Index › Security operations › September 2026 Edition

Endpoint detection and response

Asked as “EDR platform”, and as “endpoint detection and response tool”, on behalf of a mid-market B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Bitdefender GravityZone and Microsoft Defender for Endpoint

Contested

20% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Huntress Managed EDR44%Clear leaderStanding →Mid-market

Bitdefender GravityZone20%ContestedThis page Enterprise

CrowdStrike Falcon43%Clear leaderStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Bitdefender GravityZone0%42accepted challenger

Microsoft Defender for Endpoint11%38accepted challenger

Huntress Managed EDR0%34accepted challenger

Microsoft Defender for Cloud0%10accepted challenger

CrowdStrike Falcon20%35accepted challenger

SentinelOne Singularity16%45accepted challenger

CrowdStrike31%13criticized challenger

Show the six products at 0%, ordered by negative rate

VMware Carbon Black58%12criticized challenger

ThreatDown EDR30%10criticized challenger

Palo Alto Networks Cortex XDR11%19accepted challenger

Trend Micro8%13accepted challenger

Sophos Intercept X5%22accepted challenger

Cynet0%11accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Bitdefender GravityZone vs Microsoft Defender for Endpoint Bitdefender GravityZone vs Huntress Managed EDR Microsoft Defender for Endpoint vs Huntress Managed EDR

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative30%

Key

Bitdefender GravityZone20%

Microsoft Defender for Endpoint20%

Huntress Managed EDR14%

Microsoft Defender for Cloud14%

CrowdStrike Falcon12%

SentinelOne Singularity8%

CrowdStrike6%

Sophos Intercept X0%

Palo Alto Networks Cortex XDR0%

Cynet0%

Trend Micro0%

ThreatDown EDR0%

VMware Carbon Black0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

VMware Carbon Black

58%

7 of 12 labels negative · 6 of 12 models · 4 hard negative

“Strongly Avoid or High Caution... High false positives blocking legit apps, integration struggles post-acquisitions, premium pricing without matching value” Grok 4.1 Fast, negative prompt

SentinelOne Singularity

16%

7 of 45 labels negative · 6 of 12 models

“Cautions: Occasional false positives/alert issues, compatibility/migration challenges, less mature ecosystem/threat intel depth, weaker non-Windows support.” Grok 4.1 Fast, negative prompt

CrowdStrike Falcon

20%

7 of 35 labels negative · 5 of 12 models

“Excellent capabilities, but the 2024 outage and testing controversies are valid caution flags for risk-averse environments.” GLM 4.7 FlashX, negative prompt

Datto EDR

100%

4 of 4 labels negative · 4 of 12 models · 3 hard negative

“MSP reviews describe it as "among the least effective tools"... the high FPR and operational overhead can be a dealbreaker.” GLM 4.7 FlashX, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

65 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 723 links across 194 sites, every framing counted. Ranked by the number of answers carrying the site or page.

gbhackers.com

41 answers · 45 citations · 9 models

cybersecuritynews.com

32 answers · 33 citations · 10 models

cyberpress.org

31 answers · 31 citations · 10 models

huntress.com

vendor site · Huntress22 answers · 34 citations · 10 models

acronis.com

vendor site · Acronis17 answers · 17 citations · 7 models

senseon.io

vendor site · SenseOn15 answers · 15 citations · 8 models

cnicsolutions.com

14 answers · 22 citations · 8 models

learn.g2.com

14 answers · 18 citations · 7 models

decryptiondigest.com

13 answers · 15 citations · 9 models

reddit.com

11 answers · 25 citations · 7 models

kaseya.com

vendor site · Kaseya11 answers · 11 citations · 6 models

redcanary.com

vendor site · Red Canary10 answers · 15 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

gbhackers.com/best-edr-solutions-compared

40 answers · 9 models

cybersecuritynews.com/best-edr-solutions

32 answers · 10 models

cyberpress.org/edr-solutions-by-business-size

31 answers · 10 models

senseon.io/blog/best-edr-solutions

15 answers · 8 models

acronis.com/en/blog/posts/best-edr-endpoint-detection-and-response-solution…

14 answers · 5 models

huntress.com/internal-it-cybersecurity-guide/best-endpoint-protection-for-s…

13 answers · 9 models

cnicsolutions.com/cybersecurity-threat-protection/best-endpoint-protection-…

12 answers · 8 models

huntress.com/edr-guide/best-edr-solutions

11 answers · 6 models

kaseya.com/blog/best-edr-solutions

11 answers · 6 models

learn.g2.com/best-edr-software

11 answers · 6 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best EDR platform for a mid-market B2B company?”Paraphrase“Which endpoint detection and response tool would you recommend to a mid-sized B2B company?”Comparative“What are the top EDR platforms and how do they differ?”Budget-constrained“What is the best EDR platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a EDR platform. What should we look at?”Negative“Which EDR platforms should I avoid or be cautious about?”

