# Managed detection and response: what AI models recommend, September 2026 Gane Index, September 2026 Edition. Asked as "MDR service" and as "managed detection and response provider", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/managed-detection-and-response/2026-09 This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/managed-detection-and-response/index.md **Standing:** Arctic Wolf Managed Detection and Response leads with 39% of first choices; verdict contested. 46 first choices across the direct, paraphrase, budget and scale prompts. ## First-choice share | Rank | Product | Share | Negative rate | Labels | |---|---|---|---|---| | 1 | [Arctic Wolf Managed Detection and Response](https://www.gane.ai/index/it/vendors/arctic-wolf-managed-detection-and-response/index.md) | 39% | 14% | 43 | | 2 | [Huntress Managed EDR](https://www.gane.ai/index/it/vendors/huntress-managed-edr/index.md) | 26% | 0% | 38 | | 3 | [Sophos MDR](https://www.gane.ai/index/it/vendors/sophos-mdr/index.md) | 11% | 0% | 43 | | 4 | [eSentire MDR](https://www.gane.ai/index/it/vendors/esentire-mdr/index.md) | 11% | 0% | 20 | | 5 | [Expel MDR](https://www.gane.ai/index/it/vendors/expel-mdr/index.md) | 4% | 4% | 24 | | 6 | [CrowdStrike Falcon Complete](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-complete/index.md) | 2% | 12% | 26 | | 7 | [SentinelOne Singularity MDR](https://www.gane.ai/index/it/vendors/sentinelone-singularity-mdr/index.md) | 2% | 0% | 18 | | 10 | [Red Canary](https://www.gane.ai/index/it/vendors/red-canary/index.md) | 0% | 5% | 21 | | 11 | [Rapid7 MDR](https://www.gane.ai/index/it/vendors/rapid7-mdr/index.md) | 0% | 0% | 17 | | 12 | [Ontinue](https://www.gane.ai/index/it/vendors/ontinue/index.md) | 0% | 0% | 13 | Rank is by share of first choices among all 42 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels. ## Each model's first choice on the direct prompt - Claude Haiku 4.5: Arctic Wolf Managed Detection and Response; alternatives ESET PROTECT MDR, Sophos MDR - GPT-5.4 mini: eSentire MDR; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Sophos MDR - Gemini 3.5 Flash: Sophos MDR; alternatives Arctic Wolf Managed Detection and Response, Huntress Managed EDR, Red Canary - Perplexity Sonar: Arctic Wolf Managed Detection and Response; alternatives Huntress Managed EDR, Ontinue, SentinelOne Singularity MDR, Sophos MDR - Grok 4.20: Arctic Wolf Managed Detection and Response; alternatives Sophos MDR, eSentire MDR - Mistral Small: Arctic Wolf Managed Detection and Response, eSentire MDR - DeepSeek V4 Flash: Arctic Wolf Managed Detection and Response, Expel MDR; alternatives CrowdStrike Falcon Complete, Huntress Managed EDR, Red Canary, Sophos MDR - Llama 4 Maverick: Arctic Wolf Managed Detection and Response; alternatives Field Effect MDR, Huntress Managed EDR, Ontinue, Rapid7 MDR - Qwen 3.7 Flash: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Microsoft Defender for Cloud Apps, SentinelOne Singularity MDR, Sophos MDR - Kimi K2: Arctic Wolf Managed Detection and Response; alternatives Rapid7 MDR, Sophos MDR, eSentire MDR - GLM 4.7 FlashX: Arctic Wolf Managed Detection and Response, eSentire MDR; alternatives CrowdStrike Falcon Complete, Expel MDR, Microsoft Defender Experts for XDR, Red Canary - MiniMax M2.5: Arctic Wolf Managed Detection and Response; alternatives CrowdStrike Falcon Complete, eSentire MDR ## Sources the answers cite 64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers: - gbhackers.com: 38 answers, 41 citations - cybersecuritynews.com: 28 answers, 33 citations - learn.g2.com: 28 answers, 28 citations - consilien.com: 21 answers, 22 citations - gartner.com: 20 answers, 30 citations - cyberpress.org: 20 answers, 20 citations - huntress.com: 16 answers, 20 citations - mdrproviders.io: 16 answers, 20 citations Pages named in the most answers: - https://gbhackers.com/best-mdr-services-compared (38 answers) - https://learn.g2.com/top-mdr-providers (28 answers) - https://consilien.com/news/best-mdr-providers-smb-2026 (20 answers) - https://cyberpress.org/mdr-services-to-consider (19 answers) - https://cybersecuritynews.com/best-mdr-services (16 answers) - https://cybersecuritynews.com/best-mdr-services/amp (16 answers) - https://huntress.com/cybersecurity-insights/managed-detection-response-vendors (15 answers) - https://gartner.com/reviews/market/managed-detection-and-response (14 answers) - https://checkthat.ai/answers/what-are-the-best-managed-detection-and-response-solutions (13 answers) - https://defendify.com/blog/managed-detection-and-response-providers (12 answers) ## Warned against - Arctic Wolf Managed Detection and Response: 6 of 43 labels negative. "Avoid enterprise-tier providers (Arctic Wolf, CrowdStrike Falcon Complete, Expel, Red Canary) on a tight budget" (DeepSeek V4 Flash, budget prompt) - CrowdStrike Falcon Complete: 3 of 26 labels negative. "Avoid enterprise-tier providers (Arctic Wolf, CrowdStrike Falcon Complete, Expel, Red Canary)" (DeepSeek V4 Flash, budget prompt) - Expel MDR: 1 of 24 labels negative. "Avoid enterprise-tier providers (Arctic Wolf, CrowdStrike Falcon Complete, Expel, Red Canary)" (DeepSeek V4 Flash, budget prompt) - Red Canary: 1 of 21 labels negative. "Avoid enterprise-tier providers (Arctic Wolf, CrowdStrike Falcon Complete, Expel, Red Canary)" (DeepSeek V4 Flash, budget prompt) ## Record - Method: https://www.gane.ai/index/it/methodology - License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.