Managed detection and response
Asked as “MDR service”, and as “managed detection and response provider”, on behalf of a mid-market B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
31%
Contested · Huntress Managed EDR 27%
31Arctic Wolf Managed Detection and Response27Huntress Managed EDR12Expel MDR29others
31% of first choices, contested.
Since October 2026▼−6Since October 2026: 37% → 31%, −6 points. Inside the 11-point floor: within noise.Arctic Wolf Managed Detection and Response held the lead, −6 points on 37%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Huntress Managed EDR83%Clear leader▲+5Since October 2026: 78% → 83%, +5 points. Inside the 11-point floor: within noise.Standing →Mid-market
Arctic Wolf Managed Detection and Response31%Contested▼−6Since October 2026: 37% → 31%, −6 points. Inside the 11-point floor: within noise.This pageEnterprise
CrowdStrike Falcon Complete33%Contested▼−2Since October 2026: 35% → 33%, −2 points. Inside the 11-point floor: within noise.Standing →
Huntress Managed EDR83%Clear leader▲+5Since October 2026: 78% → 83%, +5 points. Inside the 11-point floor: within noise.Standing →Mid-marketArctic Wolf Managed Detection and Response31%Contested▼−6Since October 2026: 37% → 31%, −6 points. Inside the 11-point floor: within noise.This pageEnterpriseCrowdStrike Falcon Complete33%Contested▼−2Since October 2026: 35% → 33%, −2 points. Inside the 11-point floor: within noise.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Arctic Wolf Managed Detection and Response31%12%48endorsed leader▼−6Since October 2026: 37% → 31%, −6 points. Inside the 11-point floor: within noise.37% → 31%
Arctic Wolf Managed Detection and Response31%12%48endorsed leader▼−6Since October 2026: 37% → 31%, −6 points. Inside the 11-point floor: within noise.37% → 31%02Huntress Managed EDR27%8%39accepted challenger▼−8Since October 2026: 35% → 27%, −8 points. Inside the 11-point floor: within noise.35% → 27%
Huntress Managed EDR27%8%39accepted challenger▼−8Since October 2026: 35% → 27%, −8 points. Inside the 11-point floor: within noise.35% → 27%03
Sophos MDR12%7%54accepted challenger▼−1Since October 2026: 13% → 12%, −1 point. Inside the 11-point floor: within noise.13% → 12%
Sophos MDR12%7%54accepted challenger▼−1Since October 2026: 13% → 12%, −1 point. Inside the 11-point floor: within noise.13% → 12%04
Expel MDR12%3%35accepted challenger▲+8Since October 2026: 4% → 12%, +8 points. Inside the 11-point floor: within noise.4% → 12%
Expel MDR12%3%35accepted challenger▲+8Since October 2026: 4% → 12%, +8 points. Inside the 11-point floor: within noise.4% → 12%05CrowdStrike Falcon Complete6%22%27accepted challenger▲+4Since October 2026: 2% → 6%, +4 points. Inside the 11-point floor: within noise.2% → 6%
CrowdStrike Falcon Complete6%22%27accepted challenger▲+4Since October 2026: 2% → 6%, +4 points. Inside the 11-point floor: within noise.2% → 6%06
Red Canary4%11%18accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%
Red Canary4%11%18accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%07
Rapid7 MDR2%5%21accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
Rapid7 MDR2%5%21accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%08
CrowdStrike2%18%11accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
CrowdStrike2%18%11accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%Show the three products at 0%, ordered by negative rate
11
Cynet 3600%20%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Cynet 3600%20%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%10
SentinelOne Singularity MDR0%8%12accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
SentinelOne Singularity MDR0%8%12accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%09
eSentire MDR0%7%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
eSentire MDR0%7%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
For buyers
Head to head
All twenty-eight head-to-head pages: the top eight products, each against each