Claude Haiku 4.5Huntress Managed EDR

Five alternatives

Bitdefender GravityZone, CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne Singularity, ThreatDown EDR

Huntress Managed EDRHeld

Two alternatives

Bitdefender GravityZone, ESET PROTECT

no first choiceagainst: Datto RMMMicrosoft Defender for Cloud

Two alternatives

Bitdefender GravityZone, ThreatDown EDR

no first choiceagainst: CrowdStrike, Cybereason

GPT-5.4 miniCrowdStrike Falcon, Microsoft Defender for Endpoint

Three alternatives

Huntress Managed EDR, SentinelOne Singularity, Sophos Intercept X

Microsoft Defender for EndpointChanged

Two alternatives

CrowdStrike Falcon, SentinelOne Singularity

CrowdStrike Falcon, Microsoft Defender for Endpoint

Three alternatives

Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X / Sophos EDR

against: Symantec Endpoint Security, Trellix EDR, VMware Carbon BlackMicrosoft Defender for Cloud, Microsoft Defender for Endpoint

One alternative

Sophos Intercept X

against: CrowdStrike, SentinelOne Singularityno first choiceagainst: FortiEDR, Microsoft Defender XDR, VMware Carbon Black

Gemini 3.5 FlashSentinelOne Singularity

Two alternatives

Huntress Managed EDR, Sophos Intercept X

against: CrowdStrike Falcon, Microsoft Defender for EndpointHuntress Managed EDRChanged

Two alternatives

Microsoft Defender for Cloud, SentinelOne Singularity

against: CrowdStrike FalconCrowdStrike Falcon Insight

Three alternatives

Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity

Microsoft Defender for Cloud

Five alternatives

Bitdefender GravityZone, Cynet, Huntress Managed EDR, LimaCharlie, Wazuh

against: CrowdStrike, SentinelOne SingularityCrowdStrike, SentinelOne Singularity

Three alternatives

Microsoft Defender for Endpoint, Sophos Intercept X, Trend Micro

against: CrowdStrike, Kaspersky Endpoint Detection and Response (EDR) Expert, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity

Perplexity SonarCrowdStrike Falcon Insight

Four alternatives

Bitdefender GravityZone, Huntress Managed EDR, SentinelOne Singularity, Sophos Intercept X + Sophos MDR

CrowdStrike Falcon InsightHeld

Three alternatives

Bitdefender GravityZone, Huntress Managed EDR, Microsoft Defender for Endpoint

no first choiceMicrosoft Defender for Cloud

Three alternatives

Bitdefender GravityZone, Huntress Managed EDR, SentinelOne Singularity

no first choiceagainst: Elastic Security, FireEye EDR, ThreatDown EDR

Grok 4.1 FastBitdefender GravityZone

Two alternatives

CrowdStrike Falcon Insight, Microsoft Defender for Endpoint

Bitdefender GravityZoneHeld

Four alternatives

CrowdStrike Falcon, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity

CrowdStrike Falcon

Five alternatives

Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro

Microsoft Defender for Cloud

Three alternatives

Bitdefender GravityZone, ESET PROTECT, Huntress Managed EDR

against: WazuhCrowdStrike

Five alternatives

Bitdefender GravityZone, Huntress Managed EDR, Microsoft Defender, SentinelOne Singularity, Sophos MDR

against: CrowdStrike Falcon, Datto EDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Trend Micro, VMware Carbon Black

Mistral SmallBitdefender GravityZone, Microsoft Defender for Endpoint

Two alternatives

CrowdStrike Falcon, SentinelOne Singularity

Bitdefender GravityZoneChanged

One alternative

CrowdStrike

CrowdStrike Falcon

Two alternatives

Microsoft Defender for Endpoint, SentinelOne Singularity

ESET PROTECT, Huntress Managed EDR

Three alternatives

Bitdefender GravityZone, Microsoft Defender for Endpoint, ThreatDown EDR

no first choiceagainst: FireEye EDR, ThreatDown EDR, VMware Carbon Black

DeepSeek V4 FlashBitdefender GravityZone, Huntress Managed EDR

Two alternatives

CrowdStrike Falcon, Microsoft Defender for Endpoint

CrowdStrike Falcon, SentinelOne SingularityChanged

Five alternatives

Bitdefender GravityZone, Cynet, Huntress Managed EDR, Microsoft Defender for Endpoint, Sophos Intercept X

