comprehensive detection and response capabilities, the TEHTRIS DXR AI Platform is fully compliant with European Union frameworks such as the NIS2 Directive, DORA, and GDPR. It is also SecNumCloud certified and hosted on OVHcloud.2 The platform ensures data sovereignty and shields organizations from the complexities of extraterritorial regulations outside Europe. This reduces vendor and regulatory risk while supporting digital sovereignty and strategic resilience.
Strong and collaborative relationship. The interviewee reported a positive and evolving relationship between their organization and TEHTRIS, which granted its customers access to dedicated advisers, best practices, and operational support to accelerate time to value and reduce operational risk.
Accelerated incident learning and maturity companywide. By providing a centralized dashboard and enhanced security operations, the solution facilitates better postincident analysis and knowledge sharing, helping security teams evolve their detection logic and response playbooks, and thereby encouraging a companywide culture of continuous improvement.
Improved employee experience. TEHTRIS made it easier to monitor and manage endpoint security while maintaining a seamless end-user experience, for example by detecting unauthorized software installations (shadow IT) and offering granular insight into all processes running on devices. This also improved IT operational planning since the team could automate data analysis to assess system readiness for updates (e.g., memory, disk space).
Enhanced trust and confidence due to 24/7 protection. By enabling 24/7 protection — which was not possible to achieve with human-only monitoring — TEHTRIS strengthened employees’ and customers’ trust and confidence in the organization’s capacity to protect their data.
Costs. Three-year, risk-adjusted PV costs for the interviewee’s organization include:
Implementation and ongoing management. The organization paid an initial integration fee of €250,000 for a system integrator to deploy XDR AI PLATFORM across all endpoints. Additionally, it dedicated two FTEs to manage the solution. This amounted to a total three-year adjusted cost of €1.2 million.
Licensing costs. Total licensing costs with included 24/7 support and a subscription to the TEHTRIS Technical Account Management (TAM) service, which grants access to TEHTRIS’ technical experts to build a collaborative relationship, amounts to €1.1 million NPV over three years.
The financial analysis that is based on the interview found that the interviewee’s organization experiences benefits of €8.7 million over three years versus costs of €2.3 million, adding up to a net present value (NPV) of €6.4 million and an ROI of 277%.
Hours saved by security professionals per year
Return on investment (ROI)
Benefits PV
Net present value (NPV)
Payback
The interviewee’s organization was looking for a solution that could go beyond traditional antivirus software and cover a wide range of security functions. They also wanted to diversify their security stack and avoid vendor lock-in, so they deliberately excluded their antivirus software providers in use from the tender.
The organization selected the TEHTRIS XDR AI PLATFORM after a rigorous proof of concept and technical evaluations of several vendors. TEHTRIS outperformed other tenderers in its performance and cost effectiveness and ranked first among the solutions evaluated, demonstrating strong capabilities in automated detection and response. Also, as a Europe-based provider, TEHTRIS offered data sovereignty, compliance, and strategic alignment with EU cybersecurity standards. The interviewee highlighted that choosing TEHTRIS helped them ensure compliance with EU regulations and reduced the risk associated with data transfers outside the EU.
The interviewee’s organization successfully deployed TEHTRIS across approximately 100,000 computers with ongoing deployment on server infrastructure. The platform’s ability to scale and integrate into the interviewee organization’s complex environment easily was a decisive factor.
Forrester interviewed a decision-maker who has experience using the TEHTRIS XDR AI PLATFORM at their organization. Their organization has the following characteristics:
The interviewee’s organization is a public company operating in a wide range of sectors including mail, parcels, banking, and digital services.
The organization is headquartered in Europe but is now present in more than 60 countries across five continents.
The organization generated more than €34 billion in revenue in the past fiscal year.
The organization employees more than 230,000 employees.
The interviewee’s organization was using traditional antivirus software and multiple point solutions. This caused their organization to have to perform its security operations in silos and rely extensively on manual labor to consolidate data in a single view, analyze potential threats, and put forth a coordinated response. The interviewee noted how their organization struggled with challenges, including:
Insufficient ransomware protection. The interviewee highlighted that one of the most pressing issues before TEHTRIS was ransomware threats. The organization lacked effective protection against ransomware and was constantly at risk of data loss, operational disruption, financial damage, reputational harm, and potential regulation violations.
