IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Security operations September 2026 Edition

Extended detection and response

Asked as “XDR platform”, and as “extended detection and response solution”, on behalf of a mid-market B2B company. 41 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Clear leader
63% of first choices, clear leader.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Microsoft Defender XDR63%11%57endorsed leader
02Coro7%8%13accepted challenger
03SentinelOne Singularity5%5%37accepted challenger
04Bitdefender5%6%17accepted challenger
05CrowdStrike Falcon XDR2%7%14accepted challenger
06Sophos Intercept X2%14%14accepted challenger
Show the five products at 0%, ordered by negative rate
09CrowdStrike Falcon0%28%29criticized challenger
10Trend Vision One0%24%21accepted challenger
11Cisco XDR0%24%17accepted challenger
08Palo Alto Networks Cortex XDR0%21%29accepted challenger
07Stellar Cyber0%5%19accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

One product takes 63% of first choices here, so the chart would put ten markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. One product carries a negative rate above 25% in this category. Jump to the standing

02What they warned about

Four of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick and Qwen 3.7 Flash changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike Falcon
28%
8 of 29 labels negative · 7 of 12 models
“deeply embedded within massive, enterprise-grade licensing suites like Microsoft and CrowdStrike... requires an exorbitant financial commitment” Claude Haiku 4.5, negative prompt
Microsoft Defender XDR
11%
6 of 57 labels negative · 6 of 12 models
“Vendor-native suites if you are not already standardized on that vendor: Microsoft Defender XDR is especially compelling in Microsoft 365 estates... outside those contexts, fit can be much weaker.” Perplexity Sonar, negative prompt
Palo Alto Networks Cortex XDR
21%
6 of 29 labels negative · 5 of 12 models
“Complex policy tuning/detections leading to high false positives/noise (requires expertise), steep learning curve ... aggressive pricing” Grok 4.1 Fast, negative prompt
Trend Vision One
24%
5 of 21 labels negative · 5 of 12 models
“If you're looking for alternatives to Trend Micro, consider options like CrowdStrike Falcon, Microsoft Defender XDR + Sentinel, Palo Alto Networks Cortex XDR, SentinelOne Singularity, and others.” Llama 4 Maverick, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

66 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 796 links across 169 sites, every framing counted. Ranked by the number of answers carrying the site or page.

