# The leader changed in eighteen of sixty-seven categories since September 2026

IT AI Recommendation Index, October 2026 Edition. Page: https://it-ai-index.com/research/movement/

Between the September 2026 Edition and the October 2026 Edition the leader changed in eighteen of sixty-seven categories, six of them by more than the noise floor of 11 points. Thirty-five of 556 changes in first-choice share clear the floor. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. A change smaller than the floor is reported as within noise: asked twice with nothing changed, the models move a leader's share by that much on their own, so a smaller change between editions cannot be told from the instrument.

- Business password managers: Bitwarden 49% to 1Password 45%
- Container and Kubernetes security: Sysdig Secure 29% to Trivy 22%
- Data warehouses: Snowflake 47% to Google BigQuery 48%
- Endpoint detection and response: Bitdefender GravityZone EDR 20% to Microsoft Defender for Endpoint 34%
- Endpoint protection: Microsoft Defender for Cloud 22% to Microsoft Defender for Endpoint 23%
- ETL and ELT: Airbyte 32% to Fivetran 37%
- Feature flags: LaunchDarkly 30% to Flagsmith 27%
- Identity governance: Lumos 20% to Microsoft Entra ID Governance 19%
- Infrastructure monitoring: Site24x7 24% to Datadog 27%
- IT asset management: Snipe-IT 24% to Freshservice 31%
- ML platforms: Databricks Mosaic AI 19% to Azure Machine Learning 18%
- Observability platforms: Grafana 29% to New Relic 31%
- Patch management: Action1 27% to ManageEngine Patch Manager Plus 30%
- SASE platforms: Cato SASE Cloud 28% to Cato Networks 35%
- Secrets management: Doppler 33% to HashiCorp Vault 33%
- Threat intelligence platforms: NordStellar 13% to Anomali ThreatStream 11%
- Vector databases: Qdrant 37% to pgvector 36%
- Zero trust network access: Cloudflare One 42% to Twingate 40%
- Microsoft Defender XDR in Extended detection and response: 63% to 39%
- Cloudflare WAF in Web application firewalls: 89% to 67%
- Cato SASE Cloud in SASE platforms: 28% to 7%
- Atera in Remote monitoring and management: 7% to 27%
- WorkOS in Customer identity and access management: 22% to 4%
- Sophos Intercept X in Extended detection and response: 2% to 20%
- Qdrant in Vector databases: 37% to 20%
- Semgrep in Static application security testing: 47% to 30%
- Rapid7 InsightVM in Vulnerability management platforms: 45% to 29%
- CurrentWare in Data loss prevention: 18% to 2%
- Graylog in Log management: 10% to 26%
- Site24x7 in Infrastructure monitoring: 24% to 9%

Published under CC BY 4.0. The output is the models' output; nothing here is a recommendation by the index.