Capability scores for network analysis and forensics vendors are primarily driven by the breadth of protocol support and the accuracy of their threat detections. Vendors must demonstrate the ability to decode a wide range of network protocols at wire speed and provide high-fidelity alerts that minimize false positives.
Cloud-native capabilities, such as the ability to monitor serverless environments and containers, are also crucial for achieving a high capability score.Innovation scores are largely determined by the integration of Generative AI (GenAI) and autonomous response capabilities. Top-ranked companies are investing in AI-driven 'copilots' that assist analysts in understanding suspicious traffic patterns and recommending response actions.
To improve their ranking, vendors should focus on providing explainable AI, unifying visibility across identity, endpoint, and network data, and enabling precision containment to stop individual sessions without isolating entire computers.
