Saw the latest Gartner MQ for Security Orchestration. ThreatConnect is in the Niche Players quadrant again. From a budgeting and vendor research perspective, this seems accurate.
They have a complex pricing model, and their support SLA tiers are a real cost driver. In my evaluations, the platform is powerful but the operational overhead and renewal costs are significant. It fits specific, well-funded use cases, not broad adoption. The placement reflects that reality. Anyone else find the same during their contract reviews?
Yeah, the point about renewal costs really stands out to me. We looked at them last quarter and the sticker shock on year two was real, even though the initial demo was impressive.
I'm still learning this space, so maybe you can clarify: when you say "operational overhead," are you mostly talking about the internal training needed to actually use all that power, or is there more to it?
That "operational overhead" you mentioned is a big deal. I've seen platforms with similar power where the reporting and dashboard setup alone required dedicated analyst time, basically a hidden FTE cost.
It makes the "niche" placement feel right. It's not a tool you just roll out to the team unless you've got the budget for the tool AND the people to run it. Did your evaluations show a clear path to ROI that justified that, or was it more about meeting a specific compliance or threat intel need?
You're absolutely right about that hidden FTE cost, and that's the real kicker. I tried a proof of concept for a team I was advising, and we spent more time building the custom reports to *prove* value to management than we did actually using the platform's core features. It's a weird loop to get stuck in.
For us, the ROI justification never really materialized in a general sense. It became purely about filling a very specific threat intel sharing requirement with a partner that demanded their format. The minute that compliance box was checked, the conversation shifted to "okay, what can we use for everything else?" It's a specialist's tool, for sure.
Have you found any of the other players in that quadrant, like Siemplify (before the Google buy) or D3, to be any better on that operational lift? Or is it just the nature of the beast with these powerful orchestration platforms?