Insider risk management for enterprise buyers
Asked as “insider risk management tool”, and as “insider threat platform”, on behalf of an enterprise B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the November 2026 Edition.
Standing · first-choice share
57%
Clear leader
57Microsoft Purview Insider Risk Management16DTEX Systems08DTEX InTERCEPT20others
57% of first choices, clear leader.
Since October 2026▲+13Since October 2026: 44% → 57%, +13 points. Past the 11-point floor: movement.Microsoft Purview Insider Risk Management held the lead, +13 points on 44%, past the floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessMicrosoft Purview Insider Risk Management50%Clear leader▲+8Since October 2026: 42% → 50%, +8 points. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Purview Insider Risk Management45%Clear leader▲+19Since October 2026: 26% → 45%, +19 points. Past the 11-point floor: movement.Standing →EnterpriseMicrosoft Purview Insider Risk Management57%Clear leader▲+13Since October 2026: 44% → 57%, +13 points. Past the 11-point floor: movement.This page
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Microsoft Purview Insider Risk Management57%2%65endorsed leader▲+13Since October 2026: 44% → 57%, +13 points. Past the 11-point floor: movement.44% → 57%
02
DTEX Systems16%3%30accepted challenger▲+4Since October 2026: 12% → 16%, +4 points. Inside the 11-point floor: within noise.12% → 16%
DTEX Systems16%3%30accepted challenger▲+4Since October 2026: 12% → 16%, +4 points. Inside the 11-point floor: within noise.12% → 16%03
DTEX InTERCEPT8%7%30accepted challenger=heldSince October 2026: 8% → 8%, ±0 points. Inside the 11-point floor: within noise.8% → 8%
DTEX InTERCEPT8%7%30accepted challenger=heldSince October 2026: 8% → 8%, ±0 points. Inside the 11-point floor: within noise.8% → 8%04
Proofpoint Insider Threat Management6%10%39accepted challenger▲+2Since October 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise.4% → 6%
Proofpoint Insider Threat Management6%10%39accepted challenger▲+2Since October 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise.4% → 6%05
Above Security6%13%23accepted challenger▲+2Since October 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise.4% → 6%
Above Security6%13%23accepted challenger▲+2Since October 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise.4% → 6%06
Code42 Incydr2%5%22accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Code42 Incydr2%5%22accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%07
Exabeam2%11%19accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Exabeam2%11%19accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%08
Teramind2%46%39criticized challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Teramind2%46%39criticized challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%Show the five products at 0%, ordered by negative rate
13
Veriato0%67%12criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Veriato0%67%12criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%12
Forcepoint DLP0%20%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Forcepoint DLP0%20%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%11Securonix UEBA0%14%21accepted challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%
09
Varonis Data Security Platform0%10%39accepted challenger▼−6Since October 2026: 6% → 0%, −6 points. Inside the 11-point floor: within noise.6% → 0%
Varonis Data Security Platform0%10%39accepted challenger▼−6Since October 2026: 6% → 0%, −6 points. Inside the 11-point floor: within noise.6% → 0%10
Cyberhaven0%6%17accepted challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%
Cyberhaven0%6%17accepted challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
Microsoft Purview Insider Risk Management vs TeramindMicrosoft Purview Insider Risk Management vs Code42 IncydrMicrosoft Purview Insider Risk Management vs ActivTrak
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.All twenty-eight head-to-head pages: the top eight products, each against each
Microsoft Purview Insider Risk Management vs Proofpoint Insider Threat ManagementMicrosoft Purview Insider Risk Management vs ApployeMicrosoft Purview Insider Risk Management vs CyberhavenMicrosoft Purview Insider Risk Management vs DTEX SystemsTeramind vs Code42 IncydrTeramind vs ActivTrakTeramind vs Proofpoint Insider Threat ManagementTeramind vs ApployeTeramind vs CyberhavenTeramind vs DTEX SystemsCode42 Incydr vs ActivTrakCode42 Incydr vs Proofpoint Insider Threat ManagementCode42 Incydr vs ApployeCode42 Incydr vs CyberhavenCode42 Incydr vs DTEX SystemsActivTrak vs Proofpoint Insider Threat ManagementActivTrak vs ApployeActivTrak vs CyberhavenActivTrak vs DTEX SystemsProofpoint Insider Threat Management vs ApployeProofpoint Insider Threat Management vs CyberhavenProofpoint Insider Threat Management vs DTEX SystemsApploye vs CyberhavenApploye vs DTEX SystemsCyberhaven vs DTEX Systems
One product takes 57% of first choices here, so the chart would put twelve markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Two products carry a negative rate above 25% in this category.
