# Identity threat detection and response: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "ITDR solution" and as "identity threat detection tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/identity/identity-threat-detection-and-response

**Standing:** Huntress Managed ITDR leads with 42% of first choices; verdict clear leader. 50 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Huntress Managed ITDR](https://www.gane.ai/index/it/vendors/huntress-managed-itdr/index.md) | 42% | 9% | 47 |
| 2 | [Microsoft Defender for Identity](https://www.gane.ai/index/it/vendors/microsoft-defender-for-identity/index.md) | 26% | 6% | 47 |
| 3 | [CrowdStrike Falcon Identity Protection](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-identity-protection/index.md) | 10% | 21% | 42 |
| 4 | [Silverfort ITDR](https://www.gane.ai/index/it/vendors/silverfort-itdr/index.md) | 4% | 9% | 44 |
| 13 | [Semperis Directory Services Protector](https://www.gane.ai/index/it/vendors/semperis-directory-services-protector/index.md) | 0% | 4% | 26 |
| 14 | [SentinelOne Singularity Identity](https://www.gane.ai/index/it/vendors/sentinelone-singularity-identity/index.md) | 0% | 20% | 30 |
| 15 | [Okta Identity Threat Protection](https://www.gane.ai/index/it/vendors/okta-identity-threat-protection/index.md) | 0% | 7% | 14 |
| 16 | [Vectra AI ITDR](https://www.gane.ai/index/it/vendors/vectra-ai-itdr/index.md) | 0% | 0% | 11 |
| 17 | [BeyondTrust Platform](https://www.gane.ai/index/it/vendors/beyondtrust-platform/index.md) | 0% | 9% | 11 |
| 18 | [Delinea Identity Threat Protection](https://www.gane.ai/index/it/vendors/delinea-identity-threat-protection/index.md) | 0% | 10% | 10 |
| 19 | [Sophos ITDR](https://www.gane.ai/index/it/vendors/sophos-itdr/index.md) | 0% | 10% | 10 |
| 33 | [CyberArk Identity Security Platform](https://www.gane.ai/index/it/vendors/cyberark-identity-security-platform/index.md) | 0% | 30% | 10 |

Rank is by share of first choices among all 122 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Netwrix ITDR; alternatives Huntress Managed ITDR, Stellar Cyber Open XDR
- GPT-5.4 mini: CrowdStrike Falcon Identity Protection; alternatives Huntress Managed ITDR, Silverfort ITDR
- Gemini 3.5 Flash: CrowdStrike Falcon Next-Gen Identity Protection; alternatives Huntress Managed ITDR, Microsoft Defender for Identity / Entra ID Protection, Silverfort ITDR
- Perplexity Sonar: Huntress Managed ITDR; alternatives CrowdStrike Falcon Identity Security, Microsoft Defender for Identity, Silverfort ITDR, Stellar Cyber Open XDR
- Grok 4.20: Huntress Managed ITDR; alternatives BeyondTrust Platform, CrowdStrike Falcon Identity Protection, Delinea Identity Threat Protection, Microsoft Entra ID
- Mistral Small: Huntress Managed ITDR; alternatives Microsoft Defender for Identity, SentinelOne Singularity Identity, Silverfort ITDR
- DeepSeek V4 Flash: Microsoft Defender for Identity; alternatives CrowdStrike Falcon Identity Protection, Huntress Managed ITDR, Silverfort ITDR
- Llama 4 Maverick: Huntress Managed ITDR; alternatives Microsoft Defender for Identity, SentinelOne Singularity Identity, Varonis Platform
- Qwen 3.7 Flash: Microsoft Defender for Identity, Microsoft Sentinel, Zeitl; alternatives Keyfactor, Wiz
- Kimi K2: Huntress Managed ITDR; alternatives Microsoft Defender for Identity, Silverfort ITDR, Sophos ITDR
- GLM 4.7 FlashX: Microsoft Defender for Identity; alternatives Delinea Identity Threat Protection, Huntress Managed ITDR, Silverfort ITDR
- MiniMax M2.5: Huntress Managed ITDR; alternatives CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity, Secfolio, Sophos ITDR
- GPT-6 Luna: Huntress Managed ITDR; alternatives Falcon Identity Protection, Microsoft Defender, Semperis Directory Services Protector
- Muse Glimmer 30B: Microsoft Entra ID; alternatives CrowdStrike, Huntress Managed ITDR, SentinelOne Singularity Identity, Silverfort ITDR