Arctic Wolf Managed Detection and Response vs CrowdStrike Falcon CompleteArctic Wolf Managed Detection and Response vs Red CanaryArctic Wolf Managed Detection and Response vs Rapid7 MDRArctic Wolf Managed Detection and Response vs CrowdStrikeHuntress Managed EDR vs Sophos MDRHuntress Managed EDR vs Expel MDRHuntress Managed EDR vs CrowdStrike Falcon CompleteHuntress Managed EDR vs Red CanaryHuntress Managed EDR vs Rapid7 MDRHuntress Managed EDR vs CrowdStrikeSophos MDR vs Expel MDRSophos MDR vs CrowdStrike Falcon CompleteSophos MDR vs Red CanarySophos MDR vs Rapid7 MDRSophos MDR vs CrowdStrikeExpel MDR vs CrowdStrike Falcon CompleteExpel MDR vs Red CanaryExpel MDR vs Rapid7 MDRExpel MDR vs CrowdStrikeCrowdStrike Falcon Complete vs Red CanaryCrowdStrike Falcon Complete vs Rapid7 MDRCrowdStrike Falcon Complete vs CrowdStrikeRed Canary vs Rapid7 MDRRed Canary vs CrowdStrikeRapid7 MDR vs CrowdStrike
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Arctic Wolf Managed Detection and Response31%
Arctic Wolf Managed Detection and Response31%02Huntress Managed EDR27%
Huntress Managed EDR27%03Sophos MDR12%
Sophos MDR12%04Expel MDR12%
Expel MDR12%05CrowdStrike Falcon Complete6%
CrowdStrike Falcon Complete6%06Red Canary4%
Red Canary4%07Rapid7 MDR2%
Rapid7 MDR2%08CrowdStrike2%
CrowdStrike2%09eSentire MDR0%
eSentire MDR0%10SentinelOne Singularity MDR0%
SentinelOne Singularity MDR0%11Cynet 3600%
Cynet 3600%What they warned about
One of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5 and GPT-6 Luna changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Arctic Wolf Managed Detection and Response12%
6 of 48 labels negative · 5 of 14 models · 1 hard negative
“Arctic Wolf (transparency issues)” Kimi K2, negative prompt
CrowdStrike Falcon Complete22%
6 of 27 labels negative · 4 of 14 models · 1 hard negative
“Avoid "enterprise-tier" providers on a budget: CrowdStrike Falcon Complete” DeepSeek V4 Flash, budget prompt
Sophos MDR7%
4 of 54 labels negative · 4 of 14 models
“multiple sources note it can be expensive for smaller organizations, so it's usually better if you can stretch the budget a bit” GPT-5.4 mini, budget prompt
Cynet 36020%
3 of 15 labels negative · 3 of 14 models · 1 hard negative
“Described as having "joke" MDR service with monthly reviews that are just alert summaries” Kimi K2, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
74 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 743 links across 196 sites, every framing counted. Ranked by the number of answers carrying the site or page. 25 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
38 answers · 56 citations · 12 models
vendor site · Expel19 answers · 26 citations · 8 models
19 answers · 19 citations · 10 models
vendor site · Cynet16 answers · 23 citations · 9 models
vendor site · Rapid716 answers · 16 citations · 10 models
15 answers · 15 citations · 8 models
13 answers · 14 citations · 6 models
13 answers · 13 citations · 9 models
vendor site · Sophos12 answers · 17 citations · 8 models
vendor site · Huntress12 answers · 14 citations · 7 models
12 answers · 12 citations · 9 models
vendor site · ESET11 answers · 12 citations · 7 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
19 answers · 10 models
19 answers · 10 models
15 answers · 8 models
13 answers · 6 models
12 answers · 7 models
12 answers · 8 models
12 answers · 9 models
10 answers · 7 models
10 answers · 4 models
10 answers · 10 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best mdr service”, “mdr service”, “mdr services”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Arctic Wolf arcticwolf.com Arctic Wolf Managed Detection and Response 31% | 31% | 127 | 49,500 | 1,342 | 40,780 company | 56 | 9 | |
| Huntress huntress.com Huntress Managed EDR 27%, Huntress MDR 4% | 31% | 353 | 33,100 | 4,338 | 352,368 company | $15,522 | 120 | 8 |
| Sophos parent site Sophos MDR 12% | 12% | 155 | 18,100 | 2,046 | ||||
| Expel MDR expel.com | 12% | 88 | 210 | 2 | 16,570 | $314 | 7 | 7 |
| CrowdStrike parent site CrowdStrike Falcon Complete 6% | 6% | 84 | 74,000 | 5,130 | ||||
| Red Canary zscaler.com | 4% | 58 | 4,400 | 232 | 103,886 | $9,116 | 66 | |
| Rapid7 parent site Rapid7 MDR 2% | 2% | 52 | 14,800 | 798 | ||||
