Endpoint detection and response
Asked as “EDR platform”, and as “endpoint detection and response tool”, on behalf of a mid-market B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
22%
Contested · Bitdefender GravityZone EDR 20%
22Microsoft Defender for Endpoint20Bitdefender GravityZone EDR16CrowdStrike Falcon Insight43others
22% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the six products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Defender for Endpoint vs Microsoft Defender for CloudMicrosoft Defender for Endpoint vs SentinelOne SingularityMicrosoft Defender for Endpoint vs CrowdStrikeBitdefender GravityZone EDR vs CrowdStrike Falcon InsightBitdefender GravityZone EDR vs Huntress Managed EDRBitdefender GravityZone EDR vs Microsoft Defender for CloudBitdefender GravityZone EDR vs SentinelOne SingularityBitdefender GravityZone EDR vs CrowdStrikeCrowdStrike Falcon Insight vs Huntress Managed EDRCrowdStrike Falcon Insight vs Microsoft Defender for CloudCrowdStrike Falcon Insight vs SentinelOne SingularityCrowdStrike Falcon Insight vs CrowdStrikeHuntress Managed EDR vs Microsoft Defender for CloudHuntress Managed EDR vs SentinelOne SingularityHuntress Managed EDR vs CrowdStrikeMicrosoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs CrowdStrikeSentinelOne Singularity vs CrowdStrike
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Microsoft Defender for Endpoint22%
Microsoft Defender for Endpoint22%02Bitdefender GravityZone EDR20%
Bitdefender GravityZone EDR20%03CrowdStrike Falcon Insight16%
CrowdStrike Falcon Insight16%04Huntress Managed EDR14%
Huntress Managed EDR14%05Microsoft Defender for Cloud14%
Microsoft Defender for Cloud14%06SentinelOne Singularity8%
SentinelOne Singularity8%07CrowdStrike6%
CrowdStrike6%08Sophos Intercept X0%
Sophos Intercept X0%09Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%10Cynet0%
Cynet0%11Trend Micro0%
Trend Micro0%12ThreatDown EDR0%
ThreatDown EDR0%13VMware Carbon Black0%
VMware Carbon Black0%What they warned about
Three of twelve models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
VMware Carbon Black58%
7 of 12 labels negative · 6 of 12 models · 4 hard negative
“Strongly Avoid or High Caution... High false positives blocking legit apps, integration struggles post-acquisitions, premium pricing without matching value” Grok 4.20, negative prompt
SentinelOne Singularity16%
7 of 45 labels negative · 6 of 12 models
“Cautions: Occasional false positives/alert issues, compatibility/migration challenges, less mature ecosystem/threat intel depth, weaker non-Windows support.” Grok 4.20, negative prompt
CrowdStrike Falcon Insight17%
7 of 41 labels negative · 5 of 12 models
“Excellent capabilities, but the 2024 outage and testing controversies are valid caution flags for risk-averse environments.” GLM 4.7 FlashX, negative prompt
Datto EDR100%
4 of 4 labels negative · 4 of 12 models · 3 hard negative
“MSP reviews describe it as "among the least effective tools"... the high FPR and operational overhead can be a dealbreaker.” GLM 4.7 FlashX, negative prompt
What they cite
Twelve of the twelve models returned a source list in this edition: four return the pages they cited and eight the search results they consulted.
Sites the answers cite
65 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 812 links across 220 sites, every framing counted. Ranked by the number of answers carrying the site or page.