What they warned about
Four of fourteen models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5 and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Teramind46%
18 of 39 labels negative · 11 of 14 models · 5 hard negative
“Overly Invasive "Bossware" / Full-Screen Recording Tools (e.g., Teramind, ActivTrak, Time Doctor in surveillance mode) ... Recommendation: Avoid as a primary insider risk tool.” DeepSeek V4 Flash, negative prompt
Veriato67%
8 of 12 labels negative · 7 of 14 models · 4 hard negative
“overly surveillance-heavy tools, such as Teramind and Veriato, should be approached with caution or avoided” Llama 4 Maverick, negative prompt
Coro100%
4 of 4 labels negative · 4 of 14 models · 3 hard negative
“Noted for limited features and potential performance shortcomings in large-scale deployments.” Mistral Small, negative prompt
Metomic100%
4 of 4 labels negative · 4 of 14 models · 3 hard negative
“Noted for limited features and potential performance shortcomings in large-scale deployments.” Mistral Small, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
75 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 867 links across 176 sites, every framing counted. Ranked by the number of answers carrying the site or page. 49 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
52 answers · 100 citations · 12 models
vendor site · DTEX32 answers · 47 citations · 12 models
vendor site · Microsoft24 answers · 45 citations · 9 models
vendor site · Jazz24 answers · 35 citations · 11 models
vendor site · Exabeam23 answers · 34 citations · 12 models
18 answers · 23 citations · 8 models
vendor site · Microsoft16 answers · 26 citations · 8 models
16 answers · 16 citations · 10 models
15 answers · 22 citations · 7 models
vendor site · Guideflow15 answers · 15 citations · 8 models
vendor site · Venn14 answers · 14 citations · 7 models
13 answers · 13 citations · 6 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
28 answers · 10 models
19 answers · 7 models
16 answers · 10 models
16 answers · 8 models
15 answers · 10 models
14 answers · 8 models
14 answers · 6 models
14 answers · 7 models
13 answers · 7 models
13 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best insider risk management tool”, “insider risk management tool”, “insider risk management tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft parent site Microsoft Purview Insider Risk Management 57% | 57% | 168 | 2,240,000 | 403,136 | ||||
| DTEX Systems dtex.ai DTEX Systems 16%, DTEX InTERCEPT 8% | 24% | 70 | 480 | 19 | 1,296 | 10 | ||
| Proofpoint parent site Proofpoint Insider Threat Management 6%, Proofpoint ITM 0% | 6% | 63 | 27,100 | 1,488 | ||||
| Above Security above.security | 6% | 46 | 390 | 178 | 172 | 7 | ||
| Code42 Incydr mimecast.com | 2% | 51 | 110 | 6 | 148,929 | 21 | ||
| Exabeam exabeam.com | 2% | 110 | 1,900 | 82 | 66,723 | 0 | 4 | |
| Microsoft Purview Insider Risk Management add-on | 2% | |||||||
| Teramind teramind.co | 2% | 137 | 5,400 | 119 | 19,425 | $518 | 48 | 2 |
| Varonis Data Security Platform varonis.com | 0% | 224 | 210 | 2 | 136,629 | 12 | ||
| Cyberhaven cyberhaven.com | 0% | 82 | 2,900 | 54 | 13,999 | 22 | 6 |
Google's top ten for the three searches hold 17 sites; 4 of them are among the sites the models cited here (exabeam.com, gartner.com, learn.microsoft.com, microsoft.com). The first result for “best insider risk management tool” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best insider risk management tool for an enterprise B2B company?”Paraphrase“Which insider threat platform would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade insider risk management tools and how do they differ?”Budget-constrained“What is the best insider risk management tool for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an insider risk management tool. What should we look at?”Negative“Which insider risk management tools should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5DTEX SystemsDTEX SystemsHeldAbove Security, DTEX InTERCEPTMicrosoft Purview Insider Risk Managementagainst: DTEX InTERCEPT, Exabeam, Forcepoint DLP, Proofpoint, Syteca, Veriatono first choiceagainst: CyberArk, Proofpoint Insider Threat Management, Teramind, Trellix, Varonis Data Security Platform
Three alternatives
Code42's Incydr, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat ManagementFive alternatives
Above Security, Cyberhaven, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBAFour alternatives
Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBA, Varonis Data Security PlatformOne alternative
TeramindGPT-5.4 miniMicrosoft Purview Insider Risk Management, Proofpoint Insider Threat ManagementMicrosoft Purview Insider Risk ManagementChangedMicrosoft Purview Insider Risk Management, Proofpoint Insider Threat ManagementMicrosoft Purview Insider Risk Managementno first choicenothing named
Two alternatives
Teramind, Varonis Data Security PlatformThree alternatives