| CrowdStrike crowdstrike.com | 2% | 302 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | 6 |
| eSentire MDR esentire.com | 0% | 40 | 50 | 0 | 4,642 | $114 | 58 | |
| SentinelOne parent site SentinelOne Singularity MDR 0%, SentinelOne Singularity Wayfinder 0% | 0% | 35 | 33,100 | 1,675 |
Google's top ten for the three searches hold 23 sites; 5 of them are among the sites the models cited here (eset.com, expel.com, huntress.com, rapid7.com, sophos.com). The first result for “best mdr service” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best MDR service for a mid-market B2B company?”Paraphrase“Which managed detection and response provider would you recommend to a mid-sized B2B company?”Comparative“What are the top MDR services and how do they differ?”Budget-constrained“What is the best MDR service for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a MDR service. What should we look at?”Negative“Which MDR services should I avoid or be cautious about?”
Claude Haiku 4.5Arctic Wolf Managed Detection and ResponseRapid7 MDRChangedCrowdStrike Falcon CompleteHuntress MDRno first choiceagainst: Arctic Wolf Managed Detection and Response, Check Point, Huntress Managed EDR, Kaseya K365, SentinelOne Vigilance Respond, Sophos MDR
Three alternatives
Rapid7 MDR, Sophos MDR, eSentire MDRThree alternatives
ESET PROTECT, Eye Security, Sophos MDRFour alternatives
Arctic Wolf Managed Detection and Response, Huntress Managed EDR, SentinelOne Singularity Wayfinder, Sophos MDRTwo alternatives
Sophos MDR, WebrootGPT-5.4 miniArctic Wolf Managed Detection and Response, CrowdStrike Falcon CompleteCrowdStrike Falcon CompleteChangedno first choiceHuntress Managed EDRagainst: Sophos MDRno first choicenothing named
Three alternatives
Microsoft Defender Experts for XDR, Rapid7 MDR, Sophos MDRThree alternatives
Arctic Wolf Managed Detection and Response, Rapid7 MDR, Sophos MDRSeven alternatives
Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Microsoft Defender Experts for XDR, Palo Alto Networks' Cortex-based MDR offerings, Rapid7 MDR, SentinelOne Singularity MDR, Sophos MDROne alternative
BlumiraGemini 3.5 FlashArctic Wolf Managed Detection and Response, Expel MDRArctic Wolf Managed Detection and ResponseChangedCrowdStrike Falcon CompleteHuntress Managed EDRagainst: CrowdStrike, SentinelOne Singularity MDRno first choicenothing named
Four alternatives
CrowdStrike Falcon Complete, Huntress Managed EDR, Red Canary, Sophos MDRFour alternatives
CrowdStrike Falcon Complete, Expel MDR, Red Canary, Sophos MDRNine alternatives
Arctic Wolf Managed Detection and Response, Expel MDR, Huntress Managed EDR, Microsoft Defender Experts for MDR, Rapid7 MDR, Red Canary, SentinelOne Singularity MDR, Sophos MDR, Unit 42 Managed Detection and ResponseFour alternatives
Blackpoint Cyber, ESET PROTECT MDR, Field Effect MDR, Sophos MDRPerplexity SonarArctic Wolf Managed Detection and Responseagainst: Huntress Managed EDRExpel MDRChangedagainst: CrowdStrike Falcon Completeno first choiceHuntress Managed EDRagainst: Cynet 360, Sophos MDRno first choicenothing named
Five alternatives
CrowdStrike, Expel MDR, Red Canary, SentinelOne Singularity MDR, Sophos MDRThree alternatives
Arctic Wolf Managed Detection and Response, Huntress Managed EDR, Sophos MDRNine alternatives
Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Expel MDR, Huntress Managed EDR, Rapid7 MDR, Secureworks Taegis ManagedXDR, SentinelOne Singularity Wayfinder, Sophos MDR, Unit 42 Managed Detection and ResponseOne alternative
BlumiraGrok 4.20Sophos MDRagainst: CrowdStrike Falcon CompleteRed CanaryChangedagainst: CrowdStrike Falcon Complete, Huntress Managed EDRCrowdStrike Falcon Completeagainst: Mandiant Managed DefenseHuntress Managed EDRagainst: Arctic Wolf Managed Detection and Response, CrowdStrikeno first choiceagainst: Accenture, Arctic Wolf Managed Detection and Response, Cyderes, IBM Security MDR, LevelBlue, Mandiant
Two alternatives
Arctic Wolf Managed Detection and Response, eSentire MDRTwo alternatives
Expel MDR, Sophos MDRFour alternatives
