Identity threat detection and response for enterprise buyers
Asked as “ITDR solution”, and as “identity threat detection tool”, on behalf of an enterprise B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each. Added to the September 2026 Edition; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories: how the two compare.
Standing · first-choice share
38%
Contested · CrowdStrike Falcon Identity Protection 23%
38Microsoft Defender for Identity23CrowdStrike Falcon Identity Protection08Microsoft Entra ID32others
38% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the five products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
M01
02
03
04
05
06
07
08
09Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Microsoft Defender for Identity38%
02CrowdStrike Falcon Identity Protection23%
CrowdStrike Falcon Identity Protection23%03Silverfort ITDR6%
Silverfort ITDR6%04CrowdStrike4%
CrowdStrike4%05Okta Identity Threat Protection0%
Okta Identity Threat Protection0%06Semperis Directory Services Protector0%
Semperis Directory Services Protector0%07Huntress Managed ITDR0%
Huntress Managed ITDR0%08CyberArk Identity Security Platform0%
CyberArk Identity Security Platform0%09SentinelOne Singularity Identity0%
SentinelOne Singularity Identity0%What they warned about
Two of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike40%
6 of 15 labels negative · 5 of 12 models · 2 hard negative
“highly rated for technical capability but are **poor choices** for your specific "predictable cost" requirement” Qwen 3.7 Flash, budget prompt
Silverfort ITDR16%
5 of 32 labels negative · 5 of 12 models · 1 hard negative
“highly rated for technical capability but are **poor choices** for your specific "predictable cost" requirement” Qwen 3.7 Flash, budget prompt
Microsoft Defender for Identity
12%
5 of 41 labels negative · 5 of 12 models
“Some ITDR tools are tightly integrated with a single vendor's ecosystem (e.g., Microsoft Defender for Identity for Microsoft shops... they may lack the breadth required for large enterprises” Mistral Small, negative prompt
SentinelOne Singularity Identity19%
4 of 21 labels negative · 4 of 12 models
“licensing can vary by module and identity count, making it less predictable than Silverfort or Microsoft at scale” DeepSeek V4 Flash, budget prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the twelve in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
78 of 84 answers in this category came back with a source list, from 14 of 12 models: citations where the model returns them, or the search results it consulted. 1140 links across 202 sites, every framing counted. Ranked by the number of answers carrying the site or page.
vendor site · Huntress50 answers · 68 citations · 12 models
40 answers · 40 citations · 12 models
36 answers · 49 citations · 12 models
vendor site · Cynet36 answers · 36 citations · 12 models
33 answers · 39 citations · 12 models
29 answers · 37 citations · 10 models
vendor site · CrowdStrike26 answers · 45 citations · 10 models
vendor site · Microsoft24 answers · 41 citations · 11 models
vendor site · ManageEngine20 answers · 20 citations · 8 models
19 answers · 22 citations · 8 models
vendor site · Breachsense19 answers · 19 citations · 10 models
19 answers · 19 citations · 10 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
45 answers · 12 models
40 answers · 12 models
35 answers · 12 models
30 answers · 11 models
27 answers · 10 models
20 answers · 8 models
19 answers · 10 models
18 answers · 8 models
18 answers · 10 models
18 answers · 11 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best itdr solution”, “itdr solution”, “itdr solutions”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft parent site Microsoft Defender for Identity 38%, Microsoft Entra ID 8%, Microsoft Defender for Identity / Microsoft Entra ID Protection 4%, Microsoft Defender for Identity / Entra ID Protection 4% and 2 more | 57% | 480 | 2,240,000 | 403,136 | ||||
| CrowdStrike crowdstrike.com CrowdStrike Falcon Identity Protection 23%, CrowdStrike 4% | 26% | 337 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | 3 |
| Silverfort ITDR silverfort.com | 6% | 77 | 10 | 0 | 15,992 | 49 | 7 | |
| BeyondTrust beyondtrust.com | 2% | 181 | 6,600 | 377 | 91,200 | $1,820 | 120 | 6 |
| Cynet cynet.com | 2% | 65 | 2,400 | 147 | 13,782 | 43 | ||
| Stellar Cyber Open XDR stellarcyber.ai | 2% | 66 | 0 | 3,048 | 31 | |||
| Sophos parent site Sophos ITDR 2% | 2% | 36 | 18,100 | 2,046 | ||||
| CrowdStrike Identity Module | 2% | |||||||
| Microsoft Defender parent site Microsoft Defender XDR 2% | 2% | 191 | 18,100 | 3,525 | ||||
| Okta okta.com Okta Identity Threat Protection 0% | 0% | 45 | 368,000 | 8,418 | 1,959,740 company | 118 |