44 answers · 75 citations · 10 models
40 answers · 49 citations · 9 models
31 answers · 36 citations · 10 models
vendor site · Palo Alto Networks30 answers · 39 citations · 10 models
21 answers · 32 citations · 9 models
21 answers · 22 citations · 9 models
20 answers · 20 citations · 9 models
vendor site · Guideflow18 answers · 18 citations · 9 models
15 answers · 51 citations · 9 models
15 answers · 15 citations · 8 models
vendor site · Expert Insights14 answers · 15 citations · 7 models
vendor site · SentinelOne12 answers · 14 citations · 5 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best XDR platform for a mid-market B2B company?”Paraphrase“Which extended detection and response solution would you recommend to a mid-sized B2B company?”Comparative“What are the top XDR platforms and how do they differ?”Budget-constrained“What is the best XDR platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a XDR platform. What should we look at?”Negative“Which XDR platforms should I avoid or be cautious about?”
Claude Haiku 4.5no first choiceESET PROTECTChanged
Two alternativesHuntress Managed EDR, Microsoft Defender for Endpoint
no first choiceCynet
Two alternativesBlumira, Microsoft Defender XDR
no first choiceagainst: Check Point, Cisco XDR, CrowdStrike Falcon, Microsoft, Palo Alto Networks, Trend Vision One
GPT-5.4 miniMicrosoft Defender XDR
Five alternativesCisco XDR, CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X
Microsoft Defender XDRHeld
One alternativeSentinelOne Singularity
no first choice
Seven alternativesCrowdStrike Falcon XDR, Elastic Security, Microsoft Defender XDR, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision One
Microsoft Defender XDR
One alternativeCrowdStrike Falcon
against: Palo Alto Networks Cortex XDR
no first choiceagainst: Bitdefender GravityZone XDR, Microsoft Defender XDR, Sophos, Stellar Cyber, Taegis XDR, Trend Vision One, WithSecure Elements XDR
Gemini 3.5 FlashSophos Intercept X + Sophos MDR
Four alternativesCrowdStrike Falcon, Microsoft Defender XDR, SentinelOne Singularity, Stellar Cyber
Microsoft Defender XDRChanged
Four alternativesBlumira, SentinelOne Singularity, Sophos Intercept X, Stellar Cyber
CrowdStrike Falcon, Palo Alto Networks
Four alternativesCisco XDR, Microsoft, SentinelOne Singularity, Sophos
Cynet, Microsoft Defender XDR
Four alternativesCoro, Huntress Managed EDR, LimaCharlie, Wazuh
SentinelOne Singularity
Four alternativesCrowdStrike Falcon, Microsoft Defender XDR, Sophos Intercept X + Sophos MDR, Stellar Cyber
against: CrowdStrike Falcon, Fortinet, Microsoft, Palo Alto Networks
Perplexity SonarCrowdStrike Falcon XDR, Microsoft Defender XDR
Three alternativesRapid7 InsightIDR, SentinelOne Singularity, Stellar Cyber Open XDR
CrowdStrike Falcon Insight XDRChanged
Three alternativesBitdefender GravityZone, Huntress Managed EDR, Microsoft Defender for Endpoint
no first choice
Seven alternativesCisco XDR, CrowdStrike Falcon Insight XDR, Microsoft Defender XDR, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Stellar Cyber Open XDR, Trend Vision One
Microsoft Defender XDR
Two alternativesRapid7 InsightIDR, Stellar Cyber
against: CrowdStrike Falcon XDR
no first choiceagainst: CrowdStrike Falcon, Microsoft Defender XDR, Palo Alto
Grok 4.1 FastMicrosoft Defender XDR
Four alternativesBitdefender GravityZone XDR, CrowdStrike Falcon XDR, Palo Alto Networks Cortex XDR, Sophos Intercept X
Sophos Intercept XChanged
Three alternativesBitdefender GravityZone XDR, CrowdStrike Falcon, Microsoft Defender XDR
Palo Alto Networks Cortex XDR
Seven alternativesCisco XDR, CrowdStrike Falcon XDR, Microsoft Defender XDR, SentinelOne Singularity, Sophos Intercept X, Stellar Cyber, Trend Vision One
Microsoft Defender XDR
Three alternativesCoro, Huntress Managed EDR, Wazuh
no first choiceagainst: Broadcom/VMware, Cisco XDR, Fortinet, Palo Alto Networks Cortex XDR, Sophos Intercept X, Trellix XDR, Trend Micro Vision One™ – XDR
Mistral SmallBitdefender
Three alternativesMicrosoft Defender XDR, Ontinue, Stellar Cyber
Microsoft Defender XDRChanged
Three alternativesBitdefender, Ontinue, Stellar Cyber
CrowdStrike Falcon Insight XDR, Palo Alto Networks Cortex XDR
Four alternativesMicrosoft Defender XDR, SentinelOne Singularity, Stellar Cyber, Trend Vision One
Microsoft Defender XDR
Two alternativesBitdefender, Ontinue
no first choiceagainst: Cisco XDR, CrowdStrike Falcon, Microsoft, Palo Alto, SentinelOne Singularity, Sophos, Trellix XDR, Trend Vision One
DeepSeek V4 FlashMicrosoft Defender XDR, SentinelOne Singularity
Three alternativesBitdefender, Ontinue, Sophos Intercept X
against: CrowdStrike Falcon, Palo Alto Networks Cortex XDR
Microsoft Defender XDRChanged
Two alternativesCrowdStrike Falcon XDR, SentinelOne Singularity
Palo Alto Networks Cortex XDR
Five alternativesCoro, CrowdStrike Falcon XDR, Microsoft Defender XDR, SentinelOne Singularity, Stellar Cyber
Microsoft Defender XDR
Three alternativesCoro, CrowdStrike Falcon, SentinelOne Singularity
Microsoft Defender XDR
Two alternativesCrowdStrike Falcon, Palo Alto Networks Cortex XDR
against: Barracuda Managed XDR, Coro, Hunters, Microsoft Defender XDR, Palo Alto Networks Cortex XDR, Secureworks Taegis XDR
Llama 4 MaverickBitdefender
One alternativeOntinue
Microsoft Defender XDRChanged
One alternativeBitdefender
no first choiceMicrosoft Defender XDR
Three alternativesBitdefender, CrowdStrike Falcon, SentinelOne Singularity
no first choiceagainst: Trend Vision One
Qwen 3.7 FlashMicrosoft Defender XDR, Sophos
Two alternativesCrowdStrike Falcon, SentinelOne Singularity
Microsoft Defender XDRChanged
Three alternativesBitdefender GravityZone, Cisco XDR, Ontinue
CrowdStrike Falcon XDR, Microsoft Defender XDR, Palo Alto Networks Cortex XDR
Four alternativesBitdefender GravityZone, Fortinet FortiXDR, SentinelOne Singularity, Trend Vision One
Coro
Two alternativesBitdefender GravityZone, Microsoft Defender XDR
against: CrowdStrike Falcon, Palo Alto Networks
no first choiceagainst: Acronis, Bitdefender, CrowdStrike Falcon, Microsoft Defender XDR, Palo Alto Networks Cortex XDR, Sophos Intercept X
Kimi K2Microsoft Defender XDR
Three alternativesBitdefender, Cynet, Sophos Intercept X
Microsoft Defender XDRHeld
Five alternativesBitdefender GravityZone XDR, CrowdStrike Falcon Insight XDR, Huntress Managed EDR, SentinelOne Singularity, Stellar Cyber Open XDR
against: Palo Alto, Rapid7
Palo Alto Networks Cortex XDR
Four alternativesCrowdStrike Falcon XDR, Microsoft Defender XDR, SentinelOne Singularity, Stellar Cyber
Microsoft Defender XDR
Three alternativesBitdefender, Coro, Huntress Managed EDR
no first choiceagainst: CrowdStrike Falcon, Microsoft Defender XDR, Palo Alto, Trend Vision One
GLM 4.7 FlashXMicrosoft Defender XDR