43 answers · 47 citations · 10 models
33 answers · 35 citations · 11 models
vendor site · CyberPress31 answers · 31 citations · 10 models
vendor site · Huntress26 answers · 40 citations · 11 models
vendor site · Acronis17 answers · 17 citations · 7 models
vendor site · SenseOn17 answers · 17 citations · 9 models
vendor site · G215 answers · 19 citations · 8 models
vendor site · Kaseya15 answers · 15 citations · 7 models
14 answers · 28 citations · 8 models
14 answers · 22 citations · 8 models
13 answers · 15 citations · 9 models
vendor site · SentinelOne13 answers · 15 citations · 6 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
40 answers · 9 models
33 answers · 11 models
31 answers · 10 models
17 answers · 9 models
15 answers · 7 models
14 answers · 7 models
14 answers · 5 models
13 answers · 9 models
12 answers · 8 models
12 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best edr platform”, “edr platform”, “edr platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender parent site Microsoft Defender for Endpoint 22%, Microsoft Defender XDR 0% | 22% | 264 | 18,100 | 3,525 | ||||
| Bitdefender parent site Bitdefender GravityZone EDR 20% | 20% | 64 | 90,500 | 3,261 | ||||
| CrowdStrike parent site CrowdStrike Falcon Insight 16% | 16% | 148 | 74,000 | 5,130 | ||||
| Huntress huntress.com Huntress Managed EDR 14% | 14% | 353 | 33,100 | 4,338 | 352,368 company | $15,522 | 120 | |
| Microsoft Defender microsoft.com Microsoft Defender for Cloud 14%, Microsoft 0% | 14% | 659 | 2,240,000 | 403,136 | 145,358,109 company | $12,455 | 103 | 4 |
| SentinelOne sentinelone.com SentinelOne Singularity 8% | 8% | 499 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 1 |
| CrowdStrike crowdstrike.com | 6% | 302 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | |
| ESET eset.com ESET PROTECT 2% | 2% | 111 | 18,100 | 1,812 | 637,959 company | $4,397 | 75 | |
| Sophos sophos.com Sophos Intercept X 0% | 0% | 304 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| Palo Alto Networks parent site Palo Alto Networks Cortex XDR 0% | 0% | 251 | 40,500 | 1,088 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (acronis.com, learn.g2.com, reddit.com, sentinelone.com). The first result for “best edr platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best EDR platform for a mid-market B2B company?”Paraphrase“Which endpoint detection and response tool would you recommend to a mid-sized B2B company?”Comparative“What are the top EDR platforms and how do they differ?”Budget-constrained“What is the best EDR platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a EDR platform. What should we look at?”Negative“Which EDR platforms should I avoid or be cautious about?”
Claude Haiku 4.5Huntress Managed EDRHuntress Managed EDRHeldno first choiceagainst: Datto RMMMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike, Cybereason
Five alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne Singularity, ThreatDown EDRTwo alternatives
Bitdefender GravityZone EDR, ESET PROTECTTwo alternatives
Bitdefender GravityZone EDR, ThreatDown EDRGPT-5.4 miniCrowdStrike Falcon Insight, Microsoft Defender for EndpointMicrosoft Defender for EndpointChangedCrowdStrike Falcon Insight, Microsoft Defender for Endpointagainst: Symantec Endpoint Security, Trellix EDR, VMware Carbon BlackMicrosoft Defender for Cloud, Microsoft Defender for Endpointagainst: CrowdStrike, SentinelOne Singularityno first choiceagainst: FortiEDR, Microsoft Defender XDR, VMware Carbon Black
Three alternatives
Huntress Managed EDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
CrowdStrike Falcon Insight, SentinelOne SingularityThree alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XOne alternative
Sophos Intercept XGemini 3.5 FlashSentinelOne Singularityagainst: CrowdStrike Falcon Insight, Microsoft Defender for EndpointHuntress Managed EDRChangedagainst: CrowdStrike Falcon InsightCrowdStrike Falcon InsightMicrosoft Defender for Cloudagainst: CrowdStrike, SentinelOne SingularityCrowdStrike, SentinelOne Singularityagainst: CrowdStrike, Kaspersky Endpoint Detection and Response (EDR) Expert, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity
Two alternatives
Huntress Managed EDR, Sophos Intercept XTwo alternatives
Microsoft Defender for Cloud, SentinelOne SingularityThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityFive alternatives
Bitdefender GravityZone EDR, Cynet, Huntress Managed EDR, LimaCharlie, WazuhThree alternatives