Difficulty detecting sophisticated, multivector attacks. Traditional security tools such as antivirus software used prior to deploying XRD AI Platform operated in silos, creating tool overload. Analysts performed low value, time-consuming processes and tasks to manually reconcile and analyze all data from disparate data sources to reconstruct threat contexts. They found it increasingly difficult to detect sophisticated, multivector attacks, which resulted in overlooking critical alerts and missing threats.
Alert fatigue. The large number of false positives and low priority issues due to tool overload also caused burnout and mental fatigue, making analyst jobs less attractive, causing significant turnover, and resulting in a lack of analyst effectiveness.
Slow response time. The time-consuming effort to detect threats and eliminate false positives also detracted analyst time from effective incident response once they correctly identified and isolated the threat. This resulted in diminished trust in the cybersecurity team’s capacity to operate effectively and efficiently.
Compliance burdens. Compliance with shifting European legislation on privacy, data protection, and resiliency was particularly burdensome given the need to manage and run multiple tools and systems.
In assessing the costs and benefits of the TEHTRIS XDR AI PLATFORM, we focus on a large organization with approximately 10,000 endpoints to manage and a strong commitment to digital transformation. As the company faces an ever-expanding landscape of cyber threats, it has implemented the TEHTRIS XDR AI PLATFORM to leverage automation. This allows the cybersecurity team to respond more quickly, adapt efficiently, reduce costs, and scale security operations effectively. For this use case, Forrester has modeled benefits and costs over three years.
10,000 endpoints managed
10.9 billion security events recorded by XDR AI PLATFORM
10.9 million security events analyzed by XDR AI PLATFORM
32,850 potential threats investigated automatically by XDR AI PLATFORM
16 cybersecurity security events requiring human investigation every 60 days
One threat requiring a human response in 60 days
MTTI before TEHTRIS: 44 days
MTTR before TEHTRIS: 46 days
| Ref. | Benefit | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|
| Atr | Reduced MTTI and MTTR | €1,583,244 | €1,583,244 | €1,583,244 | €4,749,732 | €3,937,293 |
| Btr | Improved productivity of SOC team | €1,475,175 | €1,475,175 | €1,475,175 | €4,425,525 | €3,668,542 |
| Ctr | Reduced risk of breach savings | €442,000 | €442,000 | €442,000 | €1,326,000 | €1,099,189 |
| Total benefits (risk-adjusted) | €3,500,419 | €3,500,419 | €3,500,419 | €10,501,257 | €8,705,024 |
Evidence and data. The interviewee mentioned that their organization’s threat investigation and threat response relied overwhelmingly on manual processes to gather logs from endpoints, firewalls, servers, and other systems; correlate events across different sources; search for indicators of compromise; scan for anomalies and suspicious behavior; review and prioritize alerts; and investigate false positives. Introducing the TEHTRIS XDR AI PLATFORM automated the ingestion and correlation from endpoints, network, cloud, identity and email; injected AI-driven anomaly detection; and provided behavioral analytics and machine learning to prioritize alerts and reduce false positives.
The interviewee reported that before TEHTRIS, detection and response were manual and limited to business hours, creating delays and risk exposure during weekends. With TEHTRIS, these processes became almost fully automated, ensuring continuous protection even outside working hours. He noted that the organization reduced MTTI by approximately 70% due to TEHTRIS agents providing immediate access to endpoint data. Over 60 days, TEHTRIS automatically recorded and managed roughly 27 billion security events (generated by 75,000 endpoints) but required only one analyst intervention, demonstrating a significant reduction in manual workload and response time.
Modeling and assumptions. Based on the interview, Forrester assumes the following:
Ten-thousand endpoints generate 10.9 billion security events per year, which a TEHTRIS agent analyzes, and 10.9 million require complementary analysis by the TEHTRIS XDR AI PLATFORM.
In one year, TEHTRIS automatically investigates 32,850 potential threats, with 99 requiring deeper investigation from a human analyst.
In one year, TEHTRIS automatically neutralizes 16,425 threats, with six requiring intervention from a human analyst.
