# Wazuh: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 54 judge labels across 12 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/wazuh

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [SIEM platforms](https://www.gane.ai/index/it/security/siem-platforms/index.md) | 15% | 2 | 12% | 24 |
| [Deception technology](https://www.gane.ai/index/it/security/deception-technology/index.md) | 2% | 18 | 0% | 1 |
| [AI security platforms](https://www.gane.ai/index/it/security/ai-security-platforms/index.md) | 2% | 29 | 33% | 3 |
| [Vulnerability management platforms](https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md) | 2% | 13 | 0% | 1 |
| [Extended detection and response](https://www.gane.ai/index/it/security/extended-detection-and-response/index.md) | 0% | 25 | 33% | 6 |
| [AI SOC agents](https://www.gane.ai/index/it/security/ai-soc-agents/index.md) | 0% | 24 | 0% | 5 |
| [Endpoint detection and response](https://www.gane.ai/index/it/security/endpoint-detection-and-response/index.md) | 0% | 62 | 40% | 5 |
| [Insider risk management](https://www.gane.ai/index/it/security/insider-risk-management/index.md) | 0% | 21 | 0% | 4 |
| [Identity threat detection and response](https://www.gane.ai/index/it/identity/identity-threat-detection-and-response/index.md) | 0% | 38 | 0% | 2 |
| [Client-side protection](https://www.gane.ai/index/it/security/client-side-protection/index.md) | 0% | 107 | 100% | 1 |
| [Endpoint protection](https://www.gane.ai/index/it/operations/endpoint-protection/index.md) | 0% | 38 | 0% | 1 |
| [SOAR platforms](https://www.gane.ai/index/it/security/soar-platforms/index.md) | 0% | 73 | 100% | 1 |

## What the models said for it

- "Start with Wazuh if you have the technical capability — it provides enterprise-grade security monitoring at zero software cost." (Kimi K2, SIEM)
- "Best Free/Open-Source Option: Wazuh or Elastic Security ... Completely free software; you only pay for servers." (Qwen 3.7 Flash, SIEM)
- "Wazuh (Top Overall Open-Source Pick) ... Best feature-rich, free open-source SIEM/XDR on the market." (Gemini 3.5 Flash, SIEM)
- "For small teams, Wazuh is a strong low-cost option because it's free/open-source" (GPT-5.4 mini, AI security)

## And against it

- "Avoid if you do not have dedicated staff to maintain the platform infrastructure." (Gemini 3.5 Flash, SIEM)
- "Open-source or DIY options such as Wazuh/OpenEDR for organizations without security engineering capacity: These can work well, but deployment, tuning, integrations, and response remain your responsibility." (Perplexity Sonar, EDR)
- "Wazuh when no one can operate Linux and detection content. ... its technical and administrative investment is comparatively high." (Perplexity Sonar, SIEM)
- "Lowest licensing cost—often free/open source—but requires substantially more technical effort, maintenance, and monitoring" (Perplexity Sonar, XDR)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 1 | 0 | 1 |
| GPT-5.4 mini | 2 | 0 | 0 | 0 | 2 |
| Gemini 3.5 Flash | 2 | 5 | 0 | 1 | 8 |
| Perplexity Sonar | 0 | 2 | 0 | 4 | 6 |
| Grok 4.20 | 0 | 2 | 1 | 1 | 4 |
| Mistral Small | 0 | 2 | 1 | 0 | 3 |
| DeepSeek V4 Flash | 1 | 1 | 1 | 0 | 3 |
| Llama 4 Maverick | 0 | 2 | 0 | 0 | 2 |
| Qwen 3.7 Flash | 2 | 4 | 0 | 3 | 9 |
| Kimi K2 | 1 | 2 | 0 | 0 | 3 |
| GLM 4.7 FlashX | 1 | 3 | 0 | 0 | 4 |
| MiniMax M2.5 | 1 | 1 | 0 | 1 | 3 |
| GPT-6 Luna | 1 | 0 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 3 | 2 | 0 | 5 |

## Sources returned with these answers

The sites and pages cited by the answers that named Wazuh, from 118 of the 147 answers that named it (only the models that return a source list).

### Domains cited

- underdefense.com: 42
- reddit.com: 37
- softwareadvice.com: 35
- g2.com: 34
- capterra.com: 32
- github.com: 31
- utmstack.com: 31
- microsoft.com: 30
- huntress.com: 29
- techrepublic.com: 24

### Pages cited

- https://utmstack.com/siem-for-small-business: 25
- https://techrepublic.com/article/siem-tools: 22
- https://underdefense.com/blog/most-affordable-ai-soc-platforms: 22
- https://softwareadvice.com/siem/small-business: 20
- https://underdefense.com/blog/siem-solutions-comparison: 17
- https://capterra.com/siem-software/s/small-businesses: 16
- https://g2.com/categories/ai-soc-agents/small-business: 15
- https://reddit.com/r/cybersecurity/comments/1b80zza/best_siem_solution_for_small_company: 14

## In its own words

What Wazuh's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: The Open Source Security Platform; Unified XDR and SIEM protection for endpoints and cloud workloads. (https://wazuh.com/)
- For: security analysts and enterprise users (https://wazuh.com/)
- Price stated: Free and open source; no license cost; Free Cloud Trial (https://wazuh.com/)
- Starting price: 0 (https://wazuh.com/)
- Free plan or trial: Free Cloud Trial (https://wazuh.com/)
- Customers named: Guayoyo, Enevo, ITA, University of Chichester, Groupon, Woop, Alignet, FirmGuardian

## What it publishes

Every page wazuh.com exposes, read 2026-09-29: 704 addresses. By kind, pages and the last 90 days:

- blog: 404 pages, 17 in the last 90 days, latest 2026-09-28
- case study: 15 pages, 1 in the last 90 days, latest 2026-09-15
- conference or event: 4 pages, 0 in the last 90 days, latest undated
- report or ebook: 1 pages, 0 in the last 90 days, latest undated
- glossary or explainer: 19 pages, 0 in the last 90 days, latest undated
- news or press: 3 pages, 0 in the last 90 days, latest undated
- Recent: 2026-09-28 blog: Wazuh and ai cyber consulting announce partnership to strengthen soc services https://wazuh.com/blog/wazuh-and-ai-cyber-consulting-announce-partnership-to-strengthen-soc-services/
- Recent: 2026-09-24 blog: Detecting common windows privilege escalation techniques with wazuh https://wazuh.com/blog/detecting-common-windows-privilege-escalation-techniques-with-wazuh
- Recent: 2026-09-17 blog: Securing web applications with coraza waf and wazuh https://wazuh.com/blog/securing-web-applications-with-coraza-waf-and-wazuh
- Recent: 2026-09-15 case study: Isecng delivers flexible open source security services with wazuh https://wazuh.com/resources/case-studies/isecng-delivers-flexible-open-source-security-services-with-wazuh
- Recent: 2026-09-10 blog: Detecting windows attacks with microsoft defender asr and wazuh https://wazuh.com/blog/detecting-windows-attacks-with-microsoft-defender-asr-and-wazuh
- Recent: 2026-09-04 blog: Wazuh and e defence announce partnership to improve soc services https://wazuh.com/blog/wazuh-and-e-defence-announce-partnership-to-improve-soc-services

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.