Microsoft Defender for Endpoint, Sophos Intercept X, Trend MicroPerplexity SonarCrowdStrike Falcon InsightCrowdStrike Falcon InsightHeldno first choiceMicrosoft Defender for Cloudno first choiceagainst: Elastic Security, FireEye EDR, ThreatDown EDR
Four alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, SentinelOne Singularity, Sophos Intercept X + Sophos MDRThree alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, Microsoft Defender for EndpointThree alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, SentinelOne SingularityGrok 4.20Bitdefender GravityZone EDRBitdefender GravityZone EDRHeldCrowdStrike Falcon InsightMicrosoft Defender for Cloudagainst: WazuhCrowdStrikeagainst: CrowdStrike Falcon Insight, Datto EDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Trend Micro, VMware Carbon Black
Two alternatives
CrowdStrike Falcon Insight, Microsoft Defender for EndpointFour alternatives
CrowdStrike Falcon Insight, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne SingularityFive alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend MicroThree alternatives
Bitdefender GravityZone EDR, ESET PROTECT, Huntress Managed EDRFive alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos MDRMistral SmallBitdefender GravityZone EDR, Microsoft Defender for EndpointBitdefender GravityZone EDRChangedCrowdStrike Falcon InsightESET PROTECT, Huntress Managed EDRno first choiceagainst: FireEye EDR, ThreatDown EDR, VMware Carbon Black
Two alternatives
CrowdStrike Falcon Insight, SentinelOne SingularityOne alternative
CrowdStrikeTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityThree alternatives
Bitdefender GravityZone EDR, Microsoft Defender for Endpoint, ThreatDown EDRDeepSeek V4 FlashBitdefender GravityZone EDR, Huntress Managed EDRCrowdStrike Falcon Insight, SentinelOne SingularityChangedCrowdStrike Falcon InsightMicrosoft Defender for CloudCrowdStrike Falcon Insightagainst: CrowdStrike Falcon Insight, Datto EDR, Symantec Endpoint Security, VMware Carbon Black
Two alternatives
CrowdStrike Falcon Insight, Microsoft Defender for EndpointFive alternatives
Bitdefender GravityZone EDR, Cynet, Huntress Managed EDR, Microsoft Defender for Endpoint, Sophos Intercept XThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Huntress Managed EDRThree alternatives
Cynet, Microsoft Defender for Endpoint, SentinelOne Singularity MDRLlama 4 MaverickCrowdStrikeBitdefender GravityZone EDRChangedno first choiceMicrosoft Defender for Endpointno first choiceagainst: FireEye's EDR, ThreatDown EDR
One alternative
Bitdefender GravityZone EDRTwo alternatives
Bitdefender GravityZone EDR, SenseOnQwen 3.7 FlashCrowdStrike Falcon InsightBitdefender GravityZone EDRChangedCrowdStrike Falcon Insight, SentinelOne SingularityMicrosoft Defender for EndpointCrowdStrike Falcon Insight, SentinelOne Singularityagainst: Cisco Secure Endpoint, FireEye (Mandiant) – Legacy On-Premises Solutions, SentinelOne Singularity, VMware Carbon Black
Four alternatives
Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, Sophos Intercept XTwo alternatives
Microsoft Defender XDR, Palo Alto Networks Cortex XDRFour alternatives
Bitdefender GravityZone EDR, Cynet, ESET PROTECT, Huntress Managed EDROne alternative
Microsoft Defender XDRKimi K2Bitdefender GravityZone EDRagainst: CrowdStrike Falcon InsightMicrosoft Defender for CloudChangedCrowdStrike Falcon InsightMicrosoft Defender for Endpointagainst: OSQuery, VelociraptorMicrosoft Defender for Endpointagainst: CrowdStrike Falcon Insight, Datto EDR, SentinelOne Singularity
Three alternatives
Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne SingularityThree alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, SentinelOne SingularitySeven alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend MicroFour alternatives
Bitdefender GravityZone EDR, Huntress Managed EDR, Microsoft Defender for Cloud, WazuhFour alternatives
Bitdefender GravityZone EDR, ESET PROTECT, Huntress Managed EDR, SentinelOne SingularityGLM 4.7 FlashXCrowdStrike Falcon InsightBitdefender GravityZone EDR, Microsoft Defender for EndpointChangedCrowdStrike Falcon InsightHuntress Managed EDR, Microsoft Defender for Endpointno first choiceagainst: CrowdStrike Falcon Insight, Datto EDR, Elastic Security, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, VMware Carbon Black
Five alternatives
Bitdefender GravityZone EDR, Cynet, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne SingularityOne alternative
CrowdStrike Falcon InsightSix alternatives