The organization has an MTTI of 44 days and an MTTR of 46 days prior to deploying the TEHTRIS XDR AI PLATFORM.3
The fully burdened daily rate for a security professional is €600.
Risks. The actual benefit can vary significantly depending on the following factors:
The number of events requiring investigation and neutralization might be different.
The mean MTTI and MTTR prior to deploying the solution might be lower.
The fully burdened daily rate for a security professional might vary depending on seniority and location.
Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of €3.9 million.
Due to automated threat detection and response
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| A1 | Total security events analyzed by TEHTRIS XDR AI PLATFORM | Company | 10,950,000,000 | 10,950,000,000 | 10,950,000,000 | |
| A2 | Total significant events requiring complementary analysis by TEHTRIS XDR AI PLATFORM | A1*0.1% | 10,950,000 | 10,950,000 | 10,950,000 | |
| A3 | Total potential threats that required deeper automatic investigation by TEHTRIS XDR AI PLATFORM | A2*0.3% | 32,850 | 32,850 | 32,850 | |
| A4 | Total potential threats that required deeper investigation by human analysts | A3*0.3% | 99 | 99 | 99 | |
| A5 | MTTI before TEHTRIS XDR AI PLATFORM (days) | Forrester research | 44 | 44 | 44 | |
| A6 | Reduction due to TEHTRIS XDR AI PLATFORM | Interview | 70% | 70% | 70% | |
| A7 | Total threats that required real-time automatic neutralization by TEHTRIS XDR AI PLATFORM | A3*50% | 16,425 | 16,425 | 16,425 | |
| A8 | Total threats that required human response | Company | 6 | 6 | 6 | |
| A9 | MTTR before TEHTRIS XDR AI PLATFORM | Forrester research | 46 | 46 | 46 | |
| A10 | Reduction due to TEHTRIS XDR AI PLATFORM | Company | 20% | 20% | 20% | |
| A11 | Fully burdened daily rate for a security professional | Company | €600 | €600 | €600 | |
| At | Reduced MTTI and MTTR | (A4*A5*A6*A11)+(A8*A9*A10*A11) | €1,862,640 | €1,862,640 | €1,862,640 | |
| Risk adjustment | ↓15% | |||||
| Atr | Reduced MTTI and MTTR (risk-adjusted) | €1,583,244 | €1,583,244 | €1,583,244 | ||
| Three-year total: €4,749,732 | Three-year present value: €3,937,293 | |||||
Evidence and data. The interviewee noted that the TEHTRIS XDR AI PLATFORM significantly improved security team efficiency at their organization by automating detection and response processes, which reduced manual workloads and allowed analysts to concentrate on higher-value tasks. The interviewee noted that prior to implementing TEHTRIS, detection and response were “human-intensive and inefficient processes.” He emphasized that the organization previously had limited visibility into security events, with billions going undetected by former solutions. After deploying TEHTRIS, visibility increased dramatically, and the automation it offered enabled the security team to manage this surge in visibility without needing to hire additional staff.
The interviewee also reported greater productivity in creating playbooks. Although he acknowledged that TEHTRIS provides low- or no-code automation options for playbook development, their organization had not fully utilized this feature: “They prefer to extract the logs from TEHTRIS and develop playbooks in their SIEM solution. It’s just a matter of human habit.” Nevertheless, he pointed out that TEHTRIS offers enriched, centralized telemetry that contributes to and enhances playbook creation, facilitating more effective automation downstream.
Modeling and assumptions. Based on the interview, Forrester assumes the following:
The company employs 50 security professionals in its SOC; 35 are analysts (Tier one to Tier three) and are the most impacted by the increased productivity.
The company avoids adding five additional professionals to its SOC team to reach the desired security posture due to TEHTRIS automation.
There are 2,080 working hours per year.
The fully burdened hourly rate for a security professional is €75.
Risks. The actual benefit can vary significantly depending on the following factors:
SOC team numbers might differ.
Organizations may not want to reach the same security posture as the interviewee’s organization.
The fully burdened daily rate for a security professional might vary depending on seniority and location.
Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of €3.7 million.
