Reduced Costs From Vendor Consolidation

Evidence and data. Interviewees detailed how their organizations were able to reduce a variety of costs from consolidating their multivendor security stack. Microsoft Defender allowed the organizations to decommission several other security vendor tools and save on data ingestion and consumption costs. Interviewees also reported lower managed security service provider (MSSP) fees for monitoring and less management required for the consolidated platform, with fewer internal FTEs to manage, patch, and maintain multicloud security vendor products. Interviewees provided additional insights into the value drivers for this benefit, including:

• Internal and external cost reductions from vendor tool consolidation. The interviewees’ organizations streamlined their security operations by consolidating multiple vendor tools into Microsoft Defender, allowing their teams to harness more functionality with fewer tools as companies retired redundant solutions and simplified complex environments.

  • The CISO at the financial services company described how their organization was able to simplify its complex technology environment consisting of hybrid on-premises infrastructure with multicloud environments. They discussed how their organization was able to decommission a range of tools and achieve faster time to value by deploying Microsoft Defender. They reported that, to maintain a best-of-breed stack with similar functionality, their organization would need three to five additional FTEs to manage all the requirements.

• Lower SIEM costs. Multiple interviewees reported that their organizations reduced their data ingestion costs with Microsoft Defender’s Sentinel SIEM.

  • The cyberdefense leader at the oil and gas company noted that their organization was able to reduce their SIEM-related data ingestion costs by 20%. They shared, “Last year we calculated $450,000 in savings on the first round of analysis … and it will be done periodically, [yielding further savings]."
  • The manager of cyberdefense at the CPG company shared that their organization significantly reduced data ingestion costs by selectively filtering log data and leveraging built-in configuration tools to control what gets stored and analyzed: “We probably have about 3 TB of internet traffic a day. Rather than putting in the logs for that, we only ingest a fifth of what comes in. It’s much better than just ingesting everything. You can really cut it down with Microsoft Defender.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• In the prior environment, the composite organization’s multicloud cybersecurity budget is $10,000,000.

• The composite dedicates one security resource to managing multiple vendor cybersecurity tools in the prior environment.

• The average fully burdened annual salary of a SecOps resource is $149,760.

• With Microsoft Defender, the composite decommissions several vendor tools, saves on data ingestion and consumption costs, and reduces internal and external costs to manage, patch, and maintain multicloud security vendor products. As a result, it decreases its multicloud cybersecurity spend by 45% in Year 1, 55% in Year 2, and 60% in Year 3.

Risks. The following risks may impact this benefit:

• The number of workloads protected by Microsoft Defender.

• The volume and cost of data ingestion in the prior environment.

• The amount of internal labor and skill required to manage legacy security tools.

• The fully burdened rates of SecOps resources.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $12.0 million.

SecOps Optimization

Evidence and data. By consolidating the security environment, the interviewees noted how their organizations were able to fill security gaps, gain improved visibility into their technology estate, and improve the signal quality from alerts to reduce their false-positive and overall incident rates. SecOps teams reported significant improvements across the entire incident response lifecycle after adopting Microsoft Defender, with gains in speed, accuracy, and operational efficiency due to:

• Lower incident rates. Interviewees pointed out several factors that contributed to reducing their organizations’ volume of security incidents. Microsoft’s well-integrated platform further reduced the risk of security tool misconfiguration. Interviewees described how automations in the unified experience helped reduce error and rework while being able to handle many individual alerts through a single automatic action.

  • The IT security architect at the legal firm noted that Microsoft Defender resolved five alerts via one action, whereas previously, their alerts would each need to be managed individually: “Sentinel handles alerts a little more intelligently. It will combine alerts into an incident, so if they’re related, we might get five alerts [for] one incident, whereas [our legacy SIEM] would just be a raw feed of alerts.
  • The IT security architect added: “It saves time [and] is more efficient [because] you don’t have to close each one individually. You just close the one incident, and it resolves everything for you."

• Quicker detection of true threats. Threat detection became more proactive and precise thanks to integrated visibility across endpoints, identities, cloud services, and email. Teams could holistically assess risk, identifying threats with greater context and fewer false positives. The platform’s native integration with Microsoft tools also ensured that critical telemetry was available by default, without additional configuration.