CrowdStrike Falcon

Three alternatives

Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity

Microsoft Defender for Cloud

Three alternatives

Bitdefender GravityZone, CrowdStrike Falcon, Huntress Managed EDR

CrowdStrike Falcon

Three alternatives

Cynet, Microsoft Defender, SentinelOne Singularity MDR

against: CrowdStrike Falcon, Datto EDR, Symantec Endpoint Protection, VMware Carbon Black

Llama 4 MaverickCrowdStrike

One alternative

Bitdefender GravityZone

Bitdefender GravityZoneChangedno first choiceMicrosoft Defender for Endpoint

Two alternatives

Bitdefender GravityZone, SenseOn

no first choiceagainst: FireEye's EDR, ThreatDown EDR

Qwen 3.7 FlashCrowdStrike Falcon

Four alternatives

Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept X

Bitdefender GravityZoneChanged

Three alternatives

CrowdStrike Falcon, Microsoft Defender for Endpoint, Sophos Intercept X

CrowdStrike Falcon, SentinelOne Singularity

Two alternatives

Microsoft Defender XDR, Palo Alto Networks Cortex XDR

Microsoft Defender for Endpoint

Four alternatives

Bitdefender GravityZone, Cynet, ESET PROTECT, Huntress Managed EDR

CrowdStrike Falcon, SentinelOne Singularity

One alternative

Microsoft Defender XDR

against: Cisco Secure Endpoint, FireEye (Mandiant) – Legacy On-Premises Solutions, SentinelOne Singularity, VMware Carbon Black

Kimi K2Bitdefender GravityZone

Three alternatives

Huntress Managed EDR, Microsoft Defender for Business / Endpoint, SentinelOne Singularity

against: CrowdStrike FalconMicrosoft Defender for CloudChanged

Three alternatives

Bitdefender GravityZone, CrowdStrike Falcon Pro/Insight, SentinelOne Singularity

CrowdStrike Falcon

Seven alternatives

Bitdefender GravityZone, Huntress Managed EDR, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro

Microsoft Defender for Endpoint

Four alternatives

Bitdefender GravityZone, Huntress Managed EDR, Microsoft Defender for Cloud, Wazuh

against: OSQuery, VelociraptorMicrosoft Defender

Four alternatives

Bitdefender GravityZone, ESET PROTECT, Huntress Managed EDR, SentinelOne Singularity

against: CrowdStrike Falcon, Datto EDR, SentinelOne Singularity

GLM 4.7 FlashXCrowdStrike Falcon

Five alternatives

Bitdefender GravityZone, Cynet, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity

Bitdefender GravityZone, Microsoft Defender for EndpointChanged

One alternative

CrowdStrike Falcon

Six alternatives

Bitdefender GravityZone, ESET PROTECT, FortiEDR, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity

Huntress Managed EDR, Microsoft Defender for Endpoint

Five alternatives

CrowdStrike Falcon, Elastic Security, Jamf Protect Profile, Sophos Intercept X, ThreatDown EDR

no first choiceagainst: CrowdStrike Falcon, Datto EDR, Elastic Security, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, VMware Carbon Black

MiniMax M2.5no first choiceBitdefender GravityZone, Microsoft Defender for EndpointChanged