Google's top ten for the three searches hold 15 sites; 4 of them are among the sites the models cited here (crowdstrike.com, gartner.com, huntress.com, microsoft.com). The first result for “best itdr solution” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best ITDR solution for an enterprise B2B company?”Paraphrase“Which identity threat detection tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade ITDR solutions and how do they differ?”Budget-constrained“What is the best ITDR solution for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an ITDR solution. What should we look at?”Negative“Which ITDR solutions should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5CrowdStrike Falcon Identity ProtectionMicrosoft Defender for IdentityChangedCrowdStrike Falcon Identity ProtectionStellar Cyber Open XDRno first choiceagainst: Huntress Managed ITDR, Microsoft Defender for Identity, Netwrix ITDR, Okta Identity Threat Protection, Semperis Directory Services Protector, Silverfort ITDR
Three alternatives
Microsoft Defender for Identity, SentinelOne Singularity Identity, Silverfort ITDRFour alternatives
CyberArk Endpoint Privilege Manager, Fortive (formerly Delinea) Secret Server, Okta Identity Threat Protection, Ping IdentityFour alternatives
Huntress Managed ITDR, Microsoft Defender for Identity, SentinelOne Singularity Identity, Silverfort ITDRTwo alternatives
Huntress Managed ITDR, Microsoft Defender for IdentityGPT-5.4 miniMicrosoft Defender XDR, Microsoft Defender for Identityagainst: Delinea, Sophos ITDRMicrosoft Defender for IdentityChangedMicrosoft Entra ID Protection + Microsoft Defender for IdentityMicrosoft Entra IDno first choicenothing named
Two alternatives
CrowdStrike Falcon Identity Protection, Semperis Directory Services ProtectorTwo alternatives
CrowdStrike Falcon Identity Protection, Okta Identity Threat ProtectionFive alternatives
CrowdStrike Falcon Identity Protection, CyberArk Identity Security Platform, Palo Alto Networks Cortex ITDR, Semperis Directory Services Protector, Silverfort ITDROne alternative
CrowdStrikeGemini 3.5 FlashCrowdStrike Falcon Identity ProtectionSilverfort ITDRChangedMicrosoft Defender for IdentityMicrosoft Defender for IdentityCrowdStrike Falcon Identity Protectionnothing named
Four alternatives
Microsoft Defender for Identity / Microsoft Entra ID Protection, Okta Identity Threat Protection, Semperis Directory Services Protector, Silverfort ITDRThree alternatives
CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity, SentinelOne Singularity IdentityFive alternatives
CrowdStrike Falcon Identity Protection, Okta Identity Threat Protection, Semperis Directory Services Protector, SentinelOne Singularity Identity, Silverfort ITDRThree alternatives
CrowdStrike Falcon Identity Protection, Silverfort ITDR, Stellar Cyber Open XDRThree alternatives
Okta Identity Threat Protection, Semperis Directory Services Protector, Silverfort ITDRPerplexity SonarMicrosoft Defender for Identity / Microsoft Entra ID ProtectionMicrosoft Defender for Identity / Microsoft Entra ID ProtectionHeldMicrosoft Defender for Identity / Microsoft Entra ID Protectionagainst: IBMMicrosoft Defender for Identityagainst: Semperis Directory Services Protectorno first choicenothing named
Three alternatives
CrowdStrike, Semperis Directory Services Protector, Silverfort ITDRTwo alternatives
CrowdStrike Falcon Identity Protection, Semperis Directory Services ProtectorEight alternatives
BeyondTrust, CrowdStrike Falcon Identity Protection, CyberArk Identity Security Platform, Huntress Managed ITDR, Semperis Directory Services Protector, SentinelOne Singularity Identity, Varonis, Vectra AIGrok 4.1 FastMicrosoft Defender for Identity / Entra ID ProtectionCrowdStrike Falcon Identity ProtectionChangedMicrosoft Defender for IdentityMicrosoft Entra IDagainst: CrowdStrike Falcon Identity Protection, Proofpoint, SentinelOne Singularity Identity, Silverfort ITDRno first choiceagainst: Entra, Microsoft Defender for Identity, Semperis Directory Services Protector
Two alternatives
CrowdStrike Falcon Identity Protection, Okta Identity Threat ProtectionFour alternatives
Microsoft Defender for Identity, Semperis Directory Services Protector, Silverfort ITDR, Vectra AIFour alternatives
CrowdStrike Falcon Identity Protection, Semperis Directory Services Protector, SentinelOne, Silverfort ITDRThree alternatives
Huntress Managed ITDR, Okta Identity Threat Protection, PingOneMistral SmallBeyondTrust, Microsoft SecurityCrowdStrike, Microsoft Entra ID ProtectionChangedMicrosoft Entra IDCynet, Microsoft Defender for Identityagainst: CrowdStrike, SentinelOneno first choiceagainst: Microsoft Defender for Identity, Okta ITP, Silverfort ITDR
Two alternatives
CrowdStrike, SentinelOne Singularity IdentityThree alternatives
CyberArk Identity Security Platform, Okta Privileged Access, SailPointSix alternatives
CrowdStrike Falcon Identity Protection, CyberArk Identity Security Platform, Grip Security ITDR 2.0, Okta Identity Threat Protection, Ping Identity, SaviyntDeepSeek V4 FlashCrowdStrike Falcon Identity Protection, Microsoft Defender for IdentityCrowdStrike Falcon Identity ProtectionChangedSilverfort ITDRMicrosoft Defender for Identity, Silverfort ITDRagainst: Cisco Duo, CrowdStrike, SentinelOne Singularity Identityno first choicenothing named
Three alternatives
CyberArk Identity Security Platform, Semperis Directory Services Protector, Silverfort ITDRTwo alternatives
Microsoft Defender for Identity, Silverfort ITDRSix alternatives