## Sources the answers cite

76 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- huntress.com: 33 answers, 51 citations
- startwithidentity.com: 25 answers, 34 citations
- cybersecuritynews.com: 24 answers, 32 citations
- microsoft.com: 22 answers, 47 citations
- cynet.com: 22 answers, 22 citations
- g2.com: 20 answers, 27 citations
- assets.beyondtrust.com: 20 answers, 20 citations
- gbhackers.com: 19 answers, 20 citations

Pages named in the most answers:

- https://huntress.com/itdr-guide/best-itdr-vendors (23 answers)
- https://cynet.com/security-foundations/identity-security/itdr-vendors (22 answers)
- https://assets.beyondtrust.com/assets/documents/KuppingerCole_LeadershipCompass_IdentityThreatDetectionandResponse.pdf (20 answers)
- https://gbhackers.com/itdr-solutions-compared-features-pricing (19 answers)
- https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions (18 answers)
- https://daylight.ai/blog/best-itdr-tools (15 answers)
- https://startwithidentity.com/vendors/itdr (14 answers)
- https://breachsense.com/blog/itdr-tools (13 answers)
- https://expel.com/cyberspeak/how-to-evaluate-itdr-vendors (12 answers)
- https://expertinsights.com/identity-and-access-management/the-top-identity-threat-detection-and-response-itdr-solutions (12 answers)

## Warned against

- CrowdStrike Falcon Identity Protection: 9 of 42 labels negative. "Avoid enterprise-priced solutions like Silverfort, CrowdStrike Falcon Identity, and SentinelOne Singularity Identity" (DeepSeek V4 Flash, budget prompt)
- SentinelOne Singularity Identity: 6 of 30 labels negative. "Avoid enterprise-priced solutions like Silverfort, CrowdStrike Falcon Identity, and SentinelOne Singularity Identity" (DeepSeek V4 Flash, budget prompt)
- Silverfort ITDR: 4 of 44 labels negative. "Avoid for Limited Budgets: SentinelOne Singularity Identity, Varonis, or Silverfort" (Grok 4.20, budget prompt)
- Huntress Managed ITDR: 4 of 47 labels negative. "Huntress is generally highly rated... But if you rely heavily on Conditional Access or need granular alert context, test these specific scenarios thoroughly." (DeepSeek V4 Flash, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Huntress Managed ITDR at 42%.

- Huntress Managed ITDR: 55% to 42%, −13. Cleared the floor by 2 points · rank 1 of 122, unchanged.
- Microsoft Defender for Identity: 14% to 26%, +12. Cleared the floor by 1 point · rank 2 of 122, unchanged.
- CrowdStrike Falcon Identity Protection: 0% to 10%, +10. Inside the floor by 1 point · rank 15 → 3 of 122.
- Sophos ITDR: 4% to 0%, −4. Inside the floor by 7 points · rank 4 → 19 of 122.
- Okta Identity Threat Protection: 2% to 0%, −2. Inside the floor by 9 points · rank 6 → 15 of 122.
- Silverfort ITDR: 4% to 4%, ±0. Inside the floor by 11 points · rank 3 → 4 of 122.
- Semperis Directory Services Protector: 0% to 0%, ±0. Inside the floor by 11 points · rank 16 → 13 of 122.
- SentinelOne Singularity Identity: 0% to 0%, ±0. Inside the floor by 11 points · rank 20 → 14 of 122.
- Vectra AI ITDR: 0% to 0%, ±0. Inside the floor by 11 points · rank 21 → 16 of 122.
- BeyondTrust Platform: 0% to 0%, ±0. Inside the floor by 11 points · rank 22 → 17 of 122.
- Delinea Identity Threat Protection: 0% to 0%, ±0. Inside the floor by 11 points · rank 19 → 18 of 122.
- CyberArk Identity Security Platform: 0% to 0%, ±0. Inside the floor by 11 points · rank 18 → 33 of 122.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.