November 2026 Edition

Leader changes, mid-market buyers · 31, of which 9 cleared the floor

Digital risk protection · Mid-market

UpGuard BreachSight→SOCRadar Extended Threat Intelligence34%

New leader · moved

27 points clear of UpGuard BreachSight's current 7%.

Customer identity and access management · Mid-market

Frontegg→Auth034%

New leader · moved

26 points clear of Frontegg's current 8%.

Secure code training · Mid-market

SecureFlag→Secure Code Warrior Learning Platform38%

New leader · moved

26 points clear of SecureFlag's current 12%.

Patch management · Mid-market

ManageEngine Patch Manager Plus→Action135%

New leader · moved

15 points clear of ManageEngine Patch Manager Plus's current 20%.

API security platforms · Mid-market

Aikido Security→Salt Security16%

New leader · moved

14 points clear of Aikido Security's current 2%.

IT financial management · Mid-market

Nicus ITFM Platform→IBM Apptio22%

New leader · moved

14 points clear of Nicus ITFM Platform's current 8%.

Enterprise browsers · Mid-market

Chrome Enterprise→Microsoft Edge for Business39%

New leader · moved

13 points clear of Chrome Enterprise's current 26%.

IT asset management · Mid-market

Freshservice→Snipe-IT29%

New leader · moved

13 points clear of Freshservice's current 16%.

AI IT support agents · Mid-market

Freshservice with Freddy AI→Freshservice24%

New leader · moved

11 points clear of Freshservice with Freddy AI's current 13%.

Names swapped within the floor · 22, read as unsettled

• AIOps platforms · Mid-marketNew Relic Applied Intelligence→Site24x7 23%11 points apart, inside the floor
• ETL and ELT · Mid-marketFivetran→Airbyte 40%9 points apart, inside the floor
• Business continuity management · Mid-marketLogicManager→SafetyCulture 14%8 points apart, inside the floor
• IT documentation · Mid-marketConfluence→Hudu 29%8 points apart, inside the floor
• Dynamic application security testing · Mid-marketOWASP ZAP→Invicti 33%7 points apart, inside the floor
• EDI platforms · Mid-marketTrueCommerce EDI→Cleo Integration Cloud 29%7 points apart, inside the floor
• Colocation providers · Mid-marketTierPoint→Flexential 18%6 points apart, inside the floor
• Microsoft 365 management · Mid-marketCoreView ONE→AdminDroid 365 22%6 points apart, inside the floor
• ML platforms · Mid-marketAzure Machine Learning→Databricks Mosaic AI 24%5 points apart, inside the floor
• Network monitoring and management · Mid-marketAuvik→Zabbix 27%5 points apart, inside the floor
• AI security platforms · Mid-marketSentinelOne Singularity→Microsoft Defender for Cloud 12%4 points apart, inside the floor
• Digital employee experience · Mid-marketControlUp→Nexthink Infinity 18%4 points apart, inside the floor
• Identity verification · Mid-marketPersona→Sumsub 21%4 points apart, inside the floor
• LLM gateways and observability · Mid-marketPortkey→LiteLLM 36%4 points apart, inside the floor
• Endpoint protection · Mid-marketMicrosoft Defender for Endpoint→Microsoft Defender for Cloud 25%2 points apart, inside the floor
• Feature flags · Mid-marketFlagsmith→LaunchDarkly 24%2 points apart, inside the floor
• Process mining · Mid-marketApromore→Microsoft Power Automate Process Mining 29%2 points apart, inside the floor
• Cloud hosting · Mid-marketAmazon Web Services→Microsoft Azure 29%1 point apart, inside the floor
• Compliance automation · Mid-marketDrata→Vanta 30%0 points apart, inside the floor
• Software composition analysis · Mid-marketTrivy→Snyk Open Source 34%0 points apart, inside the floor
• Vector databases · Mid-marketpgvector→Qdrant 34%0 points apart, inside the floor
• Zero trust network access · Mid-marketTwingate→Cloudflare One 36%0 points apart, inside the floor

