Endpoint detection and response
Asked as “EDR platform”, and as “endpoint detection and response tool”, on behalf of a mid-market B2B company. 55 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
38%
Contested · Microsoft Defender for Cloud 18%
38Microsoft Defender for Endpoint18Microsoft Defender for Cloud09CrowdStrike Falcon Insight35others
38% of first choices, contested.
Since October 2026▲+7Since October 2026: 31% → 38%, +7 points. Inside the 11-point floor: within noise.Microsoft Defender for Endpoint held the lead, +7 points on 31%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Microsoft Defender for Cloud56%Clear leader▲+9Since October 2026: 47% → 56%, +9 points. Inside the 11-point floor: within noise.Standing →Mid-market
Microsoft Defender for Endpoint38%Contested▲+7Since October 2026: 31% → 38%, +7 points. Inside the 11-point floor: within noise.This pageEnterprise
CrowdStrike Falcon Insight47%Clear leader▼−5Since October 2026: 52% → 47%, −5 points. Inside the 11-point floor: within noise.Standing →
Microsoft Defender for Cloud56%Clear leader▲+9Since October 2026: 47% → 56%, +9 points. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Defender for Endpoint38%Contested▲+7Since October 2026: 31% → 38%, +7 points. Inside the 11-point floor: within noise.This pageEnterpriseCrowdStrike Falcon Insight47%Clear leader▼−5Since October 2026: 52% → 47%, −5 points. Inside the 11-point floor: within noise.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Microsoft Defender for Endpoint38%12%58endorsed leader▲+7Since October 2026: 31% → 38%, +7 points. Inside the 11-point floor: within noise.31% → 38%
Microsoft Defender for Endpoint38%12%58endorsed leader▲+7Since October 2026: 31% → 38%, +7 points. Inside the 11-point floor: within noise.31% → 38%02Microsoft Defender for Cloud18%0%12accepted challenger▲+3Since October 2026: 15% → 18%, +3 points. Inside the 11-point floor: within noise.15% → 18%
Microsoft Defender for Cloud18%0%12accepted challenger▲+3Since October 2026: 15% → 18%, +3 points. Inside the 11-point floor: within noise.15% → 18%03
SentinelOne Singularity9%13%61accepted challenger▼−6Since October 2026: 15% → 9%, −6 points. Inside the 11-point floor: within noise.15% → 9%
SentinelOne Singularity9%13%61accepted challenger▼−6Since October 2026: 15% → 9%, −6 points. Inside the 11-point floor: within noise.15% → 9%04CrowdStrike Falcon Insight9%22%58accepted challenger▼−13Since October 2026: 22% → 9%, −13 points. Past the 11-point floor: movement.22% → 9%
CrowdStrike Falcon Insight9%22%58accepted challenger▼−13Since October 2026: 22% → 9%, −13 points. Past the 11-point floor: movement.22% → 9%05
Huntress Managed EDR7%4%26accepted challenger▲+1Since October 2026: 6% → 7%, +1 point. Inside the 11-point floor: within noise.6% → 7%
Huntress Managed EDR7%4%26accepted challenger▲+1Since October 2026: 6% → 7%, +1 point. Inside the 11-point floor: within noise.6% → 7%06
Sophos Intercept X2%12%34accepted challenger▼−4Since October 2026: 6% → 2%, −4 points. Inside the 11-point floor: within noise.6% → 2%
Sophos Intercept X2%12%34accepted challenger▼−4Since October 2026: 6% → 2%, −4 points. Inside the 11-point floor: within noise.6% → 2%07
Bitdefender GravityZone EDR2%14%29accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%
Bitdefender GravityZone EDR2%14%29accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%Show the three products at 0%, ordered by negative rate
10
VMware Carbon Black0%40%10criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
VMware Carbon Black0%40%10criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%08
Palo Alto Networks Cortex XDR0%17%23accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Palo Alto Networks Cortex XDR0%17%23accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%09
Trend Micro0%12%16accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Trend Micro0%12%16accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
For buyers
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Defender for Endpoint vs Huntress Managed EDRMicrosoft Defender for Endpoint vs Sophos Intercept XMicrosoft Defender for Endpoint vs Bitdefender GravityZone EDRMicrosoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs CrowdStrike Falcon InsightMicrosoft Defender for Cloud vs Huntress Managed EDRMicrosoft Defender for Cloud vs Sophos Intercept XMicrosoft Defender for Cloud vs Bitdefender GravityZone EDRSentinelOne Singularity vs CrowdStrike Falcon InsightSentinelOne Singularity vs Huntress Managed EDRSentinelOne Singularity vs Sophos Intercept XSentinelOne Singularity vs Bitdefender GravityZone EDRCrowdStrike Falcon Insight vs Huntress Managed EDRCrowdStrike Falcon Insight vs Sophos Intercept XCrowdStrike Falcon Insight vs Bitdefender GravityZone EDRHuntress Managed EDR vs Sophos Intercept XHuntress Managed EDR vs Bitdefender GravityZone EDRSophos Intercept X vs Bitdefender GravityZone EDR
