Every category where a model named UnderDefense for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant	Since September 2026
Penetration testing as a service	Security operations	4%	5 of 82	0%	11	accepted challenger	▲+3Since September 2026: 2% → 5%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
AI SOC agents	Security operations	4%	6 of 104	0%	4	under 10 labels · led by Dropzone AI at 24%
Data loss prevention	Security operations	2%	12 of 89	0%	5	under 10 labels · led by Microsoft Purview DLP at 46%	newNew since September 2026: not ranked then, 2% now.
SIEM platforms	Security operations	0%	49 of 61	0%	1	under 10 labels · led by Microsoft Sentinel at 38%

Movement

Since September 2026, UnderDefense held within the floor in all four categories: no change cleared 11 points.

Best category · PTaaS · by segment

Small business=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

2%from 2% in September 2026

Inside the floor by 11 pointsRank 7 → 8 of 71

Mid-market▲+3Since September 2026: 2% → 5%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

5%from 2% in September 2026

Inside the floor by 8 pointsRank 7 → 5 of 74

Enterprise=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

0%from 0% in September 2026

Inside the floor by 11 pointsRank 23 → 25 of 63

All categories · Mid-market

Category	September 2026	Now	Change	Reading	Rank
PTaaS	2%	5%	▲+3Since September 2026: 2% → 5%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.	Within noise	Rank 7 → 5 of 82
DLP	0%	2%	newNew since September 2026: not ranked then, 2% now.	New this edition	Rank 12 of 89, unchanged
AI SOC agents	0%	2%	newNew since September 2026: not ranked then, 2% now.	New this edition	Rank 6 of 104, unchanged
SIEM	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 49 of 61, unchanged

Shares here are read over the models both editions asked, so they can differ by a point or two from the standing above, which counts every model in this edition.

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured · The editions

By model

How each model treated UnderDefense across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.

ShowHide

Model	First choice	Alternative	Mention	Labels
Claude Haiku 4.5	0	0	1	1
GPT-5.4 mini	0	0	0	0
Gemini 3.5 Flash	0	4	0	4
Perplexity Sonar	0	0	0	0
Grok 4.20	0	0	0	0
Mistral Small	0	1	0	1
DeepSeek V4 Flash	1	2	0	3
Llama 4 Maverick	1	0	0	1
Qwen 3.7 Flash	0	0	0	0
Kimi K2	0	0	1	1
GLM 4.7 FlashX	1	1	2	4
MiniMax M2.5	1	0	0	1
GPT-6 Luna	0	0	0	0
Muse Glimmer 30B	1	3	1	5

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct22 labels8

Paraphrase9 labels1

Comparative11 labelsNone

Budget-constrained20 labels3

Scale-constrained4 labelsNone

Negative2 labelsNone

First choiceAlternativeMentionNegative68 labels in all, every segment counted; 12 of the 12 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“If you want a fully managed, hands-off approach with compliance support: Choose UnderDefense into your budget (best ROI).” DeepSeek V4 Flash · AI SOC agents · direct prompt · first choice

“I'd recommend BreachLock or UnderDefense as they specifically target mid-market companies” MiniMax M2.5 · PTaaS · direct prompt · first choice

“UnderDefense – best for lean security staff who want an overlay, no forced SIEM replacement” Muse Glimmer 30B · AI SOC agents · direct prompt · first choice

“UnderDefense or Cobalt offer the best balance of pricing, quality, and scalability” GLM 4.7 FlashX · PTaaS · direct prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

No model argued against it.

Named alongside

The products named in the same answers as UnderDefense, over the 68 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and UnderDefense was named but was not.

ShowHide

ProductSame answerTook the first choice insteadHead to head

Cobalt20 of 686Compare →

BreachLock18 of 682Compare →

Astra Security15 of 684Compare →

Dropzone AI14 of 686Not among the top eight

Bright Defense11 of 684Not among the top eight

Intezer AI SOC11 of 682Not among the top eight

NetSPI9 of 682Not among the top eight

Synack9 of 682Compare →

Radiant Security9 of 681Not among the top eight

Prophet Security8 of 680Not among the top eight

A head-to-head page exists where both products are among a category's top eight. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named UnderDefense. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 68 of the 68 answers that named UnderDefense and are not a share of its labels.

Domains cited

underdefense.comYour site59

techrepublic.com18

brightdefense.com16

defendify.com16

g2.com15

swimlane.com15

deepstrike.io14

intezer.com14

synack.com14

beaglesecurity.com13

135 of the 194 domain citations in answers naming UnderDefense came from somebody else's page.

Pages cited

underdefense.com/blog/penetration-testing-services23

techrepublic.com/article/best-penetration-testing-companies17

defendify.com/blog/penetration-testing-companies14

synack.com/blog/best-penetration-testing-companies14

brightdefense.com/resources/best-penetration-testing-companies-for-soc-2-compliance12

swimlane.com/blog/best-ai-soc-platforms11

underdefense.com/blog/ai-soc-for-smb11

underdefense.com/blog/most-affordable-ai-soc-platforms11

Pages are listed as the models cited them.

Search and answers

underdefense.com is not in Google's top ten for any of the category's searches. In the answers, UnderDefense takes 4% of first choices and Cobalt takes 45%.