Seven alternativesBitdefender GravityZone XDR, Coro, CrowdStrike Falcon XDR, Elastic Security, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Trend Vision One
Microsoft Defender XDRHeld
Two alternativesBlumira, CrowdStrike Falcon XDR
CrowdStrike Falcon, Microsoft Defender XDR, Palo Alto Networks Cortex XDR
Eight alternativesAcronis Cyber Protect, Cisco XDR, Coro, SentinelOne Singularity, Sophos Intercept X, Stellar Cyber, Trend Vision One, eSentire Managed XDR
Coro
Five alternativesCrowdStrike Falcon Insight XDR, Elastic Security, Huntress Managed EDR, Microsoft Defender XDR, Sophos Intercept X
no first choicenothing named
MiniMax M2.5Microsoft Defender XDR
Four alternativesBitdefender, CrowdStrike Falcon XDR, Ontinue, Palo Alto Networks Cortex XDR
Microsoft Defender XDRHeld
Three alternativesBitdefender, Coro, Ontinue
no first choiceCoro
Three alternativesBitdefender, Microsoft Defender XDR, Microsoft Defender for Cloud
no first choiceagainst: Cisco XDR, Microsoft Defender XDR, Open XDR, Palo Alto Networks Cortex XDR, SentinelOne Singularity
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:42no04 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:46yes47 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:32yes1726 s
Direct recommendationPerplexity Sonarsonar2026-09-17 09:22yes205 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 14:01yes3519 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 11:27yes119 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:21yes1819 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:00yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:02yes1972 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:51yes818 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:21yes1360 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:44yes718 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:28yes1710 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:23yes25 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:10yes1020 s
ParaphrasePerplexity Sonarsonar2026-09-17 13:10yes206 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 14:11yes4218 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 11:25yes78 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 12:10yes1434 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:02yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:06yes515 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:24yes1632 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:09yes2435 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:03yes533 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:44yes911 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:50yes58 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:30yes2628 s
ComparativePerplexity Sonarsonar2026-09-17 11:52yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:23yes2615 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 13:33yes59 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:10yes1325 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:53yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:00yes530 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:45yes1233 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:20yes578 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:06yes1231 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:48yes98 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:43yes34 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:47yes1926 s
Budget constrainedPerplexity Sonarsonar2026-09-17 12:27yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:55yes3923 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 10:30yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:55yes1717 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:39yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:20yes529 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:46yes817 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:38yes819 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:55yes518 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:14no06 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 14:01no011 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:08yes1526 s
Scale constrainedPerplexity Sonarsonar2026-09-17 09:34yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:06yes1611 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 14:05no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:05yes1421 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:40yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:59no039 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:24yes1025 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:43yes762 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:39no059 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:26yes1710 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:27yes98 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:34yes1024 s
Negative framingPerplexity Sonarsonar2026-09-17 11:13yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:11yes3916 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 10:31yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:42yes2664 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:20yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:14yes881 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:49yes2437 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:05yes24104 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:01yes945 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Cisco read as Cisco XDR
Cisco (Cisco XDR & Splunk) read as Cisco XDR
CrowdStrike read as CrowdStrike Falcon
CrowdStrike (Falcon Insight XDR) read as CrowdStrike Falcon
CrowdStrike Falcon Insight read as CrowdStrike Falcon Insight XDR
Crowdstrike read as CrowdStrike Falcon
Cynet 360 read as Cynet
ESET read as ESET PROTECT
Elastic read as Elastic Security
Huntress read as Huntress Managed EDR
Microsoft Defender read as Microsoft Defender XDR
Microsoft Defender Suite read as Microsoft Defender XDR
Palo Alto Cortex read as Palo Alto Networks Cortex XDR
Palo Alto Networks Cortex read as Palo Alto Networks Cortex XDR
Palo Alto/Cortex read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity
SentinelOne (Singularity XDR) read as SentinelOne Singularity
Trellix read as Trellix XDR
Trellix (formerly FireEye/McAfee) read as Trellix XDR
Trend Micro read as Trend Vision One
Unresolved, counted raw
Amazon Security Lake
Barracuda Managed XDR
Bitdefender MXDR
Fortinet FortiXDR
Google Chronicle Security Operations Suite
Open XDR
Secureworks Taegis XDR
Taegis XDR
eSentire Atlas
eSentire Managed XDR
Discontinued, still offered
No shut-down product was recommended here.
← EDRGRC →