DTEX InTERCEPT, Proofpoint Insider Threat Management, Varonis Data Security PlatformOne alternative
DTEX Insider Risk ManagementTwo alternatives
Proofpoint Insider Threat Management, Varonis Data Security PlatformGemini 3.5 FlashCode42 Incydr, Microsoft Purview Insider Risk ManagementDTEX InTERCEPTChangedMicrosoft Purview Insider Risk ManagementMicrosoft Purview Insider Risk Managementagainst: Proofpoint ITM, Securonix UEBA, Splunk, Teramindno first choiceagainst: Hubstaff, Time Doctor, Veriato
Three alternatives
DTEX Systems, Proofpoint Insider Threat Management, Varonis Data Security PlatformFour alternatives
Code42 Incydr, Cyberhaven, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat ManagementFive alternatives
Code42 Incydr, DTEX InPrivate / InSIGHT, Forcepoint Insider Threat, Proofpoint Insider Threat Management, Varonis Data Security PlatformTwo alternatives
Code42 Incydr, DTEX InSIGHTPerplexity SonarMicrosoft Purview Insider Risk ManagementMicrosoft Purview Insider Risk ManagementHeldDTEX InTERCEPTagainst: TeramindMicrosoft Purview Insider Risk Managementagainst: DTEX InTERCEPT, Proofpoint, Varonis Data Security Platformno first choiceagainst: Coro, Metomic, Teramind, Veriato
Three alternatives
DTEX InTERCEPT, Proofpoint Insider Threat Management, Varonis Data Security PlatformThree alternatives
DTEX InTERCEPT, Proofpoint Insider Threat Management, Varonis Data Security PlatformSeven alternatives
Cyberhaven, Forcepoint Insider Risk Protection, Gurucul, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBA, Varonis Data Security PlatformTwo alternatives
Code42 Incydr, Purview SuiteGrok 4.20Microsoft Purview Insider Risk Managementagainst: Above Security, Living SecurityProofpoint Insider Threat ManagementChangedno first choiceMicrosoft Purview Insider Risk Managementagainst: Code42 Incydr, DTEX Systems, Forcepoint DLP, Gurucul, Proofpoint Insider Threat Management, Securonix UEBA, Varonis Data Security PlatformMicrosoft Purview Insider Risk Managementagainst: Forcepoint DLP, IBM Guardium, Nightfall AI, Splunk UBA, Teramind, Varonis Data Security Platform
Three alternatives
Code42 Incydr, DTEX Systems, Varonis Data Security PlatformFour alternatives
Code42 Incydr, DTEX Systems, Exabeam, Microsoft Purview Insider Risk ManagementThree alternatives
DTEX Systems, Proofpoint Insider Threat Management, Varonis Data Security PlatformMistral SmallDTEX Systems, Microsoft Purview Insider Risk ManagementExabeamChangedVaronis Data Security PlatformAbove Securityno first choiceagainst: Coro, Metomic, Teramind, Veriato
Two alternatives
Forcepoint DLP, Varonis Data Security PlatformTwo alternatives
Illumio Zero Trust Segmentation, Proofpoint Insider Threat ManagementSix alternatives
Cisco (Splunk) User Behavior Analytics, Code42 Incydr, DTEX InTERCEPT, Gurucul, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat ManagementDeepSeek V4 FlashMicrosoft Purview Insider Risk Managementagainst: TeramindDTEX SystemsChangedno first choiceMicrosoft Purview Insider Risk Managementagainst: Exabeam, Proofpoint Insider Threat Management, Securonix UEBA, Splunk Enterprise Security, Splunk UBAno first choiceagainst: Teramindagainst: ActivTrak, Teramind, Time Doctor
Three alternatives
Code42 Incydr, DTEX InTERCEPT, Proofpoint Insider Threat ManagementFive alternatives
Above Security, Exabeam, Microsoft Purview Insider Risk Management, Proofpoint ITM, Varonis Data Security PlatformEight alternatives
Cyberhaven, DTEX Systems, Forcepoint DLP, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBA, Teramind, Varonis Data Security PlatformOne alternative
DTEX InTERCEPTLlama 4 MaverickMicrosoft Purview Insider Risk ManagementMicrosoft Purview Insider Risk ManagementHeldno first choiceno first choiceno first choiceagainst: Teramind, Veriato
Three alternatives
DTEX Systems, Everfox Insider Risk Management, OktaFour alternatives
DTEX Systems, Exabeam, Securonix UEBA, TeramindQwen 3.7 FlashMicrosoft Purview Insider Risk ManagementAbove Security, DTEX SystemsChangedno first choiceagainst: Cyberhaven, TeramindMicrosoft Purview Insider Risk Managementno first choiceagainst: Code42, Coro, Metomic, Teramind, Veriato
Four alternatives
Exabeam, OneTrust, Securiti.ai, TessianFour alternatives
Exabeam, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBAFour alternatives
Above Security, DTEX Systems, Microsoft Purview Insider Risk Management, Varonis Data Security PlatformTwo alternatives
Above Security, DTEX InTERCEPTKimi K2DTEX InTERCEPT, Microsoft Purview Insider Risk ManagementDTEX InTERCEPTChangedno first choiceagainst: TeramindMicrosoft Purview Insider Risk Managementagainst: Above Security, Proofpoint, TeramindMicrosoft Purview Insider Risk Managementagainst: Teramindagainst: Workday
Three alternatives
Cyberhaven, Proofpoint Insider Threat Management, TeramindFour alternatives
Code42 Incydr, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Varonis Data Security PlatformSeven alternatives