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01020304050607080910Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Microsoft Defender for Endpoint38%
Microsoft Defender for Endpoint38%02Microsoft Defender for Cloud18%
Microsoft Defender for Cloud18%03SentinelOne Singularity9%
SentinelOne Singularity9%04CrowdStrike Falcon Insight9%
CrowdStrike Falcon Insight9%05Huntress Managed EDR7%
Huntress Managed EDR7%06Sophos Intercept X2%
Sophos Intercept X2%07Bitdefender GravityZone EDR2%
Bitdefender GravityZone EDR2%08Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%09Trend Micro0%
Trend Micro0%10VMware Carbon Black0%
VMware Carbon Black0%What they warned about
Three of fourteen models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike Falcon Insight22%
13 of 58 labels negative · 10 of 14 models
“While still market-leading, the July 2024 channel-file incident took down 8.5 million Windows machines and demonstrated a systemic risk” Claude Haiku 4.5, negative prompt
Microsoft Defender for Endpoint12%
7 of 58 labels negative · 7 of 14 models
“many companies depend on a single provider like CrowdStrike, Microsoft Defender or SentinelOne, and that "banking on, or consolidating services with a single provider can create downstream risk"” Muse Glimmer 30B, negative prompt
SentinelOne Singularity13%
8 of 61 labels negative · 6 of 14 models
“Top-tier market leaders (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Palo Alto Cortex XDR) are effective, but you should avoid any vendor that does not permit strict deployment ring management” Gemini 3.5 Flash, negative prompt
VMware Carbon Black40%
4 of 10 labels negative · 4 of 14 models · 3 hard negative
“The products most consistently flagged by practitioners and independent tests are Datto EDR (operational issues, Kaseya support), Carbon Black (post-acquisition decline, complexity, false positives)” DeepSeek V4 Flash, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
71 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 715 links across 192 sites, every framing counted. Ranked by the number of answers carrying the site or page. 23 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
23 answers · 36 citations · 8 models
vendor site · Huntress20 answers · 27 citations · 9 models
vendor site · Iru20 answers · 21 citations · 9 models
18 answers · 46 citations · 10 models
16 answers · 17 citations · 9 models
vendor site · Acronis15 answers · 15 citations · 8 models
vendor site · CyberPress13 answers · 13 citations · 7 models
vendor site · Microsoft12 answers · 22 citations · 9 models
vendor site · G211 answers · 19 citations · 7 models
vendor site · Seceon11 answers · 12 citations · 8 models
vendor site · Consilien11 answers · 11 citations · 7 models
11 answers · 11 citations · 7 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
19 answers · 9 models
17 answers · 8 models
16 answers · 9 models
15 answers · 8 models
14 answers · 7 models
13 answers · 7 models
11 answers · 7 models
11 answers · 7 models
8 answers · 4 models
8 answers · 6 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best edr platform”, “edr platform”, “edr platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender parent site Microsoft Defender for Endpoint 38% | 38% | 264 | 18,100 | 3,525 | ||||
| Microsoft Defender microsoft.com Microsoft Defender for Cloud 18% | 18% | 659 | 18,100 | 3,525 | 145,358,109 company | $12,455 | 103 | 4 |
| SentinelOne sentinelone.com SentinelOne Singularity 9% | 9% | 499 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 1 |
| CrowdStrike parent site CrowdStrike Falcon Insight 9% | 9% | 148 | 74,000 | 5,130 | ||||
| Huntress huntress.com Huntress Managed EDR 7% | 7% | 353 | 33,100 | 4,338 | 352,368 company | $15,522 | 120 | |
| Seceon aiXDR-PMax seceon.com | 4% | 8 | ||||||
| CrowdStrike crowdstrike.com CrowdStrike 2%, CrowdStrike Falcon with Falcon Complete MDR 2% | 4% | 302 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | |
| Sophos sophos.com Sophos Intercept X 2% | 2% | 304 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| Bitdefender parent site Bitdefender GravityZone EDR 2% | 2% | 64 | 90,500 | 3,261 | ||||
| Sophos parent site Sophos MDR 2% | 2% | 155 | 18,100 | 2,046 |
Google's top ten for the three searches hold 21 sites; 3 of them are among the sites the models cited here (acronis.com, microsoft.com, reddit.com). The first result for “best edr platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best EDR platform for a mid-market B2B company?”Paraphrase“Which endpoint detection and response tool would you recommend to a mid-sized B2B company?”Comparative“What are the top EDR platforms and how do they differ?”Budget-constrained“What is the best EDR platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a EDR platform. What should we look at?”Negative“Which EDR platforms should I avoid or be cautious about?”
Claude Haiku 4.5no first choiceno first choiceHeldCrowdStrike Falcon Insight, SentinelOne SingularityMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike Falcon Insight, IBM Security QRadar EDR, Open EDR, SentinelOne Singularity
Two alternatives
Huntress Managed EDR, Microsoft Defender for EndpointTwo alternatives
Huntress Managed EDR, ThreatDown EDRGPT-5.4 miniMicrosoft Defender for EndpointCrowdStrike Falcon Insight, Microsoft Defender for EndpointChangedCrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne SingularityMicrosoft Defender for Endpointno first choicenothing named
Three alternatives
CrowdStrike Falcon Insight, SentinelOne Singularity, Sophos Intercept XTwo alternatives
SentinelOne Singularity, Sophos Intercept XTwo alternatives
Palo Alto Networks Cortex XDR, Sophos Intercept XOne alternative
SentinelOne SingularityGemini 3.5 FlashCrowdStrike, SentinelOne SingularitySentinelOne SingularityChangedCrowdStrike Falcon InsightMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike Falcon Insight, Kaspersky Security Solutions, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Symantec Endpoint Security, Trellix/McAfee, Trend Micro
Two alternatives
Microsoft Defender for Endpoint, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, Sophos Intercept XFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XFour alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, LimaCharlie, WazuhSix alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Control/Complete, Sophos MDR, Trend MicroPerplexity SonarHuntress Managed EDRMicrosoft Defender for EndpointChangedagainst: CrowdStrike Falcon InsightCrowdStrike Falcon InsightMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike, Microsoft Defender for Endpoint, OpenEDR, SentinelOne Singularity, Wazuh
Five alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos MDRThree alternatives
Bitdefender GravityZone EDR, SentinelOne Singularity, Sophos Intercept XSeven alternatives
Bitdefender GravityZone EDR, Cynet, Huntress Managed EDR, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XThree alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, ThreatDown EDRGrok 4.20CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne SingularityMicrosoft Defender for EndpointChangedagainst: CrowdStrike Falcon InsightCrowdStrike Falcon Insight, Microsoft Defender for EndpointMicrosoft Defender for Endpointagainst: Bitdefender GravityZone EDRno first choiceagainst: Elastic Security, McAfee, Microsoft Defender for Endpoint, Sophos Intercept X, Trend Micro, VMware Carbon Black
Two alternatives
Bitdefender GravityZone EDR, Sophos Intercept XOne alternative
SentinelOne SingularityTwo alternatives
Palo Alto Networks Cortex XDR, SentinelOne SingularityTwo alternatives
Huntress Managed EDR, SentinelOne SingularityMistral SmallBitdefender GravityZone EDR, Microsoft Defender for EndpointMicrosoft Defender for CloudChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Open EDR, VMware Carbon Black
Three alternatives
CrowdStrike Falcon Insight, Seceon aiXDR-PMax, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, SentinelOne SingularityThree alternatives
Datto EDR, Huntress Managed EDR, SentinelOne SingularityDeepSeek V4 FlashHuntress Managed EDRMicrosoft Defender for EndpointChangedCrowdStrike Falcon Insight, SentinelOne SingularityMicrosoft Defender for CloudMicrosoft Defender for Endpointagainst: Bitdefender GravityZone EDR, Datto EDR, Microsoft Defender for Endpoint, Sophos Central with EDR, VMware Carbon Black
Four alternatives