  • The CISO at the financial services company said their organization was able to cut their false-positive rate for alerts from up to 20% in the prior environment to less than 10% with Microsoft Defender.

• More rapid investigations and triage of security incidents. Interviewees reported that their SecOps analysts saw major time savings thanks to Microsoft Defender’s unified views and enriched data from sources such as Intune and Entra ID. These insights allowed teams to quickly understand who was impacted, what assets were involved, and how incidents were related. What previously took up to 2 hours could now be triaged in as little as 10 minutes. Automation and correlation capabilities further accelerated this phase.

  • The manager of cyberdefense at the CPG company shared how their teams achieved 75% time savings in part because the platform’s integrations allowed it to automatically display more information to the SecOps analyst: “Because of the automations, we’re able to correlate and enrich data better. We’ve written automations that actually let us make what would [take] 5 minutes [to complete previously] automatic, so an analyst is now presented with this stuff [instantly in the platform]. … Correlation is so much faster compared to other tools, and as we integrate more and more things, correlation [becomes even] better.”
  • The cyberdefense leader at the oil and gas company noted that their organization saved time from having to manually correlate data sources: “In Microsoft Defender’s unified experience, we … created custom detection rules. It helps us see everything that is correlated with the out-of-the-box detection from XDR. [That makes it] easier for us to triage [because] it’s all in the same pane of glass. It’s no longer separate where they need to read the logs and match it with what happened in XDR to see.”

• Faster overall response to incidents. Interviewees explained how Microsoft Defender streamlined containment and response, reduced manual effort, and improved SLA adherence, with MTTA dropping from 30 minutes to 15, and MTTR shrinking from up to 3 hours to less than 1 hour in many cases.

  • The CISO at the financial services company said their organization’s mean time to resolve incidents went from 3 hours in the prior environment to about 2 hours. They said, “Now we have almost everything under one platform, so getting those data sources, creating information, and triaging have obviously become much more efficient.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite dedicates 10 SecOps analysts to security incident response.

• With Microsoft Defender, the composite reduces the false-positive rate and overall incident rate, and it is able to conduct more rapid investigations and triage of security incidents. Time savings across the incident resolution spectrum with Microsoft’s unified SecOps platform helps the composite to reduce incident response effort by 65% in Year 1, 75% in Year 2, and 80% in Year 3.

• The average fully burdened annual salary of a SecOps resource is $149,760.

Risks. The following risks may impact this benefit:

• The number of threat alerts experienced annually and the number of alerts needing investigation and response.

• The current time to investigate and time to respond to each threat alert.

• The fully burdened hourly rate of security professionals and how this grows over time.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.4 million.

Reduction In SOC Engineering Costs

Evidence and data. Interviewees shared how their organizations significantly optimized their SOC engineering efforts with Microsoft Defender through a combination of automation, integration, and streamlined detection capabilities. Previously constrained by legacy SIEM tools that limited detection to specific data types, teams were able to expand their visibility and analytic reach across diverse data sources. This enabled them to build custom ingestion pipelines and normalize threat intelligence from multiple feeds using workflows that would have been cost-prohibitive to develop in the prior environment. Key value drivers for this benefit included:

• Far-reaching and seamless integrations. The platform’s integration with identity and device management tools provided enriched context during investigations, with built-in capabilities like identifying device and login patterns. Previously, this level of insight would have been unattainable or would have required manual correlation and expensive additional staffing or specialized engineering.

  • The manager of cyberdefense at the CPG company shared that their organization achieved SOC engineering productivity gains by combining SIEM and EDR capabilities to yield rapid, cross-data detections and automations. This allowed teams to correlate endpoint activity, blocked files, and application whitelisting data, which would have been far slower or limited in traditional tools. They said: “Sentinel allows you to adjust that data and … essentially build your own ingestion tool. We’ve built custom feeds for our firewalls and our cyberthreat intelligence applications. That’s incredibly important when it comes to responding to vulnerabilities in the organization. We have so many different sources for how vulnerabilities get discovered, being able to normalize that in a platform and be able to create reports based on that [helps us address this threat].”

