| Category | Function | Share | Rank | Negative rate | Labels | Quadrant | Since September 2026 |
|---|---|---|---|---|---|---|---|
| Endpoint protection | IT operations and endpoint | 3% | 9 of 86 | 0% | 3 | under 10 labels · led by Microsoft Defender for Endpoint at 22% | ▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked. |
| Digital employee experience | IT operations and endpoint | 2% | 26 of 219 | 0% | 1 | under 10 labels · led by ControlUp at 13% |
| Category | September 2026 | Now | Change | Reading | Rank |
|---|---|---|---|---|---|
| DEX | 0% | 2% | newNew since September 2026: not ranked then, 2% now. | New this edition | Rank 26 of 219, unchanged |
| Endpoint protection | 0% | 2% | ▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked. | Within noise | Rank 21 → 9 of 86 |
Shares here are read over the models both editions asked, so they can differ by a point or two from the standing above, which counts every model in this edition.
The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured · The editions
| Model | First choice | Alternative | Mention | Negative | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 1 | 0 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 1 | 1 | 0 | 0 | 2 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.20 | 0 | 0 | 0 | 0 | 0 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 0 | 0 | 0 | 0 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 0 | 0 | 0 | 0 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 1 | 0 | 0 | 0 | 1 |
Verbatim evidence the judge attached to positive labels.
“Do you already pay for Microsoft 365 Business Premium? *Yes:* Start with Microsoft Defender. It is highly effective and already paid for.” Gemini 3.5 Flash · Endpoint protection · paraphrase prompt · first choice
“the best fit is usually Microsoft Defender for Business / Defender for Endpoint if you already use Microsoft 365” GPT-5.4 mini · DEX · budget prompt · first choice
“Microsoft Defender for Business / Defender for Endpoint is the cost-effective default.” Muse Glimmer 30B · Endpoint protection · direct prompt · first choice
“The Best "Ecosystem" Choice ... The Caveat: Defender can be notoriously complex to configure and manage” Gemini 3.5 Flash · Endpoint protection · direct prompt · alternative
Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.
Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 4 of the 4 answers that named Microsoft Defender for Business / Defender for Endpoint and are not a share of its labels.
Fifteen of the fifteen domain citations in answers naming Microsoft Defender for Business / Defender for Endpoint came from somebody else's page.
Pages are listed as the models cited them.
An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.
Already following? Everything you follow, with a stop for each.
What Microsoft Defender for Business / Defender for Endpoint's own pages state, read October 6, 2026: microsoft.com/en/customers/story/18747-sodertalje-kommun-microsoft-defender-for-endpoint, microsoft.com/en/customers/story/1725749919506701185-jll-defender-for-endpoint-realestate-en-united-states. A claimed page can correct any of them.
Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Microsoft Defender for Business / Defender for Endpoint's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Microsoft Defender for Business / Defender for Endpoint, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.
A new claim receives the current edition's vendor brief for Microsoft Defender for Business / Defender for Endpoint by email, built from the raw record of the edition. It shows: