# Managed detection and response for enterprise buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "MDR service" and as "managed detection and response provider", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/managed-detection-and-response/2026-11/enterprise

**Standing:** CrowdStrike Falcon Complete leads with 33% of first choices; verdict contested. 46 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [CrowdStrike Falcon Complete](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-complete/index.md) | 33% | 8% | 38 |
| 2 | [Arctic Wolf Managed Detection and Response](https://www.gane.ai/index/it/vendors/arctic-wolf-managed-detection-and-response/index.md) | 20% | 7% | 45 |
| 3 | [CrowdStrike](https://www.gane.ai/index/it/vendors/crowdstrike/index.md) | 9% | 10% | 10 |
| 4 | [Sophos MDR](https://www.gane.ai/index/it/vendors/sophos-mdr/index.md) | 7% | 11% | 38 |
| 5 | [Expel MDR](https://www.gane.ai/index/it/vendors/expel-mdr/index.md) | 4% | 6% | 36 |
| 6 | [Rapid7 MDR](https://www.gane.ai/index/it/vendors/rapid7-mdr/index.md) | 4% | 5% | 22 |
| 7 | [Microsoft Defender Experts for XDR](https://www.gane.ai/index/it/vendors/microsoft-defender-experts-for-xdr/index.md) | 4% | 0% | 12 |
| 9 | [ReliaQuest GreyMatter](https://www.gane.ai/index/it/vendors/reliaquest-greymatter/index.md) | 2% | 0% | 16 |
| 10 | [Unit 42 Managed Detection and Response](https://www.gane.ai/index/it/vendors/unit-42-managed-detection-and-response/index.md) | 2% | 10% | 10 |
| 16 | [eSentire MDR](https://www.gane.ai/index/it/vendors/esentire-mdr/index.md) | 0% | 0% | 24 |
| 17 | [Red Canary](https://www.gane.ai/index/it/vendors/red-canary/index.md) | 0% | 0% | 21 |
| 18 | [SentinelOne Singularity MDR](https://www.gane.ai/index/it/vendors/sentinelone-singularity-mdr/index.md) | 0% | 6% | 18 |

Rank is by share of first choices among all 83 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Palo Alto Networks Cortex Cloud, SentinelOne Singularity Wayfinder, Sophos MDR
- GPT-5.4 mini: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, SentinelOne Singularity MDR, Sophos MDR
- Gemini 3.5 Flash: Expel MDR; alternatives CrowdStrike Falcon Complete, Red Canary, ReliaQuest GreyMatter, SentinelOne Vigilance Respond
- Perplexity Sonar: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Cortex MDR / Unit 42 MDR, Expel MDR, Google Mandiant Managed Defense
- Grok 4.20: CrowdStrike Falcon OverWatch; alternatives Arctic Wolf Managed Detection and Response, Microsoft Defender Experts for XDR, eSentire MDR
- Mistral Small: Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete; alternatives ESET PROTECT MDR, Expel MDR
- DeepSeek V4 Flash: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, IBM Security Managed Detection and Response
- Llama 4 Maverick: CrowdStrike Falcon Complete; alternatives Arctic Wolf Managed Detection and Response, Expel MDR, Red Canary, Sophos MDR
- Qwen 3.7 Flash: CrowdStrike; alternatives Arctic Wolf Managed Detection and Response, Expel MDR, IBM Security MDR, Kroll
- Kimi K2: Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete; alternatives Expel MDR, eSentire MDR
- GLM 4.7 FlashX: Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete, Rapid7 MDR; alternatives Microsoft Sentinel, SentinelOne Singularity Wayfinder
- MiniMax M2.5: no first choice; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike, ReliaQuest GreyMatter, Sophos MDR
- GPT-6 Luna: Expel MDR; alternatives CrowdStrike Falcon Complete, Microsoft Defender Experts for XDR
- Muse Glimmer 30B: Arctic Wolf Managed Detection and Response, CrowdStrike; alternatives Expel MDR, Red Canary, ReliaQuest GreyMatter, Sophos MDR