CrowdStrike Falcon Identity Protection, Cynet 360, Microsoft Defender for Identity + Entra ID, Obsidian Security, Semperis Directory Services Protector, SentinelOne Singularity IdentityLlama 4 Maverickno first choiceSophos ITDRChangedno first choiceno first choiceno first choicenothing named
Three alternatives
Bitsight, Huntress Managed ITDR, Microsoft SecurityQwen 3.7 FlashMicrosoft Defender for Identity, Microsoft Entra IDCrowdStrike Falcon Identity ProtectionChangedMicrosoft SecurityMicrosoft Defender for Identityagainst: CrowdStrike, Silverfort ITDRno first choicenothing named
Five alternatives
CyberArk Identity Security Platform, Grip Security, Okta Identity Threat Protection, Ping Identity, Semperis Directory Services ProtectorTwo alternatives
Microsoft Defender for Identity, VaronisFour alternatives
CrowdStrike, Cybereason, Palo Alto Networks Cortex XSIAM, Semperis Directory Services ProtectorOne alternative
Huntress Managed ITDRKimi K2CrowdStrike Falcon Identity Protectionagainst: SentinelOne Singularity IdentityCrowdStrike Falcon Identity ProtectionHeldMicrosoft Defender for IdentityMicrosoft Defender for Identity, Silverfort ITDRMicrosoft Defender for Identity / Entra ID Protectionnothing named
Three alternatives
CyberArk Identity Security Platform, Microsoft Defender for Identity + Entra ID, SaviyntTwo alternatives
Microsoft Defender for Identity, SentinelOne Singularity IdentitySix alternatives
CrowdStrike Falcon Identity Protection, CyberArk Identity Security Platform, Delinea Identity Threat Protection, Okta Identity Threat Protection, SentinelOne Singularity Identity, Silverfort ITDROne alternative
Huntress Managed ITDRTwo alternatives
CrowdStrike Falcon Identity Protection, Okta Identity Threat ProtectionGLM 4.7 FlashXCrowdStrike Falcon Identity Protection, Microsoft Defender for IdentityCrowdStrike Falcon Identity ProtectionChangedno first choiceMicrosoft Defender for Identityno first choiceagainst: CrowdStrike Falcon Identity Protection, Cynet Identity, Delinea (formerly Thycotic) – ITDR module, Microsoft Defender for Identity, SentinelOne Singularity Identity
Three alternatives
Delinea, Semperis Directory Services Protector, SentinelOne Singularity IdentityThree alternatives
Microsoft Defender for Identity, Semperis Directory Services Protector, Silverfort ITDRThree alternatives
CrowdStrike Falcon Identity Protection, Huntress Managed ITDR, Okta Identity Threat ProtectionMiniMax M2.5CrowdStrike Identity Module, Microsoft Defender for IdentityCrowdStrike Falcon Identity ProtectionChangedMicrosoft Defender for Identity / Entra ID ProtectionMicrosoft Defender for Identityno first choicenothing named
Two alternatives
Microsoft Entra ID Protection, SailPoint Identity Security CloudFour alternatives
CrowdStrike Falcon Identity Protection, CyberArk Identity Threat Detection & Response, Palo Alto Networks Cortex ITDR, SentinelOne Singularity IdentityTwo alternatives
Cisco Duo Premier, Huntress Managed ITDRBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:26 | yes | 17 | 10 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 00:18 | yes | 4 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 23:51 | yes | 12 | 24 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-05 01:10 | yes | 21 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:13 | yes | 24 | 12 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 23:53 | yes | 13 | 9 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:46 | yes | 19 | 37 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 00:42 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:57 | yes | 10 | 23 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:55 | yes | 15 | 21 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:53 | yes | 23 | 64 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:21 | yes | 5 | 17 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:37 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:19 | yes | 3 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:30 | yes | 13 | 22 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-05 01:07 | yes | 21 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:26 | yes | 24 | 8 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:21 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 23:51 | yes | 20 | 31 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 23:31 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:46 | yes | 5 | 18 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:45 | yes | 15 | 18 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 01:01 | yes | 13 | 48 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:41 | yes | 15 | 22 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:08 | yes | 13 | 12 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:08 | yes | 6 | 11 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:51 | yes | 13 | 33 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-05 01:32 | yes | 23 | 8 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:48 | yes | 18 | 13 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:33 | yes | 16 | 15 