Network detection and response for small business buyers
Asked as “NDR platform”, and as “network traffic analysis tool”, on behalf of a small B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories: how the two compare.
Standing · first-choice share
15%
Contested · Paessler PRTG Network Monitor 11%
15Security Onion11Paessler PRTG Network Monitor09Sophos NDR64others
15% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the four products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
For buyers
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
ManageEngine NetFlow Analyzer vs ExtraHop RevealManageEngine NetFlow Analyzer vs ExtraHop RevealXManageEngine NetFlow Analyzer vs DarktraceVectra AI vs Paessler PRTG Network MonitorVectra AI vs Corelight Open NDRVectra AI vs ExtraHop RevealVectra AI vs ExtraHop RevealXVectra AI vs DarktracePaessler PRTG Network Monitor vs Corelight Open NDRPaessler PRTG Network Monitor vs ExtraHop RevealPaessler PRTG Network Monitor vs ExtraHop RevealXPaessler PRTG Network Monitor vs DarktraceCorelight Open NDR vs ExtraHop RevealCorelight Open NDR vs ExtraHop RevealXCorelight Open NDR vs DarktraceExtraHop Reveal vs ExtraHop RevealXExtraHop Reveal vs DarktraceExtraHop RevealX vs Darktrace
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05S06
Z07
08
09
10
11
12Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative30%
Key
01Security Onion15%
Security Onion15%02Paessler PRTG Network Monitor11%
Paessler PRTG Network Monitor11%03Sophos NDR9%
Sophos NDR9%04Corelight Open NDR4%
Corelight Open NDR4%05Wireshark2%
Wireshark2%06Suricata2%
07Zeek2%
08Vectra AI2%
Vectra AI2%09Cisco Secure Network Analytics0%
Cisco Secure Network Analytics0%10ExtraHop Reveal0%
ExtraHop Reveal0%11ExtraHop RevealX0%
ExtraHop RevealX0%12Darktrace0%
Darktrace0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Darktrace60%
24 of 40 labels negative · 12 of 14 models · 11 hard negative
“**Avoid enterprise NDR platforms** like Darktrace, Vectra AI, ExtraHop, and similar high-end solutions if you're a small business.” MiniMax M2.5, negative prompt
Vectra AI58%
22 of 38 labels negative · 9 of 14 models · 9 hard negative
“**Avoid enterprise NDR platforms** like Darktrace, Vectra AI, ExtraHop, and similar high-end solutions if you're a small business.” MiniMax M2.5, negative prompt
Cisco Secure Network Analytics53%
8 of 15 labels negative · 8 of 14 models · 4 hard negative
“noted for its complexity, steep learning curve, and the need for additional Cisco products” Mistral Small, negative prompt
Corelight Open NDR42%
11 of 26 labels negative · 8 of 14 models · 3 hard negative
“avoid standalone enterprise NDR platforms from vendors like **Darktrace**, **Vectra AI**, **Corelight**” DeepSeek V4 Flash, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
74 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 997 links across 217 sites, every framing counted. Ranked by the number of answers carrying the site or page. None of the 252 answers across every segment cited this index's own page for the category.
vendor site · G246 answers · 94 citations · 13 models
46 answers · 56 citations · 11 models
40 answers · 46 citations · 12 models
vendor site · FitGap34 answers · 34 citations · 10 models
28 answers · 28 citations · 10 models
23 answers · 32 citations · 10 models
22 answers · 28 citations · 10 models
21 answers · 23 citations · 10 models
20 answers · 25 citations · 10 models
vendor site · Vectra18 answers · 29 citations · 12 models
vendor site · CyberPress16 answers · 16 citations · 9 models
vendor site · Guideflow15 answers · 15 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
39 answers · 12 models
38 answers · 11 models
33 answers · 13 models
31 answers · 10 models
28 answers · 10 models
17 answers · 9 models
15 answers · 8 models
15 answers · 8 models
14 answers · 7 models
13 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best ndr platform”, “ndr platform”, “ndr platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Security Onion securityonion.net | 15% | 48 | 3,600 | 209 | 2,016 | |||
| Paessler PRTG Network Monitor paessler.com | 11% | 153 | 480 | 4 | 107,237 | $12,945 | 120 | |
| Sophos parent site Sophos NDR 9% | 9% | 18 | 18,100 | 2,046 | ||||
| ManageEngine parent site ManageEngine NetFlow Analyzer 8% | 8% | 27 | 8,100 | 675 | ||||
| Blumira blumira.com | 6% | 110 | 1,300 | 12 | 8,060 | 10 | ||
| Stellar Cyber Open XDR stellarcyber.ai | 4% | 66 | 0 | 3,048 | 31 | 2 | ||
| Lumu Technologies lumu.io | 4% | 2 | 8 | |||||
| Corelight Open NDR corelight.com | 4% | 101 | 10 | 0 | 13,796 | 36 | 2 | |
| Wireshark wireshark.org | 2% | 17 | 60,500 | 5,563 | 201,720 | 2 | ||
| Huntress huntress.com | 2% | 35 | 33,100 | 4,338 | 352,368 | $15,522 | 120 |