## Sources the answers cite

75 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- mdrproviders.io: 48 answers, 76 citations
- expel.com: 24 answers, 39 citations
- rapid7.com: 22 answers, 25 citations
- crowdstrike.com: 17 answers, 32 citations
- cynet.com: 16 answers, 18 citations
- cybersecuritynews.com: 16 answers, 16 citations
- ciopages.com: 15 answers, 15 citations
- sophos.com: 14 answers, 24 citations

Pages named in the most answers:

- https://mdrproviders.io/providers/size/enterprise (41 answers)
- https://cybersecuritynews.com/best-mdr-services (16 answers)
- https://rapid7.com/fundamentals/top-mdr-providers (15 answers)
- https://ciopages.com/buyer-guides/managed-detection-response (14 answers)
- https://eset.com/fileadmin/ESET/INT/Pages/KuppingerCole/ESET_Leadership_Compass_MDR.pdf (12 answers)
- https://expel.com/cyberspeak/what-should-i-look-for-choosing-mdr-provider (12 answers)
- https://verifiedmarketresearch.com/blog/top-managed-detection-response-services (11 answers)
- https://tatacommunications.com/hubfs/47271964/TaCO-2024/analyst-recognitions/doc/LeadershipCompassManagedDetectionandResponseMDR.pdf (10 answers)
- https://accenture.com/content/dam/accenture/final/accenture-com/document-fy26/q4/IDC-MarketScape-WW-MDR-MXDR-For-Enterprise-2026.pdf (9 answers)
- https://expertinsights.com/endpoint-security/the-top-managed-detection-and-response-mdr-solutions (9 answers)

## Warned against

- Huntress Managed EDR: 6 of 12 labels negative. "What to Avoid for Predictability - Huntress or Sophos MDR" (Muse Glimmer 30B, negative prompt)
- Sophos MDR: 4 of 38 labels negative. "What to Avoid for Predictability - Huntress or Sophos MDR" (Muse Glimmer 30B, negative prompt)
- Arctic Wolf Managed Detection and Response: 3 of 45 labels negative. "their pricing is typically quote-based and may not offer the same level of predictability or transparency" (Mistral Small, budget prompt)
- CrowdStrike Falcon Complete: 3 of 38 labels negative. "mentioned as potentially having issues include Sophos MDR, CrowdStrike Falcon Complete, and Huntress Managed EDR" (Llama 4 Maverick, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: CrowdStrike Falcon Complete at 33%.

- Sophos MDR: 2% to 7%, +5. Inside the floor by 6 points · rank 9 → 4 of 83.
- Expel MDR: 9% to 4%, −5. Inside the floor by 6 points · rank 3 → 5 of 83.
- Unit 42 Managed Detection and Response: 5% to 2%, −3. Inside the floor by 8 points · rank 6 → 10 of 83.
- CrowdStrike Falcon Complete: 35% to 33%, −2. Inside the floor by 9 points · rank 1 of 83, unchanged.
- Arctic Wolf Managed Detection and Response: 18% to 20%, +2. Inside the floor by 9 points · rank 2 of 83, unchanged.
- CrowdStrike: 7% to 9%, +2. Inside the floor by 9 points · rank 4 → 3 of 83.
- Microsoft Defender Experts for XDR: 2% to 4%, +2. Inside the floor by 9 points · rank 11 → 7 of 83.
- eSentire MDR: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 16 of 83.
- Red Canary: 2% to 0%, −2. Inside the floor by 9 points · rank 10 → 17 of 83.
- Rapid7 MDR: 5% to 4%, −1. Inside the floor by 10 points · rank 5 → 6 of 83.
- ReliaQuest GreyMatter: 2% to 2%, ±0. Inside the floor by 11 points · rank 12 → 9 of 83.
- SentinelOne Singularity MDR: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 18 of 83.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.