ShowHide

In search

Google, US estimates

Position for “penetration testing service”

–

not in the top ten

Position for “penetration testing services”

–

not in the top ten

Searches for its name, Google: 170 a month (“underdefense”)
AI search demand for its name, est.: 1 a month
Organic visits to its site: about 11,823 a month
Searches its site ranks for: 2,493 · 127 in the top three
Sites linking to it: 1,102
Paid Google search: No ads found in the estimate; that does not mean it runs none

Ads on GoogleDetailLess

40 ads · 37 text, 3 image · 10 shown in the last 30 days

First shown November 2023, as Underdefense LLC, verified. Ads started 2025-10 to 2026-09: 26 in the year, 14 before.

On Google's pages: 1 2 3 4

In answers

This edition

Share of first choices

rank 5 of 82 in ptaas

Segment leader

45%

Cobalt

First choices: 12 across its categories
Named in: 68 answers
Its own site cited: in 68 of the answers that named it

Search figures are US estimates from DataForSEO, read September 28, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.

What it publishes

ShowHide

Addresses on underdefense.com

670

subdomains included

Content

531

counted in the table below

Documentation

Product · Integration

10 · 0

Kind	Pages	Last 90 days	Latest	Categories named
Blog	405	59	2026-09-29	SIEM, MDR
Comparison	48	8	2026-08-30	MDR, SIEM
Report or ebook	22	0	2025-12-10
Webinar or virtual event	15	1	2026-09-09	EDR, Compliance automation
Template or tool	15	2	2026-07-16	SIEM
Case study	13	2	2026-08-20	SIEM, MDR
Conference or event	5	1	2026-09-22
Glossary or explainer	5	0	2026-03-11	EDR, SIEM
Podcast or video	3	undated

Most recent

2026-09-29Best managed cybersecurity services blog
2026-09-23How the best socs spend less time on alerts and more on judgment blog
2026-09-22Cybersecurity events 2026 the 14 conferences still ahead this year conference or event
2026-09-10How aitm phishing bypasses mfa and why phishing resistant mfa would have stopped it blog
2026-09-092027 security operating model webinar webinar or virtual event
2026-08-31Why is my siem generating too many false positives blog

Events in person

Upcoming

November 17, 2026 to November 20, 2026Microsoft IgniteMoscone Center, San Francisco, United States · attends
November 19, 2026ISC2 SECURE LondonLondon, U.K. · attends
November 30, 2026 to December 4, 2026AWS re:InventLas Vegas, United States · attends
December 7, 2026 to December 9, 2026Gartner Identity & Access Management SummitLas Vegas, United States · attends
December 7, 2026 to December 10, 2026Black Hat EuropeExCeL, London, U.K. · attends
December 14, 2026 to December 19, 2026SANS Cyber Defense InitiativeGrand Hyatt Washington, Washington, United States · attends

Last twelve months

October 24, 2026 to October 28, 2026ISC2 Security CongressGaylord Rockies Resort & Convention Center, Aurora, United States · attended
October 13, 2026 to October 15, 2026GovWareSands Expo and Convention Centre, Singapore, Singapore · attended
October 11, 2026 to October 15, 2026InfoSec WorldGaylord Palms Resort & Convention Center, Orlando, United States · attended
October 7, 2026 to October 9, 2026Wild West Hackin’ FestDeadwood, United States · attended
October 6, 2026 to October 8, 2026SecTorMetro Toronto Convention Centre, Toronto, Canada · attended
September 28, 2026NYC Security Leadership SummitMidtown Manhattan, New York City, United States · took part
September 22, 2026 to September 24, 2026Gartner Security & Risk Management SummitExCeL, London, U.K. · attended

As the event pages on underdefense.com state them, read September 28, 2026.

How it is countedHide how it is counted

Every page underdefense.com exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.

Names read as UnderDefense

What the judge wrote, as written, with how often. The vendor table decides that these count as UnderDefense; a claim can dispute any of them.

UnderDefense (MAXI AI SOC) 1UnderDefense (MAXI/Agentic SOC) 1

Follow UnderDefense

An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.

Already following? Everything you follow, with a stop for each.

The company

UnderDefense is its own company.

ShowHide

In its own words

Stated by the vendor, not checked

Positioning: Agentic AI SOC & Compliance Automation Platform
underdefense.com
For: IT leaders and teams
underdefense.com
Price stated: Pay only for the services you actually need, with no hidden costs. underdefense.com
Starting price: 11 per device per month underdefense.com/platform
Free plan or trial: Try it Free underdefense.com
Integrations claimed: 250 underdefense.com
Certifications: ISO 27001 CertifiedSOC 2 Type II CompliantISO 27001SOC 2GDPR
Customers named: archaea.energyInvicti Security
Not stated on the pages read: Hosting

What UnderDefense's own pages state, read September 28, 2026: underdefense.com, underdefense.com/pricing, trust.underdefense.com, underdefense.com/platform, underdefense.com/integrations. A claimed page can correct any of them.

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when UnderDefense's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as UnderDefense, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

What a new claim receivesHide what a new claim receives

A new claim receives the current edition's vendor brief for UnderDefense by email, built from the raw record of the edition. It shows:

where UnderDefense is named, by buyer and by framing, and which cells hold its first choices;
the claims the models make when they name it, ranked, with the strongest and the weakest quoted;
its vocabulary against the segment leader's, and the pages the models cited;
who was chosen in the answers that did not name UnderDefense, and every reason the record gives;
a battlecard for each top rival: the head-to-head split, why they win, and the reservation quoted against them;
one page of published figures cleared to show a buyer.