# Managed detection and response: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "MDR service" and as "managed detection and response provider", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/managed-detection-and-response/2026-11

**Standing:** Arctic Wolf Managed Detection and Response leads with 31% of first choices; verdict contested. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Arctic Wolf Managed Detection and Response](https://www.gane.ai/index/it/vendors/arctic-wolf-managed-detection-and-response/index.md) | 31% | 12% | 48 |
| 2 | [Huntress Managed EDR](https://www.gane.ai/index/it/vendors/huntress-managed-edr/index.md) | 27% | 8% | 39 |
| 3 | [Sophos MDR](https://www.gane.ai/index/it/vendors/sophos-mdr/index.md) | 12% | 7% | 54 |
| 4 | [Expel MDR](https://www.gane.ai/index/it/vendors/expel-mdr/index.md) | 12% | 3% | 35 |
| 5 | [CrowdStrike Falcon Complete](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-complete/index.md) | 6% | 22% | 27 |
| 6 | [Red Canary](https://www.gane.ai/index/it/vendors/red-canary/index.md) | 4% | 11% | 18 |
| 8 | [Rapid7 MDR](https://www.gane.ai/index/it/vendors/rapid7-mdr/index.md) | 2% | 5% | 21 |
| 9 | [CrowdStrike](https://www.gane.ai/index/it/vendors/crowdstrike/index.md) | 2% | 18% | 11 |
| 10 | [eSentire MDR](https://www.gane.ai/index/it/vendors/esentire-mdr/index.md) | 0% | 7% | 15 |
| 11 | [SentinelOne Singularity MDR](https://www.gane.ai/index/it/vendors/sentinelone-singularity-mdr/index.md) | 0% | 8% | 12 |
| 14 | [Cynet 360](https://www.gane.ai/index/it/vendors/cynet-360/index.md) | 0% | 20% | 15 |

Rank is by share of first choices among all 78 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Arctic Wolf Managed Detection and Response; alternatives Rapid7 MDR, Sophos MDR, eSentire MDR
- GPT-5.4 mini: Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete; alternatives Microsoft Defender Experts for XDR, Rapid7 MDR, Sophos MDR
- Gemini 3.5 Flash: Arctic Wolf Managed Detection and Response, Expel MDR; alternatives CrowdStrike Falcon Complete, Huntress Managed EDR, Red Canary, Sophos MDR
- Perplexity Sonar: Arctic Wolf Managed Detection and Response; alternatives CrowdStrike, Expel MDR, Red Canary, SentinelOne Singularity MDR
- Grok 4.20: Sophos MDR; alternatives Arctic Wolf Managed Detection and Response, eSentire MDR
- Mistral Small: Arctic Wolf Managed Detection and Response; alternatives Huntress Managed EDR, Sophos MDR
- DeepSeek V4 Flash: Arctic Wolf Managed Detection and Response, Sophos MDR; alternatives Expel MDR, Huntress Managed EDR, Red Canary
- Llama 4 Maverick: Arctic Wolf Managed Detection and Response; alternatives Huntress Managed EDR, Sophos MDR, SubRosa
- Qwen 3.7 Flash: Arctic Wolf Managed Detection and Response; alternatives BlueVoyant, Expel MDR, Huntress Managed EDR, eSentire MDR
- Kimi K2: Arctic Wolf Managed Detection and Response; alternatives ESET PROTECT MDR, Expel MDR, Rapid7 MDR, Sophos MDR
- GLM 4.7 FlashX: Expel MDR, Sophos MDR; alternatives Cynet 360, ESET PROTECT MDR
- MiniMax M2.5: Arctic Wolf Managed Detection and Response, Huntress Managed EDR; alternatives Sophos MDR
- GPT-6 Luna: Expel MDR, Sophos MDR; alternatives Arctic Wolf Managed Detection and Response, CrowdStrike Falcon Complete
- Muse Glimmer 30B: Arctic Wolf Managed Detection and Response; alternatives CrowdStrike Falcon Complete, Expel MDR, Red Canary, Sophos MDR

## Sources the answers cite

74 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- mdrproviders.io: 38 answers, 56 citations
- expel.com: 19 answers, 26 citations
- cybersecuritynews.com: 19 answers, 19 citations
- cynet.com: 16 answers, 23 citations
- rapid7.com: 16 answers, 16 citations
- verifiedmarketresearch.com: 15 answers, 15 citations
- cyberdb.co: 13 answers, 14 citations
- expertinsights.com: 13 answers, 13 citations

Pages named in the most answers:

- https://cybersecuritynews.com/best-mdr-services (19 answers)
- https://mdrproviders.io/providers/size/mid-market (19 answers)
- https://verifiedmarketresearch.com/blog/top-managed-detection-response-services (15 answers)
- https://cyberdb.co/best-mdr-providers-in-2026-top-services-ranked (13 answers)
- https://expel.com/cyberspeak/what-should-i-look-for-choosing-mdr-provider (12 answers)
- https://expertinsights.com/endpoint-security/the-top-managed-detection-and-response-mdr-solutions (12 answers)
- https://gbhackers.com/best-mdr-services-compared (12 answers)
- https://channelinsider.com/security/tools-and-platforms/mdr-services (10 answers)
- https://defendify.com/blog/managed-detection-and-response-providers (10 answers)
- https://mdrcost.com/small-business (10 answers)

## Warned against

- Arctic Wolf Managed Detection and Response: 6 of 48 labels negative. "Arctic Wolf (transparency issues)" (Kimi K2, negative prompt)
- CrowdStrike Falcon Complete: 6 of 27 labels negative. "Avoid "enterprise-tier" providers on a budget: CrowdStrike Falcon Complete" (DeepSeek V4 Flash, budget prompt)
- Sophos MDR: 4 of 54 labels negative. "multiple sources note it can be expensive for smaller organizations, so it's usually better if you can stretch the budget a bit" (GPT-5.4 mini, budget prompt)
- Cynet 360: 3 of 15 labels negative. "Described as having "joke" MDR service with monthly reviews that are just alert summaries" (Kimi K2, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Arctic Wolf Managed Detection and Response at 31%.

- Huntress Managed EDR: 35% to 27%, −8. Inside the floor by 3 points · rank 2 of 78, unchanged.
- Expel MDR: 4% to 12%, +8. Inside the floor by 3 points · rank 4 of 78, unchanged.
- Arctic Wolf Managed Detection and Response: 37% to 31%, −6. Inside the floor by 5 points · rank 1 of 78, unchanged.
- CrowdStrike Falcon Complete: 2% to 6%, +4. Inside the floor by 7 points · rank 5 of 78, unchanged.
- Red Canary: 0% to 4%, +4. Inside the floor by 7 points · rank 13 → 6 of 78.
- Rapid7 MDR: 0% to 2%, +2. Inside the floor by 9 points · rank 11 → 8 of 78.
- CrowdStrike: 0% to 2%, +2. Inside the floor by 9 points · rank 17 → 9 of 78.
- Sophos MDR: 13% to 12%, −1. Inside the floor by 10 points · rank 3 of 78, unchanged.
- eSentire MDR: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 of 78, unchanged.
- SentinelOne Singularity MDR: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 11 of 78.
- Cynet 360: 0% to 0%, ±0. Inside the floor by 11 points · rank 16 → 14 of 78.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.