Depends on how you use them. They're very expensive (budget 100k, can even go higher). The amount scales depending on how much you expect to use them. ETA: They can help identify best tech for your org, negotiate contracts, review MSAs, and streamline processes. But you've got to be ON YOUR GAME re: calculating ROI. Might be best if it's an IT expense, as they stand to gain the most ROI in license fee negotiations. Have them gather info on all technology licenses and you can reduce spend without any Gartner expense hitting your GL. (Or, add it to your budget, use it to reduce spend on things like M365 / E5 licensing, and make the CIO look good...then cash in that favor when you need an ally in the boardroom.) Separately: Their Security & Risk Mgt. Summit is one of the best conferences I've attended. More on reddit.com

DISCLAIMER: I work for an endpoint security vendor Fully agree with your statement that "...there is nothing like trying the tool and validating its value". Analyst reports should be part of your evaluation for sure but should not be the only (or even primary) variable in your decision-making process. Another important and often underestimated source of information are tests from independent organizations. Just make sure their methodology is transparent and you interpret the data on your own (especially important for MITRE ATT&CK Evaluations): https://www.av-comparatives.org/enterprise/ https://www.av-test.org/en/antivirus/business-users/ https://mitre-engenuity.org/cybersecurity/attackevaluations/ More on reddit.com