October 2026 Edition

Leader changes, mid-market buyers · 17, of which 5 cleared the floor

SASE platforms · Mid-market

Cato SASE Cloud→Cato Networks35%

New leader · moved

28 points clear of Cato SASE Cloud's current 7%.

Infrastructure monitoring · Mid-market

Site24x7→Datadog27%

New leader · moved

18 points clear of Site24x7's current 9%.

Vector databases · Mid-market

Qdrant→pgvector36%

New leader · moved

16 points clear of Qdrant's current 20%.

ETL and ELT · Mid-market

Airbyte→Fivetran37%

New leader · moved

11 points clear of Airbyte's current 26%.

Threat intelligence platforms · Mid-market

NordStellar→Anomali ThreatStream11%

New leader · moved

11 points clear of NordStellar's current 0%.

Names swapped within the floor · 12, read as unsettled

• Feature flags · Mid-marketLaunchDarkly→Flagsmith 27%9 points apart, inside the floor
• IT asset management · Mid-marketSnipe-IT→Freshservice 31%7 points apart, inside the floor
• Observability platforms · Mid-marketGrafana→New Relic 31%7 points apart, inside the floor
• Zero trust network access · Mid-marketCloudflare One→Twingate 40%7 points apart, inside the floor
• Identity governance · Mid-marketLumos→Microsoft Entra ID Governance 19%6 points apart, inside the floor
• Container and Kubernetes security · Mid-marketSysdig Secure→Trivy 22%4 points apart, inside the floor
• Endpoint protection · Mid-marketBitdefender GravityZone→Microsoft Defender for Endpoint 25%4 points apart, inside the floor
• ML platforms · Mid-marketDatabricks Mosaic AI→Azure Machine Learning 18%4 points apart, inside the floor
• Secrets management · Mid-marketDoppler→HashiCorp Vault 33%4 points apart, inside the floor
• Business password managers · Mid-marketBitwarden→1Password 45%2 points apart, inside the floor
• Data warehouses · Mid-marketSnowflake→Google BigQuery 48%0 points apart, inside the floor
• Patch management · Mid-marketAction1→ManageEngine Patch Manager Plus 30%0 points apart, inside the floor

Verdict changes{for_seg}

• Cloud-native application protection · Mid-marketClear leader→ContestedWiz leads at 35%
• Cloud security posture management · Mid-marketClear leader→ContestedWiz leads at 38%
• Data loss prevention · Mid-marketContested→Clear leaderMicrosoft Purview DLP leads at 48%
• Extended detection and response · Mid-marketClear leader→ContestedMicrosoft Defender XDR leads at 39%
• Managed Kubernetes platforms · Mid-marketContested→Clear leaderGoogle Kubernetes Engine leads at 42%
• Managed relational databases · Mid-marketContested→Clear leaderAmazon RDS leads at 42%
• SIEM platforms · Mid-marketClear leader→ContestedMicrosoft Sentinel leads at 39%
• SOAR platforms · Mid-marketClear leader→ContestedTines leads at 37%
• Static application security testing · Mid-marketClear leader→ContestedSemgrep AppSec Platform leads at 30%
• Vulnerability management platforms · Mid-marketClear leader→ContestedRapid7 InsightVM leads at 29%
• Workforce identity and SSO · Mid-marketContested→Clear leaderMicrosoft Entra ID leads at 42%

Biggest movers in first-choice share, mid-market buyers

Microsoft Defender XDRExtended detection and response · Mid-market

−2463% → 39%

MovedCleared the floor by 13 points · rank 1 of 52, unchanged

Cloudflare WAFWeb application firewalls · Mid-market

−2289% → 67%

MovedCleared the floor by 11 points · rank 1 of 79, unchanged

Cato SASE CloudSASE platforms · Mid-market

−2128% → 7%

MovedCleared the floor by 10 points · rank 1 → 5 of 42

AteraRemote monitoring and management · Mid-market

+207% → 27%

MovedCleared the floor by 9 points · rank 4 → 2 of 59

WorkOS AuthKitCustomer identity and access management · Mid-market

−1822% → 4%

MovedCleared the floor by 7 points · rank 2 → 7 of 62

Sophos Intercept XExtended detection and response · Mid-market

+185% → 23%

MovedCleared the floor by 7 points · rank 6 → 2 of 52

QdrantVector databases · Mid-market

−1737% → 20%

MovedCleared the floor by 6 points · rank 1 → 3 of 35

Semgrep AppSec PlatformStatic application security testing · Mid-market

−1747% → 30%

MovedCleared the floor by 6 points · rank 1 of 64, unchanged

Rapid7 InsightVMVulnerability management platforms · Mid-market

−1645% → 29%

MovedCleared the floor by 5 points · rank 1 of 75, unchanged

CurrentWareData loss prevention · Mid-market

−1618% → 2%

MovedCleared the floor by 5 points · rank 2 → 6 of 75

GraylogLog management · Mid-market

+1610% → 26%

MovedCleared the floor by 5 points · rank 3 → 2 of 65

Site24x7Infrastructure monitoring · Mid-market

−1524% → 9%

MovedCleared the floor by 4 points · rank 1 → 4 of 66

0Floor 11 pts · measured

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured · Every change resolves to its category page.