Bitdefender GravityZone EDR, ESET PROTECT, FortiEDR, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne SingularityFive alternatives
CrowdStrike Falcon Insight, Elastic Security, Jamf Protect Profile, Sophos Intercept X, ThreatDown EDRMiniMax M2.5no first choiceBitdefender GravityZone EDR, Microsoft Defender for EndpointChangedCrowdStrike Falcon Insight, SentinelOne SingularityHuntress Managed EDRno first choicenothing named
Two alternatives
CrowdStrike Falcon Insight, SentinelOne SingularityThree alternatives
Bitdefender GravityZone EDR, Cynet, Microsoft Defender for EndpointThree alternatives
Bitdefender GravityZone EDR, CrowdStrike Falcon Insight, Microsoft Defender for CloudBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:21 | yes | 9 | 11 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 12:02 | yes | 4 | 8 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 10:57 | yes | 14 | 25 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 13:41 | yes | 20 | 6 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:24 | yes | 19 | 13 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:43 | yes | 7 | 8 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:30 | yes | 9 | 13 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:39 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:36 | yes | 20 | 79 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 09:40 | yes | 8 | 22 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 12:22 | yes | 10 | 43 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 12:09 | no | 0 | 40 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 09:58 | yes | 9 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:13 | no | 0 | 17 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 13:43 | yes | 12 | 20 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 12:50 | yes | 20 | 6 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 09:30 | yes | 38 | 17 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:51 | yes | 5 | 4 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:21 | yes | 7 | 16 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:44 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:13 | yes | 5 | 36 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 10:10 | yes | 10 | 25 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 11:06 | yes | 24 | 37 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 13:48 | yes | 5 | 16 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:45 | yes | 9 | 8 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:40 | yes | 3 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 10:36 | yes | 22 | 23 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 12:29 | yes | 20 | 8 s |
| Comparative | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:15 | yes | 12 | 9 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 10:11 | yes | 5 | 5 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 11:20 | yes | 8 | 15 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 13:35 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:40 | yes | 5 | 33 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 13:32 | yes | 5 | 24 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 11:51 | yes | 14 | 31 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 13:29 | yes | 9 | 35 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:18 | yes | 9 | 6 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:43 | yes | 5 | 6 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 14:04 | yes | 19 | 27 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 12:55 | yes | 20 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 09:26 | yes | 15 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 10:06 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:21 | yes | 7 | 21 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:20 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:38 | yes | 5 | 22 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 12:54 | yes | 15 | 40 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 09:52 | yes | 9 | 305 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:58 | yes | 5 | 46 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:57 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:37 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 11:27 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 13:50 | yes | 20 | 10 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 11:26 | yes | 18 | 10 