Gartner has seen the security information and event management (SIEM) market disrupted by internal and external forces that cause users to rethink the security tool's role, which also impacts the vendors’ competitive positioning in the latest Magic Quadrant report.

SIEM has evolved into a security platform with multiple features and deployment models to provide a configurable security system of record that aggregates and analyzes security event data from on-premises and cloud environments, according to Gartner. It is commonly used for assisting response actions to mitigate issues that cause harm to the organization and meet compliance and reporting requirements.

The firm noted the SIEM market grew from $5.03 billion in 2022 to $5.7 billion in 2023, marking a 13% annual growth rate compared to a 22% increase in the previous year. The technology has reached the Plateau of Productivity, according to Gartner’s Hype Cycle for Security Operations 2023 report.

The internal and external disruptive forces However, “Gartner has seen evidence that the SIEM market itself has been disrupted by external forces that cause clients to rethink the role of a SIEM, and how to select the best technology for them,” researchers wrote.

These forces include the customers’ journey to cloud service providers, the growing appetite for more security data (cost bloat) and the need for overall simplicity in their detection stack.

Gartner noted its SIEM conversations with clients often include other security technologies such as cloud-native security suites, data lake solutions and extended detection and response (XDR) offerings.

Within the market, the disruptive forces “have brought about innovation, with providers marketing themselves to the SIEM buyer from brands that have not traditionally offered a SIEM product,” the report wrote.

This innovation wave changed the definition of a SIEM and forced incumbent vendors to rethink their product roadmap. 

Leaders and challengers in Gartner MQ for SIEM These changes in the SIEM market are limiting all vendors on overall execution, which also narrowed the overall gap between leading vendors on vision and execution.

“As a result, the leaders from the 2022 Magic Quadrant remain; some vendors move between challengers and visionaries, based on their trajectory relative to the average execution and vision; and a longer tail of niche players emerges,” Gartner wrote.

The 2024 Magic Quadrant for SIEM named Splunk, Microsoft, IBM, Securonix and Exabeam as leaders; Sumo Logic, Rapid7 and Fortinet as challengers; Gurucul, Google, Devo, Elastic and OpenText as visionaries; and LogRhythm, Logpoint, Huawei, Venustech, ManageEngine, NetWitness, Odyssey, QAX and Logz.io as niche players.