Verdict changes{for_seg}

• API management · Mid-marketContested→Clear leaderKong Gateway leads at 47%
• Application security posture management · Mid-marketContested→Clear leaderAikido Security leads at 40%
• Attack surface management · Mid-marketClear leader→ContestedIntruder leads at 29%
• Certificate lifecycle management · Mid-marketContested→Clear leaderSectigo Certificate Manager leads at 43%
• Cloud security posture management · Mid-marketContested→Clear leaderWiz leads at 45%
• Content delivery networks · Mid-marketClear leader→ConsensusCloudflare leads at 93%
• Data catalogs and governance · Mid-marketClear leader→ContestedAtlan leads at 35%
• Data center networking · Mid-marketContested→Clear leaderArista Networks leads at 42%
• DDoS protection · Mid-marketClear leader→ConsensusCloudflare leads at 94%
• Deception technology · Mid-marketContested→Clear leaderThinkst Canary leads at 56%
• Email security · Mid-marketContested→Clear leaderMicrosoft Defender for Office 365 leads at 45%
• Extended detection and response · Mid-marketContested→Clear leaderMicrosoft Defender XDR leads at 48%
• Incident management and on-call · Mid-marketContested→Clear leaderincident.io leads at 47%
• Insider risk management · Mid-marketContested→Clear leaderMicrosoft Purview Insider Risk Management leads at 45%
• Managed file transfer · Mid-marketClear leader→ContestedFiles.com leads at 33%
• Master data management · Mid-marketClear leader→ContestedProfisee MDM leads at 28%
• Network access control · Mid-marketContested→Clear leaderPortnox Cloud leads at 46%
• SIEM platforms · Mid-marketContested→Clear leaderMicrosoft Sentinel leads at 48%
• Static application security testing · Mid-marketContested→Clear leaderSemgrep AppSec Platform leads at 71%
• Streaming platforms · Mid-marketContested→Clear leaderConfluent Cloud leads at 47%
• Telemetry pipelines · Mid-marketContested→Clear leaderOpenTelemetry Collector leads at 45%
• Unified endpoint management · Mid-marketContested→Clear leaderMicrosoft Intune leads at 54%

Biggest movers in first-choice share, mid-market buyers

Semgrep AppSec PlatformStatic application security testing · Mid-market

+3536% → 71%

MovedCleared the floor by 24 points · rank 1 of 76, unchanged

SOCRadar Extended Threat IntelligenceDigital risk protection · Mid-market

+286% → 34%

MovedCleared the floor by 17 points · rank 4 → 1 of 121

CloudflareContent delivery networks · Mid-market

+2568% → 93%

MovedCleared the floor by 14 points · rank 1 of 60, unchanged

Microsoft Edge for BusinessEnterprise browsers · Mid-market

+2217% → 39%

MovedCleared the floor by 11 points · rank 3 → 1 of 100

Radiant SecurityAI SOC agents · Mid-market

−2224% → 2%

MovedCleared the floor by 11 points · rank 2 → 8 of 99

IntruderAttack surface management · Mid-market

−2049% → 29%

MovedCleared the floor by 9 points · rank 1 of 114, unchanged

IBM ApptioIT financial management · Mid-market

+202% → 22%

MovedCleared the floor by 9 points · rank 31 → 1 of 180

Thinkst CanaryDeception technology · Mid-market

+2036% → 56%

MovedCleared the floor by 9 points · rank 1 of 113, unchanged

Secure Code Warrior Learning PlatformSecure code training · Mid-market

+2018% → 38%

MovedCleared the floor by 9 points · rank 2 → 1 of 104

Site24x7AIOps platforms · Mid-market

+194% → 23%

MovedCleared the floor by 8 points · rank 8 → 1 of 105

Microsoft Purview Insider Risk ManagementInsider risk management · Mid-market

+1926% → 45%

MovedCleared the floor by 8 points · rank 1 of 87, unchanged

Snyk Open SourceSoftware composition analysis · Mid-market

+1816% → 34%

MovedCleared the floor by 7 points · rank 2 → 1 of 60

0Floor 11 pts · measured

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured · Every change resolves to its category page.