Every category where a model named Microsoft Defender XDR for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant
Extended detection and response	Security operations	63%	1 of 61	11%	57	endorsed leader
Endpoint detection and response	Security operations	0%	25 of 54	33%	3	under 10 labels · led by Bitdefender GravityZone at 20%
Security awareness training	Security operations	0%	52 of 65	0%	1	under 10 labels · led by KnowBe4 at 42%

Movement

This is the first edition on this tier, so no move can be computed for Microsoft Defender XDR yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Microsoft Defender XDR across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	0	1	1	0	2
GPT-5.4 mini	3	1	0	2	6
Gemini 3.5 Flash	2	2	0	0	4
Perplexity Sonar	2	1	0	1	4
Grok 4.1 Fast	2	2	2	0	6
Mistral Small	2	2	1	0	5
DeepSeek V4 Flash	4	1	0	1	6
Llama 4 Maverick	2	0	2	0	4
Qwen 3.7 Flash	3	3	2	1	9
Kimi K2	3	1	1	1	6
GLM 4.7 FlashX	3	1	0	0	4
MiniMax M2.5	2	1	1	1	5

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct28 labels19

Paraphrase26 labels14

Comparative35 labels9not counted in share

Budget-constrained27 labels17

Scale-constrained20 labels2

Negative27 labels2not counted in share

First choiceAlternativeMentionNegative163 labels in all, every segment counted; 52 of the 63 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“If you already pay for M365 Business Premium / E5: Use Microsoft Defender XDR. It is functionally free for your budget because it is already bundled.” Gemini 3.5 Flash · XDR · budget prompt · first choice

“Microsoft Defender XDR - an industry-leading XDR platform that provides unified investigation and response capabilities across various assets.” Llama 4 Maverick · XDR · paraphrase prompt · first choice

“If you're on Microsoft 365 E5: Start with Defender XDR—it's cost-effective, scales well for mid-market... best overall value” Grok 4.1 Fast · XDR · direct prompt · first choice

“Microsoft Defender XDR is generally the best default recommendation due to its cost-efficiency and deep integration” GLM 4.7 FlashX · XDR · paraphrase prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Vendor-native suites if you are not already standardized on that vendor: Microsoft Defender XDR is especially compelling in Microsoft 365 estates... outside those contexts, fit can be much weaker.” Perplexity Sonar · XDR · negative prompt · soft negative

“strong integration value, but reviewers report false positives, alert grouping issues, and a UI that can be non-intuitive” GPT-5.4 mini · EDR · negative prompt · soft negative

“frequently cited by smaller or purely security-focused teams as having a complex deployment curve” Qwen 3.7 Flash · XDR · negative prompt · soft negative

“strong in Microsoft-heavy environments, but can be noisy and less flexible outside that ecosystem” GPT-5.4 mini · XDR · negative prompt · soft negative

Named alongside

The products named in the same answers as Microsoft Defender XDR, over the 163 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Microsoft Defender XDR was named but was not.

ProductSame answerTook the first choice insteadHead to head

Palo Alto Networks Cortex XDR99 of 16311Not in the top three

SentinelOne Singularity97 of 1635Compare →

CrowdStrike Falcon64 of 1637Not in the top three

Trend Vision One53 of 1630Not in the top three

Stellar Cyber47 of 1633Not in the top three

Coro46 of 16326Compare →

CrowdStrike Falcon XDR41 of 1634Not in the top three

Cisco XDR35 of 1630Not in the top three

Sophos Intercept X29 of 1632Not in the top three

Bitdefender22 of 1631Not in the top three

A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Microsoft Defender XDR. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 142 of the 163 answers that named Microsoft Defender XDR and are not a share of its labels.

Domains cited

gbhackers.com99

cyberpress.org98

paloaltonetworks.com80

cybersecuritynews.com75

decryptiondigest.com55

esecurityplanet.com49

gartner.com49

guideflow.com46

g2.com34

sentinelone.com34

619 of the 619 domain citations in answers naming Microsoft Defender XDR came from somebody else's page.

Pages cited

cyberpress.org/xdr-platforms-by-business-size95

gbhackers.com/best-xdr-platforms-compared93

paloaltonetworks.com/cyberpedia/xdr-solutions67

cybersecuritynews.com/best-xdr-platforms63

decryptiondigest.com/blog/best-xdr-platforms-202653

gbhackers.com/best-managed-xdr-compared52

esecurityplanet.com/products/xdr-security-solutions49

guideflow.com/blog/xdr-platform46

Pages are listed as the models cited them.

Names read as Microsoft Defender XDR

What the judge wrote, as written, with how often. The vendor table decides that these count as Microsoft Defender XDR; a claim can dispute any of them.

Microsoft Defender 3Microsoft 365 Defender 1Microsoft Defender Suite 1Microsoft Defender XDR (via Microsoft 365 E5) 1

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Microsoft Defender XDR's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Microsoft Defender XDR, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at microsoft.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.