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:20 | yes | 22 | 76 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 22:11 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:29 | yes | 8 | 27 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 22:18 | yes | 23 | 39 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:38 | yes | 24 | 62 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:47 | yes | 25 | 72 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:55 | yes | 16 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:33 | yes | 4 | 6 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:06 | yes | 17 | 36 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-05 00:26 | yes | 17 | 4 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 01:33 | yes | 24 | 10 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:38 | yes | 8 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:48 | yes | 24 | 57 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:46 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:38 | yes | 13 | 85 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 01:37 | yes | 18 | 27 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:45 | yes | 23 | 26 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:19 | yes | 21 | 53 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:43 | yes | 37 | 19 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:45 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:30 | no | 0 | 17 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-05 00:27 | yes | 16 | 7 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:35 | yes | 17 | 12 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 23:40 | no | 0 | 11 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:02 | yes | 22 | 64 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:20 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 01:41 | no | 0 | 30 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 01:37 | yes | 25 | 35 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:36 | yes | 20 | 158 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:02 | yes | 13 | 28 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:21 | yes | 9 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 00:55 | no | 0 | 6 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:43 | yes | 14 | 32 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-05 00:39 | yes | 16 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:56 | yes | 20 | 10 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 23:53 | yes | 5 | 7 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:40 | yes | 23 | 15 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 23:13 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:26 | yes | 14 | 43 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:41 | yes | 22 | 30 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:40 | yes | 21 | 58 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 23:55 | yes | 21 | 34 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
CrowdStrike Falcon Identity read as CrowdStrike Falcon Identity Protection
CrowdStrike Falcon Identity Threat Protection read as CrowdStrike Falcon Identity Protection
CrowdStrike Falcon Next-Gen Identity Security read as CrowdStrike Falcon Identity Protection
CrowdStrike Falcon Next-Gen Identity Security / Falcon Identity Protection read as CrowdStrike Falcon Identity Protection
CyberArk read as CyberArk Identity Security Platform
CyberArk (Privilege Cloud) read as CyberArk Identity Security Platform
Huntress read as Huntress Managed ITDR
Microsoft read as Microsoft Entra ID
Microsoft (Entra ID protections) read as Microsoft Entra ID
Netwrix read as Netwrix ITDR
Okta read as Okta Identity Threat Protection
Okta (Security Suite) read as Okta Identity Threat Protection
Okta Identity Threat Protection with Okta AI read as Okta Identity Threat Protection
Palo Alto read as Palo Alto Networks Cortex XSIAM
Palo Alto Networks read as Palo Alto Networks Cortex XSIAM
Palo Alto Networks (Cortex XSIAM & CyberArk) read as Palo Alto Networks Cortex XSIAM
Semperis read as Semperis Directory Services Protector
SentinelOne Identity read as SentinelOne Singularity Identity
Silverfort read as Silverfort ITDR
Sophos read as Sophos ITDR
Vectra read as Vectra AI
Unresolved, counted raw
Auth0 Identity Threat Detection and Response
BeyondTrust Identity Threat Detection
Cisco Duo Premier
CrowdStrike Identity Module
CrowdStrike Identity Threat Detection
CyberArk Endpoint Privilege Manager
CyberArk Identity Security Threat Detection
CyberArk Identity Threat Detection & Response
Cynet Identity
Delinea (formerly Thycotic) – ITDR module
Fortive (formerly Delinea) Secret Server
Microsoft Advanced Threat Analytics (ATA)
Netenrich Resolution Intelligence Cloud
Okta Identity Threat Detection and Response
Okta ThreatInsight + Advanced Server Access
Ping Identity – PingOne Protect / PingOne for Workforce
PingOne Protect
Proofpoint ITDR
SailPoint Identity Threat Defense
Saviynt Identity Security
Segura
Discontinued, still offered
No shut-down product was recommended here.