Every category where a model named ThreatDown EDR for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant
Endpoint detection and response	Security operations	0%	16 of 54	30%	10	criticized challenger

Movement

This is the first edition on this tier, so no move can be computed for ThreatDown EDR yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated ThreatDown EDR across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.

Model	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	2	1	0	3
GPT-5.4 mini	0	0	0	0
Gemini 3.5 Flash	0	1	0	1
Perplexity Sonar	0	1	1	2
Grok 4.1 Fast	0	0	0	0
Mistral Small	1	0	1	2
DeepSeek V4 Flash	0	0	0	0
Llama 4 Maverick	0	0	1	1
Qwen 3.7 Flash	0	0	0	0
Kimi K2	0	0	0	0
GLM 4.7 FlashX	1	0	0	1
MiniMax M2.5	0	0	0	0

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct2 labelsNone

Paraphrase1 labelNone

Comparative2 labelsNone

Budget-constrained7 labels1

Scale-constrained0 labelsNone

Negative4 labelsNone

First choiceAlternativeMentionNegative16 labels in all, every segment counted; 1 of the 1 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Pricing starts at $5.75 per endpoint per month with a minimum of five endpoints, making it affordable for almost any small business.” Claude Haiku 4.5 · EDR · budget prompt · alternative

“ThreatDown had the highest composite score in Info-Tech's 2026 EDR Data Quadrant at 9.1, ahead of CrowdStrike at 9.0” Claude Haiku 4.5 · EDR · direct prompt · alternative

“best lightweight EDR for small businesses, offering strong protection with simple deployment and affordable” Mistral Small · EDR · budget prompt · alternative

“ThreatDown (from $345/year) | Very low minimum; lightweight and easy to deploy.” GLM 4.7 FlashX · EDR · budget prompt · alternative

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“it appears that FireEye's EDR and Malwarebytes EDR are not recommended” Llama 4 Maverick · EDR · negative prompt · hard negative

“Users and experts have flagged Malwarebytes EDR as something to avoid.” Mistral Small · EDR · negative prompt · hard negative

“direct negative sentiment toward FireEye EDR and Malwarebytes EDR, but these are anecdotal Reddit comments, so they should be treated as low-confidence signals” Perplexity Sonar · EDR · negative prompt · soft negative

Named alongside

The products named in the same answers as ThreatDown EDR, over the 16 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and ThreatDown EDR was named but was not.

ProductSame answerTook the first choice insteadHead to head

Huntress Managed EDR11 of 165Not in the top three

Bitdefender GravityZone9 of 160Not in the top three

Microsoft Defender for Cloud7 of 166Not in the top three

SentinelOne Singularity7 of 161Not in the top three

Microsoft Defender for Endpoint4 of 161Not in the top three

CrowdStrike Falcon4 of 160Not in the top three

Sophos Intercept X4 of 160Not in the top three

Cynet3 of 160Not in the top three

Elastic Security3 of 160Not in the top three

CrowdStrike2 of 160Not in the top three

A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named ThreatDown EDR. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 15 of the 16 answers that named ThreatDown EDR and are not a share of its labels.

Domains cited

huntress.com11

cnicsolutions.com9

learn.g2.com9

cyberpress.org8

acronis.com6

gbhackers.com6

reddit.com6

decryptiondigest.com5

bellatorcyber.com4

cybersecuritynews.com4

Sixty-eight of the sixty-eight domain citations in answers naming ThreatDown EDR came from somebody else's page.

Pages cited

learn.g2.com/best-edr-software9

cyberpress.org/edr-solutions-by-business-size8

huntress.com/internal-it-cybersecurity-guide/best-endpoint-protection-for-small-businesses8

cnicsolutions.com/cybersecurity-threat-protection/best-endpoint-protection-edr-solutions-f7

acronis.com/en/blog/posts/best-edr-endpoint-detection-and-response-solutions-in-20266

cnicsolutions.com/cybersecurity-threat-protection/detection-response/best-endpoint-protect6

gbhackers.com/best-edr-solutions-compared6

cybersecuritynews.com/best-edr-solutions4

Pages are listed as the models cited them.

Names read as ThreatDown EDR

What the judge wrote, as written, with how often. The vendor table decides that these count as ThreatDown EDR; a claim can dispute any of them.

ThreatDown 4Malwarebytes EDR 3Malwarebytes ThreatDown (with EDR) 1ThreatDown (formerly Malwarebytes for Teams) 1

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when ThreatDown EDR's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as ThreatDown EDR, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at threatdown.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.