Due to procedure standardization and automation
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| B1 | Additional security professionals avoided due to TEHTRIS automation | Company | 5 | 5 | 5 | |
| B2 | Fully burdened annual rate for a security professional | Company | €156,000 | €156,000 | €156,000 | |
| B3 | Reduction due to TEHTRIS DXR AI Platform | Interview | 100% | 100% | 100% | |
| B4 | Subtotal: Avoided hires | B1*B2*B3 | 780,000 | 780,000 | 780,000 | |
| B5 | Total security professionals in the SOC team impacted by productivity gain | Company | 35 | 35 | 35 | |
| B6 | Productivity gains due to TEHTRIS XDR AI PLATFORM | Interview | 25% | 25% | 25% | |
| B7 | Fully burdened hourly rate for a security professional | Company | €75 | €75 | €75 | |
| B8 | Productivity recapture | TEI methodology | 70% | 70% | 70% | |
| B9 | Subtotal: Productivity gain | (B5*2,080) *B6*B7*B8 | 955,500 | 955,500 | 955,500 | |
| Bt | Improved productivity of SOC team | B4+B9 | €1,735,500 | €1,735,500 | €1,735,500 | |
| Risk adjustment | ↓15% | |||||
| Btr | Improved productivity of SOC team (risk-adjusted) | €1,475,175 | €1,475,175 | €1,475,175 | ||
| Three-year total: €4,425,525 | Three-year present value: €3,668,542 | |||||
Evidence and data. Lack of automation led to time-consuming and error-prone investigations, while falling short of meeting standards implied unpredictable threat response quality that was heavily determined by individual analyst experience, talent, and skills. This increased the risk of a data breach.
Modeling and assumptions. Based on the interview, Forrester assumes the following:
There are three data breaches per year.4
The organization reduces this risk by 20% with XDR AI PLATFORM.
It avoids €2.6 million in total recover costs per year with XDR AI PLATFORM.
Risks. The actual benefit can vary significantly depending on the following factors:
The average cost per breach might be less.
Organizations with a smaller amount of sensitive customer data may risk less data breaches per year.
Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 15%) of €1.1 million.
Due to increased automation and standardization
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| C1 | Average annual breaches | Forrester research | 3 | 3 | 3 | |
| C2 | Total annual cost per breach | Forrester research | €2,600,000 | €2,600,000 | €2,600,000 | |
| C3 | Risk reduction from TEHTRIS XDR AI PLATFORM | Company | 20% | 20% | 20% | |
| Ct | Reduced risk of breach savings | C2*C3 | €520,000 | €520,000 | €520,000 | |
| Risk adjustment | ↓15% | |||||
| Ctr | Reduced risk of breach savings (risk-adjusted) | €442,000 | €442,000 | €442,000 | ||
| Three-year total: €1,326,000 | Three-year present value: €1,099,189 | |||||
The interviewee mentioned the following additional benefits that the organization experienced but was not able to quantify:
Enhanced compliance and reduced regulatory pressure. Being based in Europe and providing comprehensive detection and response capabilities means that TEHTRIS is fully compliant with European Union regulatory frameworks such as the NIS2 Directive, DORA, and GDPR. This reduces the complexity of having to manage multiple vendors’ compliance requirements and decreases regulatory pressure, allowing organizations to follow through with the strategic imperative to comply with digital sovereignty and geopolitical resilience.
Strong and collaborative relationships. The interviewee’s organization reported a positive and evolving relationship with TEHTRIS. There were initial challenges during the solution implementation because the contracted system integrator did not escalate support tickets to TEHTRIS, which created several roadblocks. To address this issue, the organization established a direct relationship with TEHTRIS to maximize its investment in XDR AI PLATFORM. The interviewee emphasized that they could then rely on a dedicated and trusted adviser who provided proactive guidance, operational support, regular health checks, strategic reviews, and streamlined communication for escalations and technical inquiries. This has resulted in faster time to value, reduced operational risk, and enhanced governance beyond standard support.
Accelerated incident learning and maturity companywide. By providing a centralized dashboard and enhanced security operations, the solution facilitated better postincident analysis and knowledge sharing, helping security teams evolve detection logic and response playbooks, and thereby encouraging a companywide culture of continuous improvement.