Two alternatives

CrowdStrike Falcon, SentinelOne Singularity

Three alternatives

Bitdefender GravityZone, Cynet, Microsoft Defender for Endpoint

Huntress Managed EDR

Three alternatives

Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Cloud

no first choicenothing named

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:21	yes	9	11 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 12:02	yes	4	8 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:57	yes	14	25 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 13:41	yes	20	6 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:24	yes	19	13 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:43	yes	7	8 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 12:30	yes	9	13 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:39	yes	5	3 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:36	yes	20	79 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 09:40	yes	8	22 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:22	yes	10	43 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:09	no	0	40 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 09:58	yes	9	9 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:13	no	0	17 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:43	yes	12	20 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 12:50	yes	20	6 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 09:30	yes	38	17 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:51	yes	5	4 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:21	yes	7	16 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:44	yes	5	2 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:13	yes	5	36 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:10	yes	10	25 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:06	yes	24	37 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:48	yes	5	16 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 11:45	yes	9	8 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:40	yes	3	7 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:36	yes	22	23 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 12:29	yes	20	8 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:15	yes	12	9 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:11	yes	5	5 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:20	yes	8	15 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:35	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:40	yes	5	33 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 13:32	yes	5	24 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:51	yes	14	31 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:29	yes	9	35 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:18	yes	9	6 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:43	yes	5	6 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 14:04	yes	19	27 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 12:55	yes	20	4 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 09:26	yes	15	8 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:06	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 12:21	yes	7	21 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:20	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:38	yes	5	22 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:54	yes	15	40 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:52	yes	9	305 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 09:58	yes	5	46 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:57	no	0	6 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:37	no	0	9 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:27	no	0	15 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 13:50	yes	20	10 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:26	yes	18	10 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:02	no	0	9 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:37	yes	19	24 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:13	yes	5	3 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:19	no	0	38 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:24	yes	13	31 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:34	yes	10	106 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 09:28	yes	5	13 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 11:57	yes	18	9 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:31	yes	4	7 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 09:55	yes	22	26 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 09:47	yes	20	8 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:43	yes	25	15 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:46	yes	5	5 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:57	yes	29	22 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:24	yes	5	3 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:16	yes	34	78 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 13:03	yes	27	69 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 13:24	yes	27	71 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:06	yes	5	15 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Bitdefender read as Bitdefender GravityZone

Bitdefender GravityZone Business Security read as Bitdefender GravityZone

Bitdefender GravityZone Business Security Enterprise read as Bitdefender GravityZone

Bitdefender GravityZone Business Security Premium read as Bitdefender GravityZone

Broadcom Symantec Endpoint Security read as Symantec Endpoint Security

Carbon Black read as VMware Carbon Black

Carbon Black (VMware) read as VMware Carbon Black

Cortex read as Palo Alto Networks Cortex XDR

CrowdStrike Falcon Complete read as CrowdStrike Falcon

CrowdStrike Falcon Enterprise read as CrowdStrike Falcon

CrowdStrike Falcon Go read as CrowdStrike Falcon

CrowdStrike Falcon Insight XDR read as CrowdStrike Falcon Insight

CrowdStrike Falcon Platform read as CrowdStrike Falcon

Cynet 360 AutoXDR read as Cynet

Defender for Endpoint read as Microsoft Defender for Endpoint

ESET PROTECT Enterprise read as ESET PROTECT

ESET PROTECT Entry read as ESET PROTECT

ESET PROTECT Platform read as ESET PROTECT

Elastic read as Elastic Security

Huntress read as Huntress Managed EDR

Huntress (via MSP) read as Huntress Managed EDR

Kaspersky read as Kaspersky Endpoint Detection and Response (EDR) Expert

Malwarebytes ThreatDown (with EDR) read as ThreatDown EDR

Microsoft Defender for Endpoint P2 read as Microsoft Defender for Endpoint

Microsoft Defender for Endpoint Plan 2 read as Microsoft Defender for Endpoint

Palo Alto read as Palo Alto Networks Cortex XDR

Palo Alto Cortex XDR read as Palo Alto Networks Cortex XDR

Palo Alto Cortex XDR (with EDR) read as Palo Alto Networks Cortex XDR

Palo Alto Networks read as Palo Alto Networks Cortex XDR

SentinelOne read as SentinelOne Singularity

SentinelOne Singularity read as SentinelOne Singularity

SentinelOne Singularity Complete read as SentinelOne Singularity

SentinelOne Singularity Core read as SentinelOne Singularity

SentinelOne Singularity Endpoint read as SentinelOne Singularity

Sophos read as Sophos Intercept X

Sophos Endpoint read as Sophos Intercept X

Sophos Intercept X Endpoint read as Sophos Intercept X

ThreatDown read as ThreatDown EDR

ThreatDown (formerly Malwarebytes for Teams) read as ThreatDown EDR

Trellix read as Trellix EDR

Trellix (formerly FireEye) read as Trellix EDR

Trend Micro Vision One read as Trend Micro

Windows Defender read as Windows Defender Antivirus

Unresolved, counted raw

CrowdStrike Falcon Pro/Insight

CyberMark

FireEye (Mandiant) – Legacy On-Premises Solutions

FireEye's EDR

Jamf Protect Profile

Discontinued, still offered

No shut-down product was recommended here.

Endpoint detection and response

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in security operations