3 categories · RankedSecurity Onion
Security Onion is an open-source platform that bundles SIEM, network security monitoring, and threat hunting · securityonion.net ↗
Read the same way at every company size.
The standing depends on who is buying. Every model is asked the same questions for each company size.
Sophos NDR is first at 16%.
Vectra AI Platform is first at 24%. 0 of 14 models made it the first choice when asked directly.
No model named it for this buyer.
Why models recommend it
“For most companies with a limited budget, Security Onion offers the best capability-to-cost ratio”DeepSeek V4 Flash · Budget-constrained question · first choice
“If you have IT staff → Start with Wazuh or Security Onion (free, powerful).”MiniMax M2.5 · Budget-constrained question · first choice
“If you have the internal skill to manage Linux servers: Deploy Security Onion.”Gemini 3.5 Flash · Budget-constrained question · first choice
“Security Onion (Best for Network Telemetry) ... Free, open-source Linux distribution focused on Network Security Monitoring”Gemini 3.5 Flash · Budget-constrained question · alternative
What gives them pause
“cost-effective for teams with strong internal security engineering... However, this requires more technical expertise to manage.”Claude Haiku 4.5 · Budget-constrained question · warning
Also on the shortlist
The products named in the same answers as Security Onion, over the 44 answers that named it, and how often each was the first choice instead.
| Product | Named together | Picked instead | |
|---|---|---|---|
| 19 | 1 | View → | |
| 17 | 1 | View → | |
| 15 | 6 | View → | |
| 13 | 3 | View → | |
| 11 | 4 | View → | |
| 11 | 0 | View → | |
| 11 | 0 | View → | |
| 10 | 1 | View → | |
| 10 | 0 | View → | |
| 9 | 0 | View → |
A side-by-side page exists where both products are among a category's top eight.
At a glance
Stated on Security Onion's own site, not checked by Gane.
- Price stated
- free
How this is measured
Fourteen AI models from 12 labs are asked the same buying questions six ways, for three company sizes. Standings refresh every edition.
Gane sells AI visibility software. No company can pay to change a result.
Read the method →Sources returned with these answers
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted. These counts come from 41 of the 44 answers that named Security Onion and are not a share of its labels.
Domains cited
110 of the 125 domain citations in answers naming Security Onion came from a third party's page. Fifteen were to the publisher's own pages (the Gane Index), which the models cite like any other source; they are not counted as a third party.
Pages cited
Pages are listed as the models cited them.
By model
| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 1 | 1 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 1 | 1 | 0 | 0 | 2 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.20 | 0 | 1 | 0 | 0 | 1 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 1 | 1 | 0 | 0 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 1 | 0 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 1 | 0 | 0 | 0 | 1 |
| GPT-6 Luna | 0 | 1 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 2 | 1 | 0 | 3 |
What it publishes
| Kind | Pages | Last 90 days | 2025-11 to 2026-10 | Latest | Categories named |
|---|---|---|---|---|---|
| Blog | 1,585 | 7 | 2026-09-11 | Logs | |
| Conference or event | 41 | 0 | 2026-05-18 | ||
| Case study | 2 | 0 | 2012-01-01 | ||
| Webinar or virtual event | 1 | 0 | 2020-05-01 | ||
| Report or ebook | 1 | undated |
Most recent
- 2026-09-11Security onion 330 hotfix 20260911 now blog
- 2026-09-08Security onion 330 now available blog
- 2026-09-0109 blog
- 2026-08-06Registration now open for augusta cyber blog
- 2026-08-06Security onion documentation printed blog
- 2026-08-0108 blog
Events in person
- October 19, 2026 to October 22, 2026Security Onion 4-day trainingAugusta, US · hosts
- October 23, 2026Security Onion ConferenceAugusta, US · hosts
- October 24, 2026BSidesAugustaAugusta, US
- October 25, 2025BSidesAugustaplace not stated
- October 24, 2025Security Onion ConferenceAugusta · hosted
- October 20, 2025 to October 23, 2025Security Onion 4-day training in AugustaAugusta · hosted
As the event pages on securityonion.net state them, read October 5, 2026.
How it is countedHide how it is counted
Every page securityonion.net exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read October 5, 2026.