Which managed detection and response providers do ChatGPT, Gemini and Google AI recommend? (October 2026)
When US buyers ask AI engines which managed detection and response provider to choose, the shortlist is short and stable. Arctic Wolf was named most often, in 46 of 56 answers (82.1%), followed by Sophos (43) and CrowdStrike (41). All 56 answers named at least one firm, and 42 different firms were named in total, 22 of them only once.
By Frederik Jakobsen, founder of Danish Lead Co and SourceRank AI. Measured 10 October 2026, published October 2026.
The firms AI named most often
Share of all 56 answers that named the firm as a provider, and how many answers on each engine named it. An answer counts once per firm however often it repeats the name.
100.0%
Answers that named at least one provider firm: 56 of 56. Every answer named firms.
42 firms
Distinct firms named across all 56 answers. 22 of them were named in only one answer.
41.3%
Share of all 315 firm mentions taken by the three most named firms, Arctic Wolf, Sophos and CrowdStrike.
| # | Firm | Answers naming it | Engines | ChatGPT of 12 | Gemini of 12 | Copilot of 8 | AI Mode of 12 | AI Overviews of 12 |
|---|---|---|---|---|---|---|---|---|
| 1 | Arctic Wolf | 46 of 56 82.1% | 5 of 5 | 10 | 10 | 5 | 12 | 9 |
| 2 | Sophos | 43 of 56 76.8% | 5 of 5 | 9 | 6 | 4 | 12 | 12 |
| 3 | CrowdStrike | 41 of 56 73.2% | 5 of 5 | 9 | 7 | 5 | 10 | 10 |
| 4 | Red Canary | 25 of 56 44.6% | 5 of 5 | 7 | 8 | 2 | 3 | 5 |
| 5 | SentinelOne | 23 of 56 41.1% | 5 of 5 | 4 | 5 | 3 | 5 | 6 |
| 6 | Rapid7 | 20 of 56 35.7% | 4 of 5 | 6 | 4 | 0 | 7 | 3 |
| 7 | Expel | 19 of 56 33.9% | 5 of 5 | 6 | 5 | 5 | 1 | 2 |
| 8 | Huntress | 19 of 56 33.9% | 5 of 5 | 4 | 5 | 4 | 3 | 3 |
| 9 | eSentire | 16 of 56 28.6% | 4 of 5 | 9 | 4 | 2 | 0 | 1 |
| 10 | Palo Alto Networks | 8 of 56 14.3% | 4 of 5 | 3 | 2 | 0 | 1 | 2 |
| 11 | ESET | 8 of 56 14.3% | 5 of 5 | 1 | 2 | 2 | 2 | 1 |
| 12 | Microsoft (Defender Experts) | 5 of 56 8.9% | 3 of 5 | 3 | 1 | 0 | 1 | 0 |
| 13 | Bitdefender | 4 of 56 7.1% | 2 of 5 | 0 | 0 | 0 | 2 | 2 |
| 14 | Ontinue | 3 of 56 5.4% | 2 of 5 | 0 | 1 | 2 | 0 | 0 |
| 15 | Mandiant | 3 of 56 5.4% | 2 of 5 | 0 | 0 | 0 | 2 | 1 |
Top 15 of 42 firms. Engine columns show answers naming the firm out of that engine's measured answers. Firms with the same count are listed in the order the data was read.
What the answers show
- +Arctic Wolf (46 of 56 answers, 82.1%), Sophos (43) and CrowdStrike (41) took 41.3% of all firm mentions, the most concentrated of the ten categories measured on 10 October.
- +Only 42 different firms were named, the fewest of the ten categories measured on 10 October. A new MDR provider is competing for a handful of slots, not a long list.
- +Both Google engines named Sophos in every answer: 12 of 12 on AI Mode and 12 of 12 on AI Overviews. ChatGPT and Gemini named Arctic Wolf most.
- +Analyst and review sites matter here more than anywhere else: gartner.com was the most cited domain, in 18 of 41 answers with sources, and directory, review or analyst sites were cited in 23.
