OpenText Core Threat Detection & Response
LeaderInformation Reimagined
Est 1991|Valuation $6.1B|Raised $14.3B
Information Reimagined
Published Oct 15, 2026
Because Core TDR has limited independent review coverage, typical complaints cannot be robustly quantified. Early signals include:
Sources:
Based on vendor positioning and third-party commentary, commonly cited reasons for selection include:
Sources:
Get a comprehensive analysis of OpenText Core Threat Detection & Response including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →Requirement for an exclusively Microsoft-native, single-vendor approach If the procurement decision is to standardize solely on Microsoft Defender XDR + Sentinel with no additional vendors, an overlay analytics product may be redundant unless it demonstrably provides incremental detection value.
Requirement for extensive independent reviews prior to procurement Core TDR had limited public independent reviews at the time of research. Organizations that require broad peer validation may prefer vendors with larger independent review footprints.
Need for confirmed near-real-time behavioral detections If the organization requires low-latency, near-real-time behavioral detection and the vendor’s "daily results" cadence is confirmed to be the primary analytic delivery mechanism, the product may not meet those operational requirements.
Immediate need for extensive cross-platform integrations For environments with heterogeneous EDR/IdP deployment on day one, vendors with broader established integrations or a SIEM-centric approach may be preferable until Core TDR’s supported integrations expand.
Sources:
Sources:
At the time of research, Core TDR had limited independent review coverage (e.g., one G2 review), constraining confidence in generalized customer experience observations.
Source:
OpenText explicitly states it does not guarantee the accuracy of AI-generated explanations; customers should treat generated summaries as assistive and validate findings during investigations.
Source:
The Service Description notes that analytics results are published daily. Procurement and POC activities should validate actual detection and alerting latencies for the classes of detections that matter to the organization.
Source:
The product’s initial integration focus is on Microsoft telemetry sources. Organizations requiring broad, multi-vendor telemetry coverage at launch should assess integration roadmaps and timelines.
Source:
Validation level: These are primarily vendor claims with limited user validation publicly available at the time of research.
Sources:
This pattern is common for recently launched offerings: vendor materials are abundant, while independent hands-on reviews typically lag the launch timeline.
Sources:
G2 (Core TDR) — limited sample (very few reviews)
Gartner Peer Insights (OpenText Managed Detection and Response) — service-related feedback (not Core TDR detection quality)
Caveat: The Gartner Peer Insights comments above reflect managed service experience and do not directly validate Core TDR detection performance.
Sources:
While direct churn evidence for Core TDR was not identified, potential deal-breakers include:
Source (AI disclaimer):
OpenText product materials include illustrative examples such as identifying a dormant guest account with repeated after-hours failures attempting to access a restricted server, and a customer quote attributed to Bernicia Homes indicating improved operational confidence.
Critical evaluation:
Sources:
Vendor materials reference industry figures for average time-to-detect (e.g., industry estimates typically measured in months) and position Core TDR as capable of reducing detection timelines. The extent to which Core TDR shortens time-to-detect will depend on telemetry coverage, baselining periods, SOC processes, and the authority to act on alerts.
Critical evaluation: Without independent benchmarks or customer-submitted metrics, time-to-detect improvement claims should be treated as vendor-stated outcomes requiring validation in POC or contractual success criteria.
Sources:
Sources:
OpenText Core Threat Detection & Response (Core TDR) is a SaaS behavioral-analytics threat detection product designed to identify insider threats, credential misuse, and "low-and-slow" anomalies that can evade traditional rule/signature-based detections. It ingests security telemetry (notably from Microsoft Defender for Endpoint and Microsoft Entra ID) and applies unsupervised behavioral analytics to baseline typical activity and surface deviations with risk-scored alerts and contextual explanations. Sources:
Positioning: Described by the vendor as an "Open XDR / behavioral threat detection" capability intended to operate alongside existing tools—particularly Microsoft security stack components—by adding UEBA-style behavioral modeling and risk prioritization. Likely buyers/users: SOC leaders, threat hunters, and security operations teams in Microsoft-centric environments seeking an additional behavioral detection layer with reduced need for custom rule-writing. Sources: