12 categories · RankedWazuh
Wazuh is an open source security platform that combines XDR and SIEM protection for endpoints and cloud workloads · wazuh.com ↗
Strongest at small business. Thin evidence at enterprise: seven labels.
The standing depends on who is buying. Every model is asked the same questions for each company size.
Blumira is first at 25%.
Microsoft Sentinel is first at 48%.
Microsoft Sentinel is first at 47%.
Why models recommend it
“Start with Wazuh if you have the technical capability — it provides enterprise-grade security monitoring at zero software cost.”Kimi K2 · Budget-constrained question · first choice
“Best Free/Open-Source Option: Wazuh or Elastic Security ... Completely free software; you only pay for servers.”Qwen 3.7 Flash · Budget-constrained question · first choice
“Wazuh (Top Overall Open-Source Pick) ... Best feature-rich, free open-source SIEM/XDR on the market.”Gemini 3.5 Flash · Budget-constrained question · first choice
“For small teams, Wazuh is a strong low-cost option because it's free/open-source”GPT-5.4 mini · Budget-constrained question · first choice
What gives them pause
“Avoid if you do not have dedicated staff to maintain the platform infrastructure.”Gemini 3.5 Flash · Negative question · warning
“Open-source or DIY options such as Wazuh/OpenEDR for organizations without security engineering capacity: These can work well, but deployment, tuning, integrations, and response remain your responsibility.”Perplexity Sonar · Negative question · warning
“Wazuh when no one can operate Linux and detection content. ... its technical and administrative investment is comparatively high.”Perplexity Sonar · Negative question · warning
“Lowest licensing cost—often free/open source—but requires substantially more technical effort, maintenance, and monitoring”Perplexity Sonar · Budget-constrained question · warning
Also on the shortlist
The products named in the same answers as Wazuh, over the 147 answers that named it, and how often each was the first choice instead.
| Product | Named together | Picked instead | |
|---|---|---|---|
| 82 | 17 | Compare → | |
| 56 | 1 | Compare → | |
| 53 | 2 | View → | |
| 42 | 16 | View → | |
| 35 | 15 | View → | |
| 31 | 0 | View → | |
| 30 | 9 | Compare → | |
| 22 | 0 | View → | |
| 20 | 2 | Compare → | |
| 20 | 0 | Compare → |
What the models named instead of Wazuh →
A side-by-side page exists where both products are among a category's top eight.
At a glance
Stated on Wazuh's own site, not checked by Gane.
- For
- security analysts and enterprise users
- Price stated
- Free and open source; no license cost; Free Cloud Trial
- Starting price
- 0
- Free plan or trial
- Free Cloud Trial
- Customers named
- Guayoyo, Enevo, ITA, University of Chichester, Groupon, Woop, Alignet, FirmGuardian
How this is measured
Fourteen AI models from 12 labs are asked the same buying questions six ways, for three company sizes. Standings refresh every edition.
Gane sells AI visibility software. No company can pay to change a result.
Read the method →Sources returned with these answers
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted. These counts come from 118 of the 147 answers that named Wazuh and are not a share of its labels.
Domains cited
325 of the 325 domain citations in answers naming Wazuh came from a third party's page.
Pages cited
Pages are listed as the models cited them.
By model
| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 1 | 0 | 1 |
| GPT-5.4 mini | 2 | 0 | 0 | 0 | 2 |
| Gemini 3.5 Flash | 2 | 5 | 0 | 1 | 8 |
| Perplexity Sonar | 0 | 2 | 0 | 4 | 6 |
| Grok 4.20 | 0 | 2 | 1 | 1 | 4 |
| Mistral Small | 0 | 2 | 1 | 0 | 3 |
| DeepSeek V4 Flash | 1 | 1 | 1 | 0 | 3 |
| Llama 4 Maverick | 0 | 2 | 0 | 0 | 2 |
| Qwen 3.7 Flash | 2 | 4 | 0 | 3 | 9 |
| Kimi K2 | 1 | 2 | 0 | 0 | 3 |
| GLM 4.7 FlashX | 1 | 3 | 0 | 0 | 4 |
| MiniMax M2.5 | 1 | 1 | 0 | 1 | 3 |
| GPT-6 Luna | 1 | 0 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 3 | 2 | 0 | 5 |
What it publishes
| Kind | Pages | Last 90 days | 2025-10 to 2026-09 | Latest | Categories named |
|---|---|---|---|---|---|
| Blog | 404 | 17 | 2026-09-28 | XDR, CSPM | |
| Glossary or explainer | 19 | undated | XDR, SIEM | ||
| Case study | 15 | 1 | 2026-09-15 | ||
| Conference or event | 4 | undated | |||
| News or press | 3 | undated | |||
| Report or ebook | 1 | undated |
Most recent
- 2026-09-28Wazuh and ai cyber consulting announce partnership to strengthen soc services blog
- 2026-09-24Detecting common windows privilege escalation techniques with wazuh blog
- 2026-09-17Securing web applications with coraza waf and wazuh blog
- 2026-09-15Isecng delivers flexible open source security services with wazuh case study
- 2026-09-10Detecting windows attacks with microsoft defender asr and wazuh blog
- 2026-09-04Wazuh and e defence announce partnership to improve soc services blog
How it is countedHide how it is counted
Every page wazuh.com exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.