Improved employee experience. TEHTRIS made it easier to monitor and manage endpoint security while maintaining a seamless end-user experience, for example by enabling the detection of unauthorized software installations (shadow IT) and offering granular insight into all processes running on devices. This also improved IT operational planning since the team could automate data analysis to assess system readiness for updates (e.g., memory, disk space).
Enhanced trust and confidence due to 24/7 protection. By enabling 24/7 protection — which was not possible to achieve with human-only monitoring — TEHTRIS strengthened employees’ and customers’ trust and confidence in the ability of the interviewee’s organization to protect their data.
The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement XDR AI PLATFORM and later realize additional uses and business opportunities, including:
Futureproofed security stack. Continuous learning-based threat and network detection capabilities might enable smoother integration with threat intelligence and automation tools and position an organization to adopt emerging technologies such as AI and security orchestration, automation, and response (SOAR).
Improved collaboration across IT and security. The centralized, holistic view of data across endpoints, networks, servers, and cloud workloads removes silos between endpoint, network, cloud, and identity teams, encouraging shared visibility and faster cross-functional coordination. This supports unified security operations and governance and DevSecOps, thus contributing to enhanced IT operation efficiency and effectiveness.
Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).
| Ref. | Cost | Initial | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|---|
| Dtr | Implementation and ongoing management | €426,300 | €327,600 | €327,600 | €327,600 | €1,409,100 | €1,240,993 |
| Etr | Licensing costs | €0 | €430,500 | €430,500 | €430,500 | €1,291,500 | €1,070,590 |
| Total costs (risk-adjusted) | €426,300 | €758,100 | €758,100 | €758,100 | €2,700,600 | €2,311,583 |
Evidence and data. The interviewee’s organization paid a one-time integration fee to a system integrator for XDR AI PLATFORM deployment across its roughly 100,000 endpoints. The implementation process lasted about 12 months (2,080 working hours) and involved rolling out the automation agent on devices, monitoring system logs, and customizing workflows to meet the organization’s specific needs. Additionally, their organization dedicated two FTEs to support the implementation for the whole period and manage the solution every year.
Modeling and assumptions. Based on the interview, Forrester assumes the following:
The company allocates two FTEs to implement TEHTRIS over six months (1,040 working hours).
The system integrator costs €250,000.
The company allocates two FTEs to manage XDR AI PLATFORM every year.
There are 2,080 working hours per year.
The fully burdened hourly rate for a security professional is €75.
Risks. The actual cost can vary significantly depending on the following factors:
The number of FTEs assigned to support the implementation and the duration of the implementation.
The costs associated with the support of a system integrator.
The number of FTEs assigned to solution management.
The fully burdened hourly rate for a security professional, which might vary depending on seniority and location.
Results. To account for these risks, Forrester adjusted this cost upward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 5%) of €1.2 million.
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| D1 | Internal security personnel supporting implementation (full-time) | Interview | 2 | |||
| D2 | Fully burdened hourly rate for a security professional | Company | €75 | |||
| D3 | Duration of the implementation process (hours) | Company | 1,040 | |||
| D4 | Cost of system integrator for initial deployment | Company | €250,000 | |||
| D5 | Internal security personnel managing TEHTRIS XDR AI PLATFORM (admin, configuration, reports) | Interview | 2 | 2 | 2 | |
| D6 | Fully burdened hourly rate for a security professional | Company | €75 | €75 | €75 | |
| D7 | Portion of time spent on TEHTRIS XDR AI PLATFORM | Interview | 100% | 100% | 100% | |
| Dt | Implementation and ongoing management | (D1*D2*D3) +D4+(D5*2,080*D6*D7) | €406,000 | €312,000 | €312,000 | €312,000 |
| Risk adjustment | ↑5% | |||||
| Dtr | Implementation and ongoing management (risk-adjusted) | €426,300 | €327,600 | €327,600 | €327,600 | |
| Three-year total: €1,409,100 | Three-year present value: €1,240,993 | |||||
Evidence and data. The interviewee’s organization reported licensing costs based on the number of endpoints protected, which includes 24/7 support. Also, he reported extra subscription costs associated with TAM access.