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:02 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:37 | yes | 19 | 24 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 10:13 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:19 | no | 0 | 38 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:24 | yes | 13 | 31 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 11:34 | yes | 10 | 106 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:28 | yes | 5 | 13 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:57 | yes | 18 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:31 | yes | 4 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:55 | yes | 22 | 26 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 09:47 | yes | 20 | 8 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:43 | yes | 25 | 15 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:46 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 13:57 | yes | 29 | 22 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:24 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 10:16 | yes | 34 | 78 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 13:03 | yes | 27 | 69 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:24 | yes | 27 | 71 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 13:06 | yes | 5 | 15 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Acronis read as Acronis Cyber Protect
Bitdefender read as Bitdefender GravityZone EDR
Bitdefender GravityZone read as Bitdefender GravityZone EDR
Bitdefender GravityZone (Business Security Enterprise) read as Bitdefender GravityZone EDR
Bitdefender GravityZone Business Security read as Bitdefender GravityZone EDR
Bitdefender GravityZone Business Security Enterprise read as Bitdefender GravityZone EDR
Bitdefender GravityZone Business Security Premium read as Bitdefender GravityZone EDR
Bitdefender GravityZone Ultra read as Bitdefender GravityZone EDR
Broadcom Symantec Endpoint Security read as Symantec Endpoint Security
Carbon Black read as VMware Carbon Black
Carbon Black (VMware) read as VMware Carbon Black
Cisco read as Cisco Secure Endpoint
Cortex read as Palo Alto Networks Cortex XDR
CrowdStrike Falcon read as CrowdStrike Falcon Insight
CrowdStrike Falcon Complete read as CrowdStrike Falcon Insight
CrowdStrike Falcon Enterprise read as CrowdStrike Falcon Insight
CrowdStrike Falcon Go read as CrowdStrike Falcon Insight
CrowdStrike Falcon Insight XDR read as CrowdStrike Falcon Insight
CrowdStrike Falcon Platform read as CrowdStrike Falcon Insight
Cynet 360 AutoXDR read as Cynet
Defender for Endpoint read as Microsoft Defender for Endpoint
ESET PROTECT Enterprise read as ESET PROTECT
ESET PROTECT Entry read as ESET PROTECT
ESET PROTECT Platform read as ESET PROTECT
Elastic read as Elastic Security
Huntress read as Huntress Managed EDR
Huntress (via MSP) read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Detection and Response (EDR) Expert
Malwarebytes ThreatDown (with EDR) read as ThreatDown EDR
Microsoft Defender read as Microsoft Defender for Endpoint
Microsoft Defender for Business/Endpoint read as Microsoft Defender for Endpoint
Microsoft Defender for Endpoint P2 read as Microsoft Defender for Endpoint
Microsoft Defender for Endpoint Plan 2 read as Microsoft Defender for Endpoint
Palo Alto read as Palo Alto Networks Cortex XDR
Palo Alto Cortex XDR read as Palo Alto Networks Cortex XDR
Palo Alto Cortex XDR (with EDR) read as Palo Alto Networks Cortex XDR
Palo Alto Networks read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity
SentinelOne Singularity read as SentinelOne Singularity
SentinelOne Singularity Complete read as SentinelOne Singularity
SentinelOne Singularity Core read as SentinelOne Singularity
SentinelOne Singularity Endpoint read as SentinelOne Singularity
Sophos read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Intercept X / Sophos EDR read as Sophos Intercept X
Sophos Intercept X Endpoint read as Sophos Intercept X
Symantec Endpoint Protection read as Symantec Endpoint Security
ThreatDown read as ThreatDown EDR
ThreatDown (formerly Malwarebytes for Teams) read as ThreatDown EDR
Trellix read as Trellix EDR
Trellix (formerly FireEye) read as Trellix EDR
Trend Micro Vision One read as Trend Micro
Windows Defender read as Windows Defender Antivirus
Unresolved, counted raw
CyberMark
FireEye (Mandiant) – Legacy On-Premises Solutions
FireEye's EDR
Jamf Protect Profile
Discontinued, still offered
No shut-down product was recommended here.