CrowdStrike Falcon Insight, ESET PROTECT, Microsoft Defender for Endpoint, SentinelOne SingularityThree alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, SentinelOne SingularityTwo alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDRFour alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Huntress Managed EDR, Sophos Intercept XFour alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, SentinelOne Singularity, Sophos Intercept XLlama 4 MaverickMicrosoft Defender for Endpointagainst: Bitdefender GravityZone EDRMicrosoft Defender for EndpointHeldno first choiceMicrosoft Defender for Cloudagainst: CrowdStrike Falcon Insight, SentinelOne Singularityno first choiceagainst: CrowdStrike Falcon Insight, FireEye's EDR, SentinelOne Singularity, Sophos Intercept X, ThreatDown EDR
Three alternatives
CrowdStrike Falcon Insight, Seceon aiXDR-PMax, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Jamf Protect, Microsoft Defender for CloudOne alternative
Huntress Managed EDRQwen 3.7 FlashMicrosoft Defender for Endpointagainst: CrowdStrike Falcon InsightMicrosoft Defender for EndpointHeldCrowdStrike Falcon Insight, Microsoft Defender for EndpointMicrosoft Defender for Endpointagainst: Wazuhno first choiceagainst: Datto, Palo Alto Networks Cortex XDR, Sophos Intercept X, Trellix EDR
Two alternatives
SentinelOne Singularity, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Elastic Security, SentinelOne SingularityThree alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity, Trend MicroThree alternatives
Bitdefender GravityZone EDR, Sophos Intercept X for Standard Small Business, Trend Micro Worry-Free ServicesKimi K2Microsoft Defender for EndpointSentinelOne SingularityChangedagainst: CrowdStrike Falcon InsightCrowdStrike Falcon Insight, SentinelOne SingularityMicrosoft Defender for CloudCynet, Huntress Managed EDR, Rapid7 MDR, Sophos MDRagainst: CrowdStrike Falcon Insight, SentinelOne Singularityagainst: Cisco Secure Endpoint, CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne Singularity
Three alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, SentinelOne SingularityOne alternative
Microsoft Defender for EndpointThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Trend MicroFour alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Huntress Managed EDR, SentinelOne SingularityThree alternatives
Bitdefender GravityZone Elite/Ultra, Microsoft Defender for Cloud, Trend MicroGLM 4.7 FlashXMicrosoft Defender for Endpoint, Sophos Intercept XCrowdStrike Falcon InsightChangedCrowdStrike Falcon Insight, SentinelOne SingularityHuntress Managed EDR, Microsoft Defender for Cloudno first choiceagainst: Acronis Cyber Protect, Barracuda Managed XDR, CrowdStrike Falcon Insight, Huntress Managed EDR, Microsoft Defender for Endpoint, Sophos Intercept X
Three alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, SentinelOne SingularityTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityEight alternatives
Bitdefender GravityZone EDR, Check Point Harmony, Cisco Secure Endpoint, Cynet, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept X, Trend MicroSix alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, ESET PROTECT, SentinelOne Singularity, Wazuh, Xcitium OpenEDRMiniMax M2.5Microsoft Defender for Endpoint, Seceon aiXDR-PMaxMicrosoft Defender for Endpoint, SentinelOne SingularityChangedCrowdStrike Falcon InsightDatto EDR, Microsoft Defender for Cloudno first choicenothing named
Three alternatives
CrowdStrike Falcon Insight, SentinelOne Singularity, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Seceon aiXDR-PMax, Sophos Intercept XSeven alternatives
Bitdefender GravityZone EDR, Check Point Harmony Endpoint, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro Vision One / Apex OneTwo alternatives
Huntress Managed EDR, SentinelOne SingularityGPT-6 LunaCrowdStrike Falcon with Falcon Complete MDRCrowdStrike Falcon InsightChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike Falcon Insight, Kaspersky Endpoint Detection and Response (EDR) Expert
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityOne alternative
Microsoft Defender for EndpointOne alternative
Huntress Managed EDRMuse Glimmer 30BCrowdStrike Falcon InsightSeceon aiXDR-PMaxChangedCrowdStrike Falcon InsightMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike, Datto EDR, FireEye EDR, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, VMware Carbon Black
Four alternatives
Bitdefender GravityZone EDR, Microsoft Defender for Endpoint, Seceon aiXDR-PMax, SentinelOne SingularityTwo alternatives