Google's top ten for the three searches hold 19 sites; 1 of them are among the sites the models cited here (vectra.ai). The first result for “best ndr platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best NDR platform for a small B2B company?”Paraphrase“Which network traffic analysis tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top NDR platforms for a small team and how do they differ?”Budget-constrained“What is the best NDR platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a NDR platform. What should we look at?”Negative“Which NDR platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Sophos NDRno first choiceChangedSophos NDRCorelight Open NDRno first choiceagainst: Cisco Secure Network Analytics
Three alternatives
Awake Security, Darktrace, Sangfor Cyber CommandTwo alternatives
Darktrace, ExtraHop RevealXTwo alternatives
Muninn, Sophos NDRGPT-5.4 miniSophos NDRagainst: ExtraHop RevealX, Vectra AIPaessler PRTG Network Monitor, ntopngChangedagainst: Darktrace, SolarWinds NetFlow Traffic Analyzer, Vectra AIExtraHop RevealXagainst: Corelight Open NDR, NetScout, NetWitnessSophos NDRagainst: Rapid7 Next-Gen SIEM / InsightIDRno first choicenothing named
Two alternatives
Darktrace, FortiNDROne alternative
WiresharkFour alternatives
Cisco Secure Network Analytics, Darktrace, Fortinet FortiNDR, Vectra AIOne alternative
Bricata NDRGemini 3.5 FlashStellar Cyber Open XDRagainst: Corelight Open NDR, ExtraHop Reveal, Vectra AILumu TechnologiesChangedSophos NDRagainst: Corelight Open NDR, ExtraHop RevealXLumu Technologiesagainst: Darktrace, ExtraHop RevealX, Vectra AIBlackpoint Cyber, Huntress, Red Canaryagainst: Cisco Secure Network Analytics, Corelight Open NDR, Darktrace, ExtraHop Reveal, NetWitness
Three alternatives
Blumira, Darktrace, Seceon OTMThree alternatives
Auvik, Paessler PRTG Network Monitor, Seceon OTMFour alternatives
Darktrace, FortiNDR, Stellar Cyber Open XDR, Vectra AIFive alternatives
Blackpoint Cyber, Huntress, Security Onion, Stamus Security Platform, WazuhPerplexity SonarVectra AIManageEngine NetFlow AnalyzerChangedSecurity OnionSecurity Onionno first choicenothing named
One alternative
DarktraceThree alternatives
Auvik, Paessler PRTG Network Monitor, ntopngFour alternatives
Corelight Open NDR, Darktrace, ExtraHop Reveal, Vectra AITwo alternatives
Rapid7 InsightIDR, Stellar Cyber Open XDRGrok 4.1 FastSecurity Onionagainst: Darktrace, ExtraHop RevealX, Vectra AIPaessler PRTG Network MonitorChangedagainst: SolarWinds NetFlow Traffic AnalyzerSecurity Onionagainst: ExtraHop RevealX, Vectra AISecurity Onionagainst: Darktrace, ExtraHop RevealX, Vectra AIno first choiceagainst: Cisco Secure Network Analytics, Corelight Open NDR, Darktrace, ExtraHop RevealX, Fortinet FortiNDR, Palo Alto, Trellix NDR, Vectra AI
Three alternatives
Blumira, Corelight Open NDR, Trend Vision OneTwo alternatives
ManageEngine NetFlow Analyzer, ZabbixFour alternatives
Cisco Secure Network Analytics, Corelight Open NDR, Darktrace, Sophos NDRThree alternatives
Blumira, Corelight Open NDR, SolarWinds Security Event ManagerMistral Smallno first choiceManageEngine NetFlow AnalyzerChangedFlowmon, Sophos NDRagainst: ExtraHop RevealFortiSIEM, LogRhythm, SolarWinds Security Event Managerno first choiceagainst: Cisco Secure Network Analytics, Darktrace, ExtraHop RevealX, Progress WhatsUp Gold
Two alternatives
Rapid7 InsightIDR, Vectra AIDeepSeek V4 FlashSophos NDRagainst: Darktrace, ExtraHop RevealX, Vectra AIPaessler PRTG Network MonitorChangedCisco Secure Network Analytics, ManageEngine NetFlow Analyzeragainst: Corelight Open NDR, Darktrace, ExtraHop (Reveal(x)), Vectra AISophos NDRagainst: Cisco Secure Network Analytics, Darktrace, Vectra AISophos, WatchGuardagainst: Darktrace, ExtraHop RevealX, Vectra AIagainst: Cisco Secure, Corelight Open NDR, Darktrace, ExtraHop RevealX, Vectra AI
Two alternatives
Corelight Open NDR, Security OnionFour alternatives
ManageEngine NetFlow Analyzer, Wireshark, Zabbix, ntopngSeven alternatives
CrowdStrike Falcon, Fortinet FortiNDR, Huntress, Red Canary, Security Onion, SentinelOne Singularity, UnderDefense MAXIOne alternative
BlumiraOne alternative
Rapid7 InsightIDRLlama 4 Maverickno first choiceManageEngine NetFlow AnalyzerChangedno first choiceSecurity Onion, Suricata, Zeekno first choiceagainst: Darktrace, Fortinet FortiNDR, Trellix NDR
Two alternatives
Motadata, SolarWinds Network Performance MonitorOne alternative
SolarWinds Security Event ManagerQwen 3.7 FlashStellar Cyber Open XDRManageEngine NetFlow AnalyzerChangedCrowdStrike Falcon Insightagainst: Darktrace, Netskope, Security OnionMicrosoft Sentinel, VeloxNetagainst: Darktrace, Palo Altono first choiceagainst: Cisco, Fortinet FortiNDR, IBM QRadar, Palo Alto Networks, Snort, Splunk Enterprise Security, Suricata, Symantec Bluecoat, WatchGuard, Zeek
Three alternatives
Corelight Open NDR, Microsoft Defender for Endpoint, WazuhTwo alternatives
Paessler PRTG Network Monitor, WiresharkTwo alternatives
CyGlass, SentinelOne SingularityTwo alternatives
Huntress, WazuhKimi K2BlumiraPaessler PRTG Network MonitorChangedagainst: SolarWinds NPMMuninn, WatchGuard ThreatSync+ NDRSecurity Onionagainst: Darktrace, ExtraHop RevealX, Vectra AIno first choiceagainst: Cisco Secure Network Analytics, Corelight Open NDR, Darktrace, ExtraHop Reveal, Vectra AI
Two alternatives
Huntress, Security OnionTwo alternatives
ManageEngine OpManager, WiresharkThree alternatives
Corelight Open NDR, ExtraHop Reveal, Vectra AIFive alternatives
Awake Security, ManageEngine NetFlow Analyzer, Progress WhatsUp Gold, Suricata, ZeekGLM 4.7 FlashXBlumira, WatchGuard Total NDRagainst: Cisco Secure Network Analytics, Corelight Open NDR, Darktrace, ExtraHop Reveal, Vectra AIWiresharkChangedSecurity Onion, Verizon Network Detection and ResponseBlumiraagainst: Security Onionno first choicenothing named
Two alternatives
Heimdal EDR, Security OnionThree alternatives
ManageEngine NetFlow Analyzer, SolarWinds NetFlow Traffic Analyzer, ntopngEight alternatives
Alert Logic Cloud Insight, Cisco Secure Network Analytics, CrowdStrike Falcon Insight, Darktrace, Fortinet FortiNDR, Sangfor Cyber Command, Vectra AI, WatchGuard ThreatSync+ NDROne alternative
Corelight Open NDRMiniMax M2.5Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDRPaessler PRTG Network MonitorChangedagainst: ManageEngine OpManager, SolarWinds Network Performance MonitorSecurity Onionagainst: Darktrace, ExtraHop Reveal, Vectra AISecurity Onionagainst: Darktrace, Vectra AIno first choiceagainst: Darktrace, ExtraHop Reveal, Vectra AI
Two alternatives
Wireshark, ntopngThree alternatives
Cisco Secure Network Analytics, Microsoft Defender for Identity, Rapid7 InsightIDRTwo alternatives
Rapid7 InsightIDR, Stellar Cyber Open XDRGPT-6 LunaFortiNDRagainst: Defender for IdentityGoogle AnalyticsChangedDarktrace, Vectra AISecurity Onion Communityagainst: ExtraHop RevealX, Vectra AIno first choiceagainst: Corelight Open NDR, Darktrace, ExtraHop RevealX, Security Onion, Vectra AI NDR, Zeek + Suricata
Four alternatives
Arctic Wolf Aurora MDR, Arista NDR, Corelight Open NDR, ExtraHop RevealXMuse Glimmer 30BCorelight Open NDR, Security Onionagainst: Darktrace, ExtraHop RevealX, Vectra AIPaessler PRTG Network MonitorChangedSecurity OnionSecurity Onionagainst: Darktrace, Vectra AIno first choiceagainst: Arista Awake, Cisco Secure Network Analytics, Corelight Open NDR, Darktrace ActiveAI Security Platform, ExtraHop RevealX, Fortinet FortiNDR, Gigamon ThreatINSIGHT, Vectra AI Platform
Four alternatives
Blumira, StreamScan, Suricata, ZeekTwo alternatives
Wireshark, ntopngFour alternatives
Corelight Open NDR, Darktrace, ExtraHop RevealX, Vectra AISix alternatives
Corelight Open NDR, SolarWinds Security Event Manager, Sophos NDR, StreamScan, Suricata, ZeekBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:37 | yes | 9 | 6 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 22:59 | yes | 5 | 4 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:27 | yes | 13 | 24 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-05 01:08 | yes | 16 | 4 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:23 | yes | 19 | 16 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:52 | yes | 5 | 3 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:44 | yes | 20 | 34 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:47 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:46 | yes | 11 | 49 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:52 | yes | 23 | 25 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:02 | yes | 24 | 54 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 23:25 | yes | 5 | 16 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-05 00:27 | yes | 2 | 12 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 00:02 | yes | 18 | 27 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:54 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:52 | no | 0 | 3 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 23:05 | yes | 13 | 27 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-04 23:50 | yes | 20 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 01:38 | yes | 14 | 6 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:28 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 23:51 | yes | 23 | 34 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:10 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 01:45 | yes | 5 | 28 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:18 | yes | 14 | 15 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:44 | yes | 15 | 52 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:11 | no | 0 | 39 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-05 00:33 | yes | 2 | 17 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-04 22:18 | yes | 12 | 14 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:21 | yes | 9 | 7 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 22:40 | yes | 5 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 22:12 | yes | 15 | 33 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-04 