Arctic Wolf Managed Detection and Response, Huntress Managed EDR, Microsoft Defender MDR, SentinelOne Singularity MDRThree alternatives
Cynet 360, Sophos MDR, ThreatDown MDRMistral SmallArctic Wolf Managed Detection and Responseagainst: Cynet 360CrowdStrike, Expel MDRChangedno first choiceHuntress Managed EDRno first choicenothing named
Two alternatives
Huntress Managed EDR, Sophos MDRTwo alternatives
Blackpoint Cyber, ESET PROTECTTwo alternatives
Arctic Wolf Managed Detection and Response, Sophos MDRDeepSeek V4 FlashArctic Wolf Managed Detection and Response, Sophos MDRagainst: CrowdStrike Falcon CompleteArctic Wolf Managed Detection and ResponseChangedagainst: Rapid7 MDR, ReliaQuest GreyMatter, eSentire MDRCrowdStrikeHuntress Managed EDRagainst: CrowdStrike Falcon Complete, CrowdStrike Falcon Go, Expel MDR, Red Canaryno first choiceagainst: Arctic Wolf Managed Detection and Response, Cyderes, Mandiant MDR, Ontinue, Sophos MDR
Three alternatives
Expel MDR, Huntress Managed EDR, Red CanaryFive alternatives
CrowdStrike Falcon Complete, Expel MDR, Huntress Managed EDR, Red Canary, Sophos MDRNine alternatives
Arctic Wolf Managed Detection and Response, Huntress Managed EDR, Kroll, Mandiant, Microsoft Defender Experts for XDR, Proficio, ReliaQuest GreyMatter, Sophos MDR, eSentire MDRTwo alternatives
Cynet 360, Sophos MDRLlama 4 MaverickArctic Wolf Managed Detection and Responseno first choiceChangedCrowdStrikeHuntress Managed EDRno first choicenothing named
Three alternatives
Huntress Managed EDR, Sophos MDR, SubRosaTwo alternatives
Expel MDR, Huntress Managed EDRQwen 3.7 FlashArctic Wolf Managed Detection and ResponseHuntress Managed EDR, Red CanaryChangedCrowdStrikeHuntress Managed EDRagainst: Red Canaryno first choiceagainst: Lloyd's Register Quality Assurance, TÜV NORD Scandinavia
Four alternatives
BlueVoyant, Expel MDR, Huntress Managed EDR, eSentire MDRThree alternatives
CrowdStrike Falcon Complete, Microsoft Defender for Cloud, Secureworks Taegis ManagedXDRFive alternatives
Arctic Wolf Managed Detection and Response, Kroll, ReliaQuest GreyMatter, Sophos MDR, eSentire MDRTwo alternatives
Expel MDR, Sophos MDRKimi K2Arctic Wolf Managed Detection and ResponseArctic Wolf Managed Detection and Response, Sophos MDRChangedCrowdStrike Falcon CompleteHuntress MDRno first choiceagainst: Arctic Wolf Managed Detection and Response, Critical Insight, Cynet 360, Trellix
Four alternatives
ESET PROTECT MDR, Expel MDR, Rapid7 MDR, Sophos MDROne alternative
eSentire MDRSeven alternatives
Arctic Wolf Managed Detection and Response, Expel MDR, Rapid7 MDR, Secureworks Taegis ManagedXDR, SentinelOne Singularity MDR, Sophos MDR, eSentire MDRFour alternatives
Cynet 360, Field Effect MDR, Sophos MDR, ThreatDown MDRGLM 4.7 FlashXExpel MDR, Sophos MDRagainst: CrowdStrike Falcon CompleteCrowdStrike Falcon Complete, Sophos MDRChangedCrowdStrike Falcon CompleteHuntress Managed EDRno first choicenothing named
Two alternatives
Cynet 360, ESET PROTECT MDRThree alternatives
Arctic Wolf Managed Detection and Response, Expel MDR, SentinelOne Singularity WayfinderSeven alternatives
Arctic Wolf Managed Detection and Response, Cynet 360, Expel MDR, Huntress Managed EDR, Red Canary, SentinelOne Singularity MDR, Sophos MDRThree alternatives
SentinelOne Singularity Wayfinder, Sophos MDR, ThreatDown MDRMiniMax M2.5Arctic Wolf Managed Detection and Response, Huntress Managed EDRExpel MDRChangedCrowdStrike Falcon CompleteHuntress Managed EDRno first choicenothing named
One alternative
Sophos MDRThree alternatives
AT&T Cybersecurity, BlueVoyant, Critical StartFive alternatives
Arctic Wolf Managed Detection and Response, Huntress Managed EDR, SentinelOne Singularity Wayfinder, Sophos MDR, eSentire MDRThree alternatives
At-Bay MDR, Coalition MDR, Sophos MDRGPT-6 LunaExpel MDR, Sophos MDRArctic Wolf Managed Detection and ResponseChangedno first choiceHuntress Managed EDRno first choicenothing named
Two alternatives
Arctic Wolf Managed Detection and Response, CrowdStrike Falcon CompleteTwo alternatives
Expel MDR, Sophos MDROne alternative
