IT AI Index

Index › Function 01 of 6 · October 2026 Edition

October 2026 Edition

Security operations

Detecting, investigating and reducing threats: SIEM, endpoint and extended detection, vulnerability and attack surface management, email security, awareness, data loss prevention, and the governance, risk and compliance that reports on it. 31 of 34 categories scored, 3 planned.

ShowinginAll 136 categories →

Standing in security operations

First-choice share across the direct, paraphrase, budget and scale prompts, all fourteen models, for the thirty-one security operations categories scored in the October 2026 Edition.

Security operations

Third-party risk management

Small business and mid-market share a leader. Enterprise differs.

UpGuardClear leader

39%▼−9Since September 2026: 44% → 35%, −9 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

55%▼−2Since September 2026: 53% → 51%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

ProcessUnity tiedContested

19%↗new leaderNew leader since September 2026: OneTrust Third-Party Risk Management (20%) replaces ProcessUnity (25% then, 15% now), 4 points clear, inside the 11-point floor.

Security operations

Attack surface management

Small business and mid-market share a leader. Enterprise differs.

IntruderClear leader

26%▼−23Since September 2026: 52% → 29%, −23 points. Past the 11-point floor: movement. Read over the models both editions asked.

49%▼−6Since September 2026: 59% → 53%, −6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Cortex XpanseContested

29%↗new leaderNew leader since September 2026: Cortex Xpanse (28%) replaces Microsoft Defender External Attack Surface Management (21% then, 17% now), 11 points clear, past the 11-point floor.

Security operations

Data loss prevention

One leader in all three segments

Microsoft Purview DLPClear leader

35%▲+2Since September 2026: 30% → 31%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

46%▲+9Since September 2026: 39% → 48%, +9 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

57%▲+5Since September 2026: 52% → 57%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Security awareness training

One leader in all three segments

KnowBe4Clear leader

20%↗new leaderNew leader since September 2026: KnowBe4 (23%) replaces Hook Security (34% then, 14% now), 9 points clear, inside the 11-point floor.

45%▲+4Since September 2026: 42% → 46%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

74%▲+11Since September 2026: 65% → 76%, +11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Penetration testing as a service

Small business and mid-market share a leader. Enterprise differs.

Cobalt tiedClear leader

17%↗new leaderNew leader since September 2026: Bright Defense (18%) replaces BreachLock (28% then, 12% now), 5 points clear, inside the 11-point floor.

45%▼−1Since September 2026: 44% → 44%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.

NetSPIClear leader

46%▲+8Since September 2026: 40% → 48%, +8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Small business and mid-market share a leader. Enterprise differs.

TinesClear leader

44%▼−7Since September 2026: 49% → 42%, −7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

41%▼−10Since September 2026: 47% → 37%, −10 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Cortex XSOARClear leader

41%▲+2Since September 2026: 40% → 42%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Extended detection and response

One leader in all three segments

Microsoft Defender XDRClear leader

25%↗new leaderNew leader since September 2026: Microsoft Defender XDR (22%) replaces Coro (57% then, 14% now), 8 points clear, inside the 11-point floor.

40%▼−25Since September 2026: 63% → 39%, −25 points. Past the 11-point floor: movement. Read over the models both editions asked.

44%▼−5Since September 2026: 48% → 43%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Mid-market and enterprise share a leader. Small business differs.

BlumiraContested

34%▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Microsoft SentinelClear leader

38%▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

41%▲+12Since September 2026: 30% → 42%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.

Security operations

Deception technology

Small business and mid-market share a leader. Enterprise differs.

Thinkst CanaryContested

Acalvio ShadowPlexClear leader

Security operations

Managed detection and response

A different leader in every segment

Huntress Managed EDRClear leader

78%▼−6Since September 2026: 88% → 82%, −6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Arctic Wolf Managed Detection and ResponseContested

37%▼−2Since September 2026: 39% → 38%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

CrowdStrike Falcon CompleteContested

35%=heldSince September 2026: 37% → 36%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Compliance automation

A different leader in every segment

VantaContested

35%▲+1Since September 2026: 35% → 37%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.

DrataContested

34%▼−2Since September 2026: 37% → 35%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

VantaContested

37%▼−9Since September 2026: 48% → 38%, −9 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Small business and mid-market share a leader. Enterprise differs.

Microsoft Defender for Office 365Contested

27%▼−17Since September 2026: 44% → 28%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.