23:54 | yes | 18 | 5 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 22:31 | yes | 16 | 12 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:46 | yes | 11 | 10 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 23:22 | yes | 19 | 71 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 00:58 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 01:57 | yes | 12 | 52 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:01 | yes | 18 | 31 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 23:01 | yes | 19 | 86 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 00:25 | yes | 14 | 50 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-05 00:05 | yes | 6 | 40 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-04 22:25 | yes | 24 | 39 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:28 | yes | 15 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:41 | yes | 4 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:21 | yes | 22 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-05 00:44 | yes | 16 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:27 | yes | 20 | 9 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:44 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 23:43 | yes | 24 | 28 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:02 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:33 | no | 0 | 34 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:59 | yes | 19 | 19 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:59 | yes | 22 | 35 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:39 | yes | 9 | 47 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-05 01:35 | yes | 2 | 12 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 00:46 | yes | 11 | 18 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:17 | no | 0 | 8 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:47 | no | 0 | 6 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:39 | yes | 12 | 27 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-04 22:41 | yes | 18 | 9 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 22:46 | yes | 23 | 11 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:22 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:54 | yes | 21 | 56 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:48 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:39 | no | 0 | 24 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 01:35 | yes | 23 | 29 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:40 | yes | 10 | 35 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:55 | yes | 5 | 12 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-05 01:14 | yes | 3 | 25 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 01:33 | yes | 15 | 22 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:06 | yes | 17 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:38 | no | 0 | 3 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:41 | yes | 23 | 27 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-05 01:03 | yes | 15 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:08 | yes | 16 | 9 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 23:51 | yes | 16 | 8 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:46 | yes | 23 | 61 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:45 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:43 | no | 0 | 30 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:59 | yes | 22 | 26 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 01:27 | yes | 22 | 55 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:05 | yes | 17 | 47 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-04 22:22 | yes | 3 | 22 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-04 22:53 | yes | 15 | 38 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Cisco Secure Network Analytics / Stealthwatch read as Cisco Secure Network Analytics
Cisco Stealthwatch read as Cisco Secure Network Analytics
Corelight read as Corelight Open NDR
Corelight (with Zeek/Stamus) read as Corelight Open NDR
CrowdStrike Falcon Insight XDR read as CrowdStrike Falcon
ExtraHop read as ExtraHop RevealX
Fortinet read as Fortinet FortiNDR
PRTG read as Paessler PRTG Network Monitor
PRTG Network Monitor read as Paessler PRTG Network Monitor
SentinelOne read as SentinelOne Singularity
Stellar Cyber read as Stellar Cyber Open XDR
Trellix read as Trellix NDR
Trend Micro read as Trend Vision One
Vectra read as Vectra AI
Unresolved, counted raw
ADAudit Plus
Arista Awake
Azure Network Watcher
Bricata NDR
CloudCover
CyGlass
Exeon
Fortinet's FortiNDR Cloud
Garland Technology
Heimdal EDR
InsightIDR
Ntop
Rapid7 Next-Gen SIEM
Rapid7 Next-Gen SIEM / InsightIDR
Security Onion Community
Stamus
Stamus Security Platform
Stellar
Symantec Bluecoat
UnderDefense MAXI MDR
Vectra AI NDR
Vectra AI Platform
VeloxNet
WatchGuard Total NDR
Discontinued, still offered
No shut-down product was recommended here.