Modeling and assumptions. Based on the interview, Forrester assumes the following:
The licensing cost to protect 10,000 endpoints is €350,000 per year.
The subscription cost of the TAM service is €60,000 per year.
Risks. The actual cost can vary depending on the number of endpoints.
Results. To account for these risks, Forrester adjusted this cost upward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of €1.1 million.
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| E1 | Total license cost with 24/7 support | Company | €350,000 | €350,000 | €350,000 | |
| E2 | Total cost for TEHTRIS TAM | Company | €60,000 | €60,000 | €60,000 | |
| Et | Licensing costs | E1+E2 | €0 | €410,000 | €410,000 | €410,000 |
| Risk adjustment | ↑5% | |||||
| Etr | Licensing costs (risk-adjusted) | €0 | €430,500 | €430,500 | €430,500 | |
| Three-year total: €1,291,500 | Three-year present value: €1,070,590 | |||||
| Initial | Year 1 | Year 2 | Year 3 | Total | Present Value | |
|---|---|---|---|---|---|---|
| Total costs | (€426,300) | (€758,100) | (€758,100) | (€758,100) | (€2,700,600) | (€2,311,583) |
| Total benefits | €0 | €3,500,419 | €3,500,419 | €3,500,419 | €10,501,257 | €8,705,024 |
| Net benefits | (€426,300) | €2,742,319 | €2,742,319 | €2,742,319 | €7,800,657 | €6,393,441 |
| ROI | 277% | |||||
| Payback | <6 months |
The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis.
These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section.
The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur.
From the information provided in the interview, Forrester constructed a Total Economic Impact™ framework for those organizations considering an investment in XDR AI PLATFORM.
The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that XDR AI PLATFORM can have on an organization.
Interviewed TEHTRIS stakeholders and Forrester analysts to gather data relative to XDR AI PLATFORM.
Interviewed a decision-maker with experience using XDR AI PLATFORM at their organization to obtain data about costs, benefits, and risks.
Constructed a financial model representative of the interview using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the interviewee.
Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.
Benefits represent the value the solution delivers to the business. The TEI methodology places equal weight on the measure of benefits and costs, allowing for a full examination of the solution’s effect on the entire organization.
Costs comprise all expenses necessary to deliver the proposed value, or benefits, of the solution. The methodology captures implementation and ongoing costs associated with the solution.
Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. The ability to capture that benefit has a PV that can be estimated.
Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on “triangular distribution.”
The present or current value of (discounted) cost and benefit estimates given at an interest rate (the discount rate). The PV of costs and benefits feed into the total NPV of cash flows.
The present or current value of (discounted) future net cash flows given an interest rate (the discount rate). A positive project NPV normally indicates that the investment should be made unless other projects have higher NPVs.
A project’s expected return in percentage terms. ROI is calculated by dividing net benefits (benefits less costs) by costs.
The interest rate used in cash flow analysis to take into account the time value of money. Organizations typically use discount rates between 8% and 16%.
The breakeven point for an investment. This is the point in time at which net benefits (benefits minus costs) equal initial investment or cost.
Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.
1 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.
2 SecNumCloud is a French government-backed security qualification awarded by the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) to cloud service providers. It signifies that a provider meets Europe's highest standards for security and data sovereignty, offering enhanced protection against cyber threats and unauthorized foreign access.
3 Source: 2024 Breach Benchmarks, By Region, Forrester Research, Inc., March 11, 2025.
4 Ibid.
Readers should be aware of the following:
This study is commissioned by TEHTRIS and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.
Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in XDR AI PLATFORM.
TEHTRIS reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.
TEHTRIS provided the customer name for the interview but did not participate in the interview.
Corrado Loreto
September 2025
ABOUT FORRESTER CONSULTING
Forrester provides independent and objective research-based consulting to help leaders deliver key transformation outcomes. Fueled by our customer-obsessed research, Forrester’s seasoned consultants partner with leaders to execute on their priorities using a unique engagement model that tailors to diverse needs and ensures lasting impact. For more information, visit forrester.com/consulting.
© Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies.
https://mainstayadvisor.com/go/mainstay/gdpr/policy.html
PDF