# Managed detection and response for enterprise buyers: what AI models recommend, September 2026 Gane Index, September 2026 Edition. Asked as "MDR service" and as "managed detection and response provider", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/managed-detection-and-response/2026-09/enterprise This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/managed-detection-and-response/enterprise/index.md **Standing:** CrowdStrike Falcon Complete leads with 37% of first choices; verdict contested. 41 first choices across the direct, paraphrase, budget and scale prompts. ## First-choice share | Rank | Product | Share | Negative rate | Labels | |---|---|---|---|---| | 1 | [CrowdStrike Falcon Complete](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-complete/index.md) | 37% | 0% | 39 | | 2 | [Arctic Wolf Managed Detection and Response](https://www.gane.ai/index/it/vendors/arctic-wolf-managed-detection-and-response/index.md) | 20% | 3% | 39 | | 3 | [Expel MDR](https://www.gane.ai/index/it/vendors/expel-mdr/index.md) | 10% | 4% | 23 | | 5 | [Red Canary](https://www.gane.ai/index/it/vendors/red-canary/index.md) | 7% | 5% | 20 | | 6 | [Sophos MDR](https://www.gane.ai/index/it/vendors/sophos-mdr/index.md) | 2% | 0% | 20 | | 7 | [Microsoft Defender Experts for XDR](https://www.gane.ai/index/it/vendors/microsoft-defender-experts-for-xdr/index.md) | 2% | 9% | 11 | | 9 | [Huntress Managed EDR](https://www.gane.ai/index/it/vendors/huntress-managed-edr/index.md) | 2% | 20% | 10 | | 13 | [Unit 42 Managed Detection and Response](https://www.gane.ai/index/it/vendors/unit-42-managed-detection-and-response/index.md) | 0% | 0% | 20 | | 14 | [Rapid7 MDR](https://www.gane.ai/index/it/vendors/rapid7-mdr/index.md) | 0% | 0% | 17 | | 15 | [SentinelOne Singularity MDR](https://www.gane.ai/index/it/vendors/sentinelone-singularity-mdr/index.md) | 0% | 6% | 16 | | 16 | [SentinelOne Singularity Wayfinder](https://www.gane.ai/index/it/vendors/sentinelone-singularity-wayfinder/index.md) | 0% | 0% | 10 | | 17 | [eSentire MDR](https://www.gane.ai/index/it/vendors/esentire-mdr/index.md) | 0% | 0% | 10 | Rank is by share of first choices among all 39 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels. ## Each model's first choice on the direct prompt - Claude Haiku 4.5: no first choice; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike, Red Canary, SentinelOne Singularity MDR - GPT-5.4 mini: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Expel MDR, Rapid7 MDR, SentinelOne Singularity MDR - Gemini 3.5 Flash: Expel MDR, Red Canary; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Microsoft Defender Experts for XDR, Rapid7 MDR - Perplexity Sonar: CrowdStrike Falcon Complete; alternatives Rapid7 MDR, SentinelOne Singularity Wayfinder, eSentire MDR - Grok 4.20: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Expel MDR, Sophos MDR, Unit 42 Managed Detection and Response - Mistral Small: Sophos MDR; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Expel MDR, Unit 42 Managed Detection and Response - DeepSeek V4 Flash: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, SentinelOne Singularity MDR, Sophos MDR, Unit 42 Managed Detection and Response - Llama 4 Maverick: no first choice - Qwen 3.7 Flash: CrowdStrike; alternatives Exabeam, Mandiant, NetScout, SentinelOne Singularity MDR - Kimi K2: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Mandiant, Rapid7 MDR, SentinelOne Singularity Wayfinder - GLM 4.7 FlashX: Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete; alternatives Expel MDR - MiniMax M2.5: CrowdStrike, Microsoft Defender for Cloud ## Sources the answers cite 64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers: - corporatevision-news.com: 31 answers, 31 citations - huntress.com: 30 answers, 32 citations - defendify.com: 29 answers, 30 citations - acquisition-international.com: 26 answers, 26 citations - rapid7.com: 25 answers, 29 citations - paloaltonetworks.com: 24 answers, 28 citations - learn.g2.com: 23 answers, 23 citations - mdrproviders.io: 22 answers, 30 citations Pages named in the most answers: - https://corporatevision-news.com/best-managed-detection-and-response-services-for-enterprises-in-2026 (31 answers) - https://huntress.com/cybersecurity-insights/managed-detection-response-vendors (30 answers) - https://defendify.com/blog/managed-detection-and-response-providers (29 answers) - https://acquisition-international.com/the-best-mdr-services-for-enterprise-security-teams-in-2026 (26 answers) - https://learn.g2.com/top-mdr-providers (23 answers) - https://paloaltonetworks.com/cyberpedia/mdr-solutions (22 answers) - https://rapid7.com/fundamentals/top-mdr-providers (21 answers) - https://gbhackers.com/best-mdr-services-compared (21 answers) - https://checkthat.ai/answers/what-are-the-best-managed-detection-and-response-solutions (17 answers) - https://gartner.com/reviews/market/managed-detection-and-response (15 answers) ## Warned against - Huntress Managed EDR: 2 of 10 labels negative. "such as Huntress or Blackpoint Cyber... makes them a poor fit for a large enterprise" (Gemini 3.5 Flash, negative prompt) - Blackpoint Cyber: 1 of 1 labels negative. "such as Huntress or Blackpoint Cyber... makes them a poor fit for a large enterprise" (Gemini 3.5 Flash, negative prompt) - Arctic Wolf Managed Detection and Response: 1 of 39 labels negative. "the total bill scales linearly with headcount – less attractive if you have a massive user base" (DeepSeek V4 Flash, budget prompt) - CrowdStrike: 1 of 9 labels negative. "such as Microsoft, CrowdStrike, or SentinelOne) that solely manage and monitor their own security stack" (Gemini 3.5 Flash, negative prompt) ## Record - Method: https://www.gane.ai/index/it/methodology - License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.