CrowdStrike Falcon Insight, Microsoft Defender for EndpointThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityFour alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, ESET PROTECT, Huntress Managed EDRBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:13 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:19 | yes | 5 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:00 | yes | 6 | 21 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 11:33 | yes | 10 | 3 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:46 | yes | 15 | 12 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:27 | yes | 5 | 6 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:45 | yes | 20 | 21 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:46 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:24 | no | 0 | 29 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:18 | yes | 10 | 18 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:02 | yes | 23 | 58 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:30 | yes | 5 | 32 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:28 | yes | 4 | 16 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:37 | yes | 13 | 26 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:35 | no | 0 | 4 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:38 | yes | 3 | 9 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:36 | no | 0 | 14 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 10:43 | yes | 10 | 3 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:32 | yes | 5 | 10 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:29 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:05 | yes | 24 | 37 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:14 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 15:06 | no | 0 | 28 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:48 | yes | 10 | 22 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:53 | yes | 10 | 45 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 15:12 | yes | 5 | 34 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:33 | yes | 2 | 15 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 11:41 | yes | 13 | 21 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 19:11 | yes | 10 | 8 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:11 | yes | 4 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 12:10 | no | 0 | 12 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 09:09 | yes | 10 | 5 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:44 | yes | 5 | 12 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:24 | yes | 5 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:50 | yes | 25 | 35 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:31 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 14:50 | yes | 5 | 23 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:14 | yes | 10 | 21 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:57 | yes | 10 | 36 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:53 | yes | 5 | 42 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 09:40 | yes | 7 | 30 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 19:21 | yes | 14 | 23 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 12:34 | yes | 10 | 7 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:56 | yes | 2 | 6 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 12:10 | yes | 11 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 16:15 | yes | 10 | 3 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:12 | yes | 5 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:15 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 14:48 | yes | 24 | 35 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:17 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:52 | no | 0 | 31 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:01 | yes | 10 | 17 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 08:53 | yes | 21 | 50 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 15:39 | yes | 15 | 44 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:49 | yes | 2 | 14 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 19:30 | yes | 15 | 21 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:09 | yes | 17 | 13 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 12:10 | no | 0 | 7 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 15:18 | no | 0 | 19 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 16:56 | yes | 10 | 9 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:53 | yes | 5 | 13 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:49 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 12:47 | yes | 15 | 34 