# Identity threat detection and response for enterprise buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "ITDR solution" and as "identity threat detection tool", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/identity/identity-threat-detection-and-response/2026-11/enterprise

**Standing:** Microsoft Defender for Identity leads with 37% of first choices; verdict contested. 49 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Microsoft Defender for Identity](https://www.gane.ai/index/it/vendors/microsoft-defender-for-identity/index.md) | 37% | 5% | 40 |
| 2 | [CrowdStrike Falcon Identity Protection](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-identity-protection/index.md) | 31% | 6% | 50 |
| 3 | [Huntress Managed ITDR](https://www.gane.ai/index/it/vendors/huntress-managed-itdr/index.md) | 8% | 33% | 18 |
| 4 | [Silverfort ITDR](https://www.gane.ai/index/it/vendors/silverfort-itdr/index.md) | 4% | 6% | 32 |
| 13 | [Semperis Directory Services Protector](https://www.gane.ai/index/it/vendors/semperis-directory-services-protector/index.md) | 0% | 4% | 25 |
| 14 | [SentinelOne Singularity Identity](https://www.gane.ai/index/it/vendors/sentinelone-singularity-identity/index.md) | 0% | 15% | 33 |
| 15 | [BeyondTrust Platform](https://www.gane.ai/index/it/vendors/beyondtrust-platform/index.md) | 0% | 5% | 19 |
| 16 | [CyberArk Identity Security Platform](https://www.gane.ai/index/it/vendors/cyberark-identity-security-platform/index.md) | 0% | 7% | 14 |
| 17 | [Okta Identity Threat Protection](https://www.gane.ai/index/it/vendors/okta-identity-threat-protection/index.md) | 0% | 8% | 12 |
| 18 | [Delinea Identity Threat Protection](https://www.gane.ai/index/it/vendors/delinea-identity-threat-protection/index.md) | 0% | 9% | 11 |
| 19 | [CrowdStrike](https://www.gane.ai/index/it/vendors/crowdstrike/index.md) | 0% | 25% | 12 |

Rank is by share of first choices among all 90 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Microsoft Defender for Identity; alternatives CrowdStrike Falcon Identity Protection, Silverfort ITDR
- Gemini 3.5 Flash: CrowdStrike Falcon Identity Protection, Silverfort Unified Identity Protection; alternatives CyberArk Identity Security Platform, Delinea Identity Threat Protection, Microsoft Defender for Identity / Microsoft Entra ID Protection, Semperis Directory Services Protector
- Perplexity Sonar: CrowdStrike Falcon Identity Protection; alternatives Huntress Managed ITDR, Microsoft Defender for Identity, Semperis Directory Services Protector, Silverfort ITDR
- Grok 4.20: Silverfort ITDR; alternatives CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity
- Mistral Small: Microsoft Defender for Identity; alternatives CrowdStrike Falcon Identity Protection, Silverfort ITDR
- DeepSeek V4 Flash: CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity / Entra ID Protection; alternatives CyberArk Identity Security Platform, Silverfort ITDR
- Llama 4 Maverick: Microsoft Defender for Identity; alternatives CrowdStrike Falcon Identity Protection, Silverfort ITDR
- Qwen 3.7 Flash: Exabeam; alternatives CyberArk Identity Security Platform, Devo, Microsoft Defender for Cloud Apps, Tenable Identity Exposure
- Kimi K2: CrowdStrike Falcon Identity Protection; alternatives Microsoft Defender for Identity, Microsoft Sentinel, SentinelOne Singularity Identity
- GLM 4.7 FlashX: CrowdStrike Falcon Identity Protection; alternatives BeyondTrust Platform, Delinea Authomize, Microsoft Defender XDR, Microsoft Entra
- MiniMax M2.5: CrowdStrike Falcon Identity Protection, Microsoft Defender XDR, Microsoft Entra; alternatives BeyondTrust Platform, Securonix
- GPT-6 Luna: Microsoft Defender XDR, Microsoft Defender for Identity; alternatives CrowdStrike Falcon Identity Protection, Silverfort ITDR
- Muse Glimmer 30B: Microsoft Entra ID; alternatives BeyondTrust Platform, CrowdStrike, CyberArk Identity Security Platform, Okta Identity Threat Protection