What each engine named
The most named firm per engine.
| Engine | Answers | Named a provider | Distinct firms | Most named firm on that engine |
|---|---|---|---|---|
| ChatGPT | 12 | 12 of 12 100.0% | 25 | Arctic Wolf (10 of 12) |
| Gemini | 12 | 12 of 12 100.0% | 17 | Arctic Wolf (10 of 12) |
| Microsoft Copilot | 8 | 8 of 8 100.0% | 15 | Arctic Wolf, CrowdStrike, Expel (5 of 8) |
| Google AI Mode | 12 | 12 of 12 100.0% | 14 | Arctic Wolf, Sophos (12 of 12) |
| Google AI Overviews | 12 | 12 of 12 100.0% | 21 | Sophos (12 of 12) |
First-pick agreement: in 10 of the 12 questions where at least two engines named a firm, two or more engines named the same firm first. Arctic Wolf was named by 5 of 5 engines.
The sources behind the recommendations
Most cited domains in the 41 answers that showed a source list. Gartner leads by a wide margin.
| # | Cited domain | Kind | Answers citing it |
|---|---|---|---|
| 1 | gartner.com | Directory, review or analyst site | 18 of 41 43.9% |
| 2 | sentinelone.com | A named firm's own website | 8 of 41 19.5% |
| 3 | kaseya.com | A named firm's own website | 7 of 41 17.1% |
| 4 | g2.com | Directory, review or analyst site | 7 of 41 17.1% |
| 5 | rapid7.com | A named firm's own website | 7 of 41 17.1% |
| 6 | cybersecuritynews.com | Other (blogs, listicles, publishers, other vendors) | 7 of 41 17.1% |
| 7 | corporatevision-news.com | Other (blogs, listicles, publishers, other vendors) | 6 of 41 14.6% |
| 8 | defendify.com | A named firm's own website | 6 of 41 14.6% |
| 9 | cipherssecurity.com | Other (blogs, listicles, publishers, other vendors) | 5 of 41 12.2% |
| 10 | intezer.com | Other (blogs, listicles, publishers, other vendors) | 5 of 41 12.2% |
| 11 | eye.security | Other (blogs, listicles, publishers, other vendors) | 4 of 41 9.8% |
| 12 | sophos.com | A named firm's own website | 4 of 41 9.8% |
Out of the 41 answers that carried a source list (89 distinct domains). Sources per engine: ChatGPT 0 of 12, Gemini 10 of 12, Copilot 8 of 8, AI Mode 11 of 12, AI Overviews 12 of 12.
| Source kind | Answers citing at least one |
|---|---|
| Other (blogs, listicles, publishers, other vendors) | 33 of 41 80.5% |
| A named firm's own website | 27 of 41 65.9% |
| Directory, review or analyst site | 23 of 41 56.1% |
| Community forum | 3 of 41 7.3% |
| Social and video | 1 of 41 2.4% |
An answer can cite several kinds, so the rows do not sum to the total. "A named firm's own website" means the domain matches the name of a firm named in this category.
What the named firms have in common
Eight of the ten most named firms had their own website cited by at least one engine, and analyst coverage (Gartner) is the most cited source. The named firms are the ones with both: vendor pages the engines can quote and third-party analyst validation.
How a firm in this category gets named
Being named depends on what the engines read. In this category, of the 41 answers that showed their sources, 27 cited a named firm's own website and 23 cited a directory, review or analyst site. Gartner Peer Insights and G2 reviews are read directly by the engines in this category. A provider outside the top names needs review volume on those platforms and pages that answer the specific buyer situations (Microsoft 365 environments, healthcare, incident response retainers) the questions ask about. This is the work SourceRank AI does, described on the services page. The free site readiness check shows whether your site is structurally ready to be cited; it checks your site, it does not measure answers like the ones on this page. To see where your own firm stands in these answers, book a call.
Exactly what was measured
| Parameter | Value |
|---|---|
| Date | 10 October 2026, one run |
| Buyer questions | 12, each phrased as a buyer asking for a provider, varied by size, budget, situation and switching. Full list below |
| Answer engines | 5: ChatGPT, Gemini, Microsoft Copilot, Google AI Mode, Google AI Overviews |
| Engine cells | 60. One question on one engine |
| Answers measured | 56 of 60. The denominator for every share on this page. 4 Copilot answers were written for a buyer outside the US, a side effect of the third-party service we query Copilot through, and are excluded |
| Market | United States, English. Google AI Mode and AI Overviews were queried with a US location. ChatGPT, Gemini and Copilot were not given a location, the same