CrowdStrike Falcon Identity Protection, Cyberhaven, DTEX InTERCEPT, Forcepoint DLP, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Splunk UEBA / Enterprise SecurityOne alternative
DTEX InTERCEPTTwo alternatives
DTEX InTERCEPT, Varonis Data Security PlatformGLM 4.7 FlashXMicrosoft Purview Insider Risk ManagementDTEX Systems, Proofpoint Insider Threat ManagementChangedagainst: Above Securityno first choiceMicrosoft Purview Insider Risk Managementagainst: Proofpoint ITMno first choicenothing named
Three alternatives
DTEX Systems, Exabeam, Varonis Data Security PlatformFour alternatives
Behavox Quantum, Exabeam, Microsoft Purview Insider Risk Management, Varonis Data Security PlatformOne alternative
TeramindMiniMax M2.5DTEX Systems, TeramindDTEX SystemsChangedno first choiceMicrosoft Purview Insider Risk Managementno first choicenothing named
Four alternatives
Exabeam, Forcepoint DLP, Microsoft Purview Insider Risk Management, Varonis Data Security PlatformThree alternatives
Above Security, Exabeam, Varonis Data Security PlatformFour alternatives
Code42 Incydr, Proofpoint ITM, Secure60.io, TeramindGPT-6 LunaMicrosoft Purview Insider Risk ManagementMicrosoft Purview Insider Risk ManagementHeldno first choiceMicrosoft Purview Insider Risk Managementno first choiceagainst: Kickidler, Teramind
Two alternatives
DTEX InTERCEPT, Proofpoint Insider Threat ManagementThree alternatives
Cyberhaven, DTEX InTERCEPT, Proofpoint Insider Threat ManagementSeven alternatives
DTEX InTERCEPT, Forcepoint Insider Risk, Microsoft Purview Insider Risk Management, Netskope One, Proofpoint Insider Threat Management, Securonix UEBA, Varonis Data Security PlatformOne alternative
VeriatoMuse Glimmer 30BDTEX InTERCEPT, Microsoft Purview Insider Risk ManagementAbove SecurityChangedno first choiceagainst: Microsoft Purview Insider Risk Management, Netskope, OpenTextMicrosoft Purview Insider Risk Management add-onagainst: Proofpoint, Teramind, Veriatono first choiceagainst: Coro, Metomic, Proofpoint Insider Threat Management, Teramind, Veriato
One alternative
Proofpoint Insider Threat ManagementTwo alternatives
DTEX Systems, Microsoft Purview Insider Risk ManagementEleven alternatives
Code42 Incydr, DTEX InTERCEPT, DTEX Systems, Ekran System, Exabeam, Forcepoint DLP, Microsoft Purview Insider Risk Management, Proofpoint Insider Threat Management, Securonix UEBA, Teramind, Varonis Data Security PlatformTwo alternatives
Above Security, InsightfulTwo alternatives
DTEX Systems, Securonix UEBABold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:11 | yes | 9 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:09 | yes | 3 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:50 | yes | 4 | 21 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 13:00 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:36 | yes | 15 | 16 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:55 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 12:35 | yes | 23 | 29 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 15:05 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:11 | no | 0 | 30 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 18:13 | yes | 10 | 41 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 19:01 | yes | 14 | 20 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:11 | yes | 5 | 34 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 09:05 | yes | 3 | 13 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:10 | yes | 23 | 25 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 15:12 | yes | 14 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 15:11 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 14:57 | yes | 5 | 22 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 14:30 | yes | 10 | 7 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:37 | yes | 13 | 13 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:42 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 19:32 | yes | 24 | 34 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:02 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:09 | yes | 5 | 19 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:45 | yes | 10 | 57 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 19:03 | yes | 18 | 37 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 18:34 | yes | 10 | 31 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:46 | yes | 3 | 18 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 09:01 | yes | 15 | 20 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:36 | yes | 10 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 18:18 | yes | 5 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:09 | no | 0 | 20 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 11:10 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:44 | yes | 13 | 46 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:40 | yes | 5 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:20 | yes | 24 | 44 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:05 | yes | 9 