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:27 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:47 | no | 0 | 27 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 08:41 | yes | 15 | 66 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:22 | yes | 15 | 161 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:32 | yes | 9 | 63 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:49 | yes | 5 | 16 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:50 | no | 0 | 3 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 08:55 | yes | 18 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 18:45 | yes | 3 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:48 | yes | 8 | 20 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 15:45 | yes | 10 | 4 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:09 | yes | 5 | 10 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:04 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:47 | yes | 24 | 47 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:56 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 14:03 | yes | 11 | 60 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 14:27 | yes | 24 | 37 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:18 | yes | 25 | 135 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:35 | no | 0 | 20 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:35 | yes | 3 | 20 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:51 | yes | 15 | 24 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Bitdefender read as Bitdefender GravityZone EDR
Bitdefender GravityZone read as Bitdefender GravityZone EDR
Bitdefender GravityZone (standard EDR) read as Bitdefender GravityZone EDR
Bitdefender GravityZone Business Security read as Bitdefender GravityZone EDR
Bitdefender GravityZone Business Security Enterprise read as Bitdefender GravityZone EDR
Carbon Black read as VMware Carbon Black
Carbon Black (now under Broadcom) read as VMware Carbon Black
Cisco read as Cisco Secure Endpoint
Cortex XDR read as Palo Alto Networks Cortex XDR
CrowdStrike Falcon read as CrowdStrike Falcon Insight
CrowdStrike Falcon Complete read as CrowdStrike Falcon Insight
CrowdStrike Falcon Enterprise read as CrowdStrike Falcon Insight
CrowdStrike Falcon Go read as CrowdStrike Falcon Insight
CrowdStrike Falcon Insight XDR read as CrowdStrike Falcon Insight
CrowdStrike Falcon Pro/Enterprise read as CrowdStrike Falcon Insight
Cynet 360 read as Cynet
ESET read as ESET PROTECT
ESET PROTECT Platform read as ESET PROTECT
Elastic read as Elastic Security
Fortinet FortiEDR read as FortiEDR
Huntress read as Huntress Managed EDR
Huntress (MDR) read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Detection and Response (EDR) Expert
Microsoft Defender read as Microsoft Defender for Endpoint
Microsoft Defender for Business / Defender for Endpoint read as Microsoft Defender for Endpoint
Microsoft Defender for Endpoint P2 read as Microsoft Defender for Endpoint
Microsoft Defender for Endpoint Plan 2 read as Microsoft Defender for Endpoint
Palo Alto read as Palo Alto Networks Cortex XDR
Palo Alto Cortex XDR read as Palo Alto Networks Cortex XDR
Palo Alto Networks read as Palo Alto Networks Cortex XDR
Palo Alto Networks (Cortex XDR) read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity
SentinelOne (Singularity Endpoint) read as SentinelOne Singularity
SentinelOne Singularity read as SentinelOne Singularity
SentinelOne Singularity Complete read as SentinelOne Singularity
SentinelOne Singularity Endpoint read as SentinelOne Singularity
Sophos read as Sophos Intercept X
Sophos (Intercept X) read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Intercept X Advanced read as Sophos Intercept X
Sophos Intercept X Endpoint read as Sophos Intercept X
Symantec read as Symantec Endpoint Security
ThreatDown read as ThreatDown EDR
ThreatDown by Malwarebytes read as ThreatDown EDR
Trellix read as Trellix EDR
Trellix (Legacy McAfee/FireEye) read as Trellix EDR
Trend Micro Vision One read as Trend Micro
Trend Micro XDR read as Trend Micro
Unresolved, counted raw
Bitdefender GravityZone Elite/Ultra
ESET Inspect
FireEye's EDR
GravityZone XDR
IBM Security MaaS360 with Watson
IBM Security QRadar EDR
Kaspersky Endpoint Detection and Response
Kaspersky Security Solutions
SentinelOne Control/Complete
SentinelOne Singularity™ Complete
Sophos Central with EDR
Sophos EDR
Sophos Intercept X for Standard Small Business
Xcitium OpenEDR
Discontinued, still offered
No shut-down product was recommended here.