Microsoft Defender Experts for XDRMuse Glimmer 30BArctic Wolf Managed Detection and ResponseArctic Wolf Managed Detection and ResponseHeldCrowdStrike, SentinelOne Singularity MDRHuntress Managed EDRno first choiceagainst: Ackcent Cybersecurity, AhnLab MDR, AirMDR, Arctic Wolf Managed Detection and Response, Cyderes
Five alternatives
CrowdStrike Falcon Complete, Expel MDR, Red Canary, Sophos MDR, eSentire MDRFour alternatives
ESET PROTECT MDR, Expel MDR, Huntress Managed EDR, Sophos MDRSeven alternatives
Arctic Wolf Managed Detection and Response, Expel MDR, Huntress Managed EDR, Microsoft Defender Experts for MDR, Red Canary, ReliaQuest GreyMatter, Sophos MDROne alternative
Sophos MDRBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:46 | yes | 17 | 10 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:25 | yes | 3 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:56 | yes | 9 | 26 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 10:01 | yes | 10 | 3 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:43 | yes | 14 | 16 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:11 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 13:07 | yes | 22 | 31 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 17:37 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:18 | yes | 5 | 29 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:24 | yes | 11 | 21 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 18:58 | yes | 12 | 36 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:17 | yes | 5 | 21 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:58 | yes | 2 | 14 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 11:59 | yes | 14 | 25 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:07 | yes | 10 | 7 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:23 | yes | 2 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 19:09 | yes | 5 | 24 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 12:20 | yes | 10 | 3 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:20 | yes | 5 | 43 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:59 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:04 | yes | 24 | 28 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 15:43 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:41 | no | 0 | 31 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 14:55 | yes | 13 | 30 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 11:05 | yes | 10 | 29 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:41 | yes | 5 | 23 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 12:50 | yes | 4 | 14 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 10:57 | yes | 13 | 19 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 12:14 | yes | 18 | 10 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:51 | yes | 3 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:25 | yes | 11 | 18 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 18:35 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:47 | yes | 5 | 13 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 19:02 | yes | 10 | 8 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 14:45 | yes | 24 | 43 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:11 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:12 | yes | 5 | 24 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 17:59 | yes | 15 | 53 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:39 | yes | 14 | 21 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:06 | yes | 15 | 73 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:53 | yes | 6 | 25 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:47 | yes | 15 | 27 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:59 | yes | 10 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:27 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:03 | yes | 8 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 13:15 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:17 | yes | 5 | 10 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 08:57 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:37 | yes | 17 | 20 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:32 