32%▲+1Since September 2026: 31% → 32%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.

Proofpoint Email ProtectionClear leader

48%▲+7Since September 2026: 40% → 48%, +7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

SaaS security posture management

A different leader in every segment

Nudge Security tiedContested

Wing SecurityContested

AppOmniContested

Security operations

Vulnerability management platforms

A different leader in every segment

IntruderClear leader

45%▼−13Since September 2026: 59% → 46%, −13 points. Past the 11-point floor: movement. Read over the models both editions asked.

Rapid7 InsightVMContested

30%▼−16Since September 2026: 45% → 29%, −16 points. Past the 11-point floor: movement. Read over the models both editions asked.

Qualys VMDR tiedContested

32%↗new leaderNew leader since September 2026: Qualys VMDR (36%) replaces Tenable Vulnerability Management (45% then, 31% now), 4 points clear, inside the 11-point floor.

Security operations

Endpoint detection and response

A different leader in every segment

Microsoft Defender for CloudClear leader

47%↗new leaderNew leader since September 2026: Microsoft Defender for Cloud (39%) replaces Huntress Managed EDR (44% then, 32% now), 7 points clear, inside the 11-point floor.

Microsoft Defender for EndpointContested

30%↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (34%) replaces Bitdefender GravityZone EDR (20% then, 4% now), 30 points clear, past the 11-point floor.

CrowdStrike Falcon InsightClear leader

52%▲+1Since September 2026: 50% → 51%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

Enterprise browsers

Small business and mid-market share a leader. Enterprise differs.

Google Password ManagerContested

Island Enterprise BrowserContested

Security operations

Cyber risk quantification

A different leader in every segment

FairCRQContested

CyberSaint CyberStrongContested

SAFE SecurityClear leader

Security operations

Breach and attack simulation

Mid-market and enterprise share a leader. Small business differs.

VantaContested

CymulateContested

Security operations

Business continuity management

A different leader in every segment

SafetyCultureClear leader

LogicManagerContested

Fusion Risk ManagementContested

Security operations

One leader in all three segments

Dropzone AI tiedContested

Security operations

Digital risk protection

A different leader in every segment

GuardzContested

UpGuard BreachSightContested

ZeroFoxContested

Security operations

Insider risk management

One leader in all three segments

Microsoft Purview Insider Risk ManagementClear leader

Security operations

Network detection and response

A different leader in every segment

Security OnionContested

ManageEngine NetFlow AnalyzerContested

Vectra AIContested

Security operations

OT and IoT security

Small business and mid-market share a leader. Enterprise differs.

Microsoft Defender for IoTContested

Claroty xDomeContested

Security operations

Communications archiving and compliance

A different leader in every segment

Google VaultContested

Smarsh Enterprise ArchiveContested

Proofpoint Enterprise ArchiveContested

Security operations

A different leader in every segment

VantaContested

30%▲+7Since September 2026: 22% → 29%, +7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

HyperproofContested

19%▲+3Since September 2026: 14% → 17%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

MetricStreamContested

24%↗new leaderNew leader since September 2026: MetricStream (25%) replaces ServiceNow Integrated Risk Management (36% then, 11% now), 14 points clear, past the 11-point floor.

Security operations

Data security posture management

Small business and mid-market share a leader. Enterprise differs.

Microsoft PurviewContested

Varonis Data Security Platform tiedContested

Security operations

Client-side protection

One leader in all three segments

csideContested

Security operations

API security platforms

A different leader in every segment

42CrunchContested

Aikido SecurityContested

Akamai API SecurityContested

Security operations

Threat intelligence platforms

Small business and mid-market share a leader. Enterprise differs.

MISP tiedContested

18%↗new leaderNew leader since September 2026: MISP (18%) replaces NordStellar (19% then, 14% now), 4 points clear, inside the 11-point floor.

12%↗new leaderNew leader since September 2026: Anomali ThreatStream (11%) replaces NordStellar (13% then, 0% now), 11 points clear, past the 11-point floor.

Recorded Future Intelligence CloudClear leader

73%▲+8Since September 2026: 61% → 69%, +8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Security operations

AI security platforms

Mid-market and enterprise share a leader. Small business differs.

Microsoft Defender for CloudContested

SentinelOne Singularity tiedContested

Next in security operations

Planned categories are in the build queue and are scored exactly like every other.

Breach and attack simulation plannedPrivacy management plannedSecurity questionnaire automation planned

All 136 categories Subscribe to the index