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:37 | yes | 14 | 37 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 11:49 | yes | 10 | 27 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:40 | yes | 14 | 88 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:53 | yes | 9 | 77 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 19:39 | yes | 10 | 26 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:35 | yes | 14 | 26 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:55 | yes | 16 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:14 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:14 | yes | 6 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 17:12 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:31 | yes | 20 | 14 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:12 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 14:39 | no | 0 | 17 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:31 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:10 | yes | 5 | 28 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:43 | yes | 19 | 58 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:09 | yes | 20 | 56 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:07 | yes | 21 | 60 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 08:55 | yes | 3 | 16 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:02 | yes | 14 | 26 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 18:31 | yes | 25 | 17 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:58 | no | 0 | 10 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:35 | no | 0 | 20 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 18:34 | yes | 10 | 11 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:32 | yes | 10 | 17 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:32 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:00 | yes | 23 | 59 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 15:00 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:17 | no | 0 | 32 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 11:00 | yes | 10 | 72 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:25 | yes | 23 | 69 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:26 | yes | 20 | 27 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:10 | yes | 4 | 20 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:31 | yes | 14 | 25 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:00 | yes | 18 | 10 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:21 | yes | 3 | 9 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 13:13 | no | 0 | 17 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 12:49 | yes | 10 | 4 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:36 | yes | 14 | 15 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 15:37 | yes | 5 | 4 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 12:17 | yes | 25 | 58 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:52 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:06 | yes | 5 | 35 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:51 | yes | 24 | 42 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:30 | yes | 23 | 98 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:01 | no | 0 | 32 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:41 | yes | 5 | 24 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:58 | yes | 22 | 29 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
DTEX read as DTEX InTERCEPT
Forcepoint read as Forcepoint DLP
Forcepoint (Risk-Adaptive DLP) read as Forcepoint DLP
Microsoft read as Microsoft Purview Insider Risk Management
Microsoft (Insider Risk Management in Purview) read as Microsoft Purview Insider Risk Management
Microsoft Purview read as Microsoft Purview Insider Risk Management
Microsoft Purview (Insider Risk Management) read as Microsoft Purview Insider Risk Management
Microsoft Purview IRM read as Microsoft Purview Insider Risk Management
Mimecast Incydr read as Code42 Incydr
Mimecast Incydr (formerly Code42 Incydr) read as Code42 Incydr
Mimecast Incydr (formerly Code42) read as Code42 Incydr
Proofpoint ObserveIT read as Proofpoint Insider Threat Management
Securonix read as Securonix UEBA
Varonis read as Varonis Data Security Platform
Varonis (EDM/data-centric) read as Varonis Data Security Platform
Varonis Insider Risk Management read as Varonis Data Security Platform
Varonis Platform read as Varonis Data Security Platform
Unresolved, counted raw
Behavox Quantum
Cisco (Splunk) User Behavior Analytics
Code42's Incydr
Cylance/Palo Alto Networks
DTEX InPrivate / InSIGHT (DTEX Systems)
DTEX InSIGHT
DTEX Insider Risk Management
Everfox Insider Risk Management
Forcepoint Insider Risk Protection
IBM QRadar UEBA
IXN Solutions 351X Platform
Insider One
Microsoft Purview Insider Risk Management add-on
Purview Suite
Splunk UEBA / Enterprise Security
Splunk User Behavior Monitoring
Discontinued, still offered
No shut-down product was recommended here.