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 15:49 | yes | 5 | 11 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:11 | yes | 18 | 27 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:55 | yes | 11 | 17 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:23 | yes | 10 | 25 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 17:54 | yes | 2 | 12 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:30 | yes | 13 | 21 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 14:36 | no | 0 | 7 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:36 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:50 | no | 0 | 16 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 17:45 | yes | 10 | 9 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:36 | yes | 14 | 16 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:46 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:45 | yes | 20 | 42 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:02 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:13 | no | 0 | 30 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:38 | yes | 10 | 20 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:34 | yes | 9 | 76 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:06 | no | 0 | 21 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 08:48 | yes | 4 | 19 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 10:47 | yes | 13 | 21 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:56 | yes | 18 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:33 | no | 0 | 4 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 08:56 | no | 0 | 14 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 09:40 | yes | 10 | 4 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:33 | yes | 5 | 14 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 18:46 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:30 | yes | 23 | 35 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:27 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:55 | yes | 15 | 52 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:04 | yes | 24 | 27 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:12 | yes | 15 | 27 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:03 | no | 0 | 24 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:54 | yes | 3 | 14 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:30 | yes | 12 | 28 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Arctic Wolf read as Arctic Wolf Managed Detection and Response
Blackpoint read as Blackpoint Cyber
Cynet read as Cynet 360
ESET read as ESET PROTECT MDR
Expel read as Expel MDR
Field Effect read as Field Effect MDR
Field Effect (Covalence) read as Field Effect MDR
Huntress read as Huntress Managed EDR
IBM read as IBM Security MDR
Microsoft read as Microsoft Defender Experts for XDR
Microsoft (Defender Experts for XDR) read as Microsoft Defender Experts for XDR
Palo Alto Networks read as Unit 42 Managed Detection and Response
Palo Alto Networks (Cortex MDR / Unit 42) read as Unit 42 Managed Detection and Response
Rapid7 read as Rapid7 MDR
ReliaQuest read as ReliaQuest GreyMatter
Secureworks read as Secureworks Taegis ManagedXDR
Secureworks (Taegis) read as Secureworks Taegis ManagedXDR
Secureworks Taegis read as Secureworks Taegis ManagedXDR
SentinelOne read as SentinelOne Singularity MDR
SentinelOne (Vigilance / SentinelOne MDR) read as SentinelOne Singularity MDR
SentinelOne Vigilance / Wayfinder MDR read as SentinelOne Singularity MDR
Sophos read as Sophos MDR
Sophos (Sophos MDR) read as Sophos MDR
ThreatDown read as ThreatDown MDR
ThreatDown (by Malwarebytes) read as ThreatDown MDR
eSentire read as eSentire MDR
Unresolved, counted raw
AhnLab MDR
At-Bay MDR
Bitdefender GravityZone MDR
Coalition MDR
Critical Insight
CrowdStrike MDR
Foresite
Kaseya K365
LevelBlue Managed Detection and Response
Lloyd's Register Quality Assurance (LRQA)
Mandiant MDR
Palo Alto Networks MDR
Palo Alto Networks' Cortex-based MDR offerings
Security Joes
TÜV NORD Scandinavia
Discontinued, still offered
No shut-down product was recommended here.