• Microsoft’s out-of-the-box detections. Interviewees emphasized how Microsoft Defender’s built-in detections made it easier to write and tune custom rules, further improving threat coverage. Compared to older platforms, the process was faster, more flexible, and less technically burdensome. Teams could proactively test and refine their defenses using frameworks like the MITRE ATT&CK Matrix, ensuring comprehensive coverage. This also helped some organizations to save on third-party contractor fees for security automation engineering.

  • The cyberdefense leader at the oil and gas company noted that, prior to Microsoft Defender, their organization did not possess enough SOC engineering expertise in-house. This resulted in external costs of approximately $200,000 for two weeks of contracted labor to develop three automation workflows. They shared that, with Microsoft Defender, they would have the ability to develop these automations in-house whenever they needed to build a new detection, while avoiding the need to request large budget sums to cover excess contractor costs for the detections they’d need.
  • The manager of cyberdefense at the CPG company similarly shared that Microsoft Defender improved detection and took less time to build compared to other solutions. Without Microsoft Defender, the interviewee estimated that their organization would need the equivalent of an additional SOC engineer to be able to manually provide the same level of enriched data leveraging Entra. They noted: “Writing a detection in [another tool we used] was exhausting, and figuring out how to tune something was even worse. … Not only [did] it take longer [in the other tool], you were really locked into using fields that they determine. You couldn’t do as much as you can with [Microsoft Defender]. It’s a Microsoft tool that integrates with Intune and Entra ID, which is your identity provider. That’s what makes it really, really good, as you have access to enrichment."

• Powerful, easy-to-deploy agile automations. Automation emerged as a major value driver. Tasks that once required advanced coding skills or external contractors were now achievable in-house using intuitive tools. This shift reduced reliance on costly external resources and accelerated the development of detection and response workflows.

  • The IT security architect at the legal firm noted that their organization was able to trigger automation rules with Microsoft’s integration platform, which wasn’t possible without advanced coding skills in the prior environment: “With [our legacy SIEM], you needed the coding skills to write playbooks [to reduce incident volume]. Whereas with Microsoft, you can … create a playbook or workflow and do the automation you need to close the incident. … It is much simpler to automate something using Microsoft Defender with Sentinel than it was [with our legacy SIEM].”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• In the prior environment, the composite had one dedicated SOC engineer.

• The composite is able to automate, integrate, and streamline detection with Microsoft Defender and Sentinel’s expanded analytic reach across diverse data sources. Without these capabilities, the composite would need to expand its SOC engineering capabilities by hiring two additional, higher-value SOC engineers to keep pace with cyberthreats.

• The average fully burdened annual salary of a SOC engineer is $156,000.

Risks. The following risks may impact this benefit:

• The number of security professionals needed for SOC engineering.

• The frequency with which new detections are created and the time it takes to create them.

• The number of new security professionals hired annually and the amount of time to onboard them.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $513,000.

Reduced Cost Of Material Security Breaches

Evidence and data. With Microsoft Defender, interviewees shared how their organizations significantly reduced the cost and impact of material security breaches compared to their prior environment. By consolidating previously siloed systems into a single, integrated environment, security teams gained real-time visibility into endpoints, networks, and cloud assets. This holistic view allowed them to track the evolution of threats and vulnerabilities across the organization, enabling more accurate risk assessments and faster prioritization of remediation efforts. Interviewees specifically noted that their organizations’ security teams:

• Improved their decision-making in response to incidents. The platform’s ability to correlate data from multiple sources — such as endpoint detections, application whitelisting tools, and vulnerability scanners — empowered teams to determine whether a vulnerability had been exploited, rather than relying on isolated indicators. This level of insight, combined with automation capabilities, allowed for immediate response actions like blocking malicious files or resetting compromised credentials, significantly reducing incident rates and dwell time.

  • The manager of cyberdefense at the CPG company shared: “Microsoft Defender really takes us to the next level. It’s no longer just a vulnerability management [tool] sending out a couple of emails — we can have a proper dedicated exposure management position, which can really work with the business to resolve these things in a much more informed manner.”