## Sources the answers cite

76 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- huntress.com: 33 answers, 48 citations
- assets.beyondtrust.com: 28 answers, 31 citations
- startwithidentity.com: 26 answers, 31 citations
- microsoft.com: 25 answers, 45 citations
- expertinsights.com: 25 answers, 25 citations
- crowdstrike.com: 23 answers, 47 citations
- kuppingercole.com: 22 answers, 37 citations
- cybersecuritynews.com: 22 answers, 27 citations

Pages named in the most answers:

- https://huntress.com/itdr-guide/best-itdr-vendors (28 answers)
- https://assets.beyondtrust.com/assets/documents/KuppingerCole_LeadershipCompass_IdentityThreatDetectionandResponse.pdf (27 answers)
- https://expertinsights.com/identity-and-access-management/the-top-identity-threat-detection-and-response-itdr-solutions (25 answers)
- https://cynet.com/security-foundations/identity-security/itdr-vendors (20 answers)
- https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions (18 answers)
- https://microsoft.com/en-us/security/business/solutions/identity-threat-detection-response (17 answers)
- https://startwithidentity.com/articles/top-5-identity-threat-detection-platforms (14 answers)
- https://daylight.ai/blog/best-itdr-tools (13 answers)
- https://guideflow.com/blog/identity-threat-detection-and-response (12 answers)
- https://download.manageengine.com/active-directory-360/analyst-reports/kuppingercole-itdr-leadership-compass-2025.pdf (11 answers)

## Warned against

- Huntress Managed ITDR: 6 of 18 labels negative. "What the market data consistently flags as a poor fit for large enterprises: SMB / MSP-first managed ITDR * Huntress Managed ITDR is positioned as the best published-price ITDR for SMBs and MSPs" (Muse Glimmer 30B, negative prompt)
- SentinelOne Singularity Identity: 5 of 33 labels negative. "What to Avoid for Predictable Costs ... use quote-based/module pricing" (DeepSeek V4 Flash, budget prompt)
- CrowdStrike: 3 of 12 labels negative. "Unlike competitors like Palo Alto Networks, Silverfort, or Crowdstrike—which often rely on module-based add-ons, per-connector pricing, or high-value custom quotes" (Qwen 3.7 Flash, budget prompt)
- CrowdStrike Falcon Identity Protection: 3 of 50 labels negative. "Premium price – you must also purchase the broader Falcon platform... No AD recovery or resilience" (GLM 4.7 FlashX, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Microsoft Defender for Identity at 37%.

- CrowdStrike Falcon Identity Protection: 23% to 31%, +8. Inside the floor by 3 points · rank 2 of 90, unchanged.
- Huntress Managed ITDR: 0% to 8%, +8. Inside the floor by 3 points · rank 18 → 3 of 90.
- CrowdStrike: 4% to 0%, −4. Inside the floor by 7 points · rank 7 → 19 of 90.
- Silverfort ITDR: 6% to 4%, −2. Inside the floor by 9 points · rank 4 of 90, unchanged.
- BeyondTrust Platform: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 15 of 90.
- Microsoft Defender for Identity: 38% to 37%, −1. Inside the floor by 10 points · rank 1 of 90, unchanged.
- Semperis Directory Services Protector: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 13 of 90.
- SentinelOne Singularity Identity: 0% to 0%, ±0. Inside the floor by 11 points · rank 19 → 14 of 90.
- CyberArk Identity Security Platform: 0% to 0%, ±0. Inside the floor by 11 points · rank 20 → 16 of 90.
- Okta Identity Threat Protection: 0% to 0%, ±0. Inside the floor by 11 points · rank 16 → 17 of 90.
- Delinea Identity Threat Protection: 0% to 0%, ±0. Inside the floor by 11 points · rank 21 → 18 of 90.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.