• Enhanced their threat-hunting abilities. Organizations enhanced their threat-hunting capabilities by consolidating data from a variety of sources into a unified platform, enabling analysts to identify patterns and anomalies with greater speed and accuracy. With simplified workflows and automation tools, teams were freed from manual tasks, allowing them to proactively investigate threats and engage in deeper, more strategic security analysis.

  • The CISO at the financial services company shared: “Microsoft Defender helps us direct where we should be threat hunting. … We do quite a bit of penetration-testing efforts — so red team, blue team, purple teaming exercises. … Earlier, they did not have [time for] those cycles, so it was quite difficult. We usually used to just do purple teaming exercises, but now we are engaging more with them as well to collaborate and find avenues for improving the security hygiene.”

• Strengthened overall security posture. Interviewees pointed out that their organizations were better protected with Microsoft Defender, often reporting measurable improvements in coverage. Furthermore, they shared that their security teams were more empowered, with the time and tools to engage in deeper threat analysis and collaborative security exercises. This shift ultimately translated into lower risk, fewer breaches, and a more efficient and effective SOC.

  • The cyberdefense leader at the oil and gas company noted that their organization was 95% covered by Microsoft and that, within Microsoft Defender, their organization was approximately 70% better protected than it had been with its previous solution. They stressed the importance of Microsoft Defender in improving their SecOps analysts’ experience, which resulted in fewer alerts requiring a response overall and decreased alert fatigue, making analysts less likely to miss true alerts requiring a response.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The likelihood of experiencing a breach is estimated at 68%, and 90% of breaches originating from external attacks targeting organizations, external attacks targeting remote environments, internal incidents, or attacks or incidents involving the external ecosystem are considered addressable by Microsoft Defender.⁵

• Based on Forrester’s data for organizations with $5 billion to $10 billion in revenue, the cumulative cost of breaches for the composite organization is $3.8 million.⁶

• The reduction in risk exposure due to Microsoft Defender improves from 65% in Year 1 to 75% in Year 3.

Risks. The following risks may impact this benefit:

• The frequency and cost of material breaches.

• The current productivity cost of material breaches to the employee base.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.8 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improvements to IT team culture and relationships. Interviewees noted that their security and IT teams were able to collaborate better and more easily on Microsoft Defender, whereas in the prior environment, they said that they would need to involve different product owners. In the unified platform, there were fewer product owners to collaborate with, resulting in fewer meetings and helping to build trust across departments.

  • The cyberdefense leader at the oil and gas company noted that deploying Microsoft Defender helped to ensure they were giving their teams the best experience. They explained: “[Microsoft Defender helps] keep them happy by giving them a … good working experience. At the same time, [it] frees them from working on manual [efforts] and false positives, so they can use their time to really focus on higher-value things like training, upskilling, and threat hunting.”
  • The CISO of a financial services company highlighted that adopting Microsoft Defender significantly improved cross-team collaboration and trust within their IT organization. With all stakeholders using the same tools and having equal access to data, the need for frequent coordination meetings decreased. This transparency allowed for more collaboration and timely response to business stakeholders, resulting in better validation of decisions and more effective brainstorming. As a result, trust improved, meetings were reduced, and decision-making became more efficient. The CISO emphasized, “Now everything is under one sun, so that definitely reduces the amount of coordination and collaboration that used to happen more frequently with multiple meetings.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Microsoft Defender and later realize additional uses and business opportunities, including:

• Time savings reallocated to higher-value activities. Overall, Microsoft Defender empowered teams to detect, investigate, and respond to threats faster and more effectively, while simplifying operations and reducing tool sprawl. The platform’s unified experience and automation reduced rework and enabled faster return to normal operations. With the time saved, teams could focus on reducing technical debt and performing higher-value tasks rather than repetitive manual processes, improving security as well as morale and productivity.

• Reduced onboarding time for SecOps analysts. Some interviewees noted that Microsoft Defender’s unified platform made it easier for new hires to grasp the environment, enabling them to more quickly contribute productive work than they could in the prior environment.

  • The cyberdefense leader at the oil and gas company noted that their organization was able to streamline the onboarding process at a time when their security organization experienced significant growth: “I can reduce the time it takes to get a new analyst to be effective. [Prior to Microsoft Defender], it took one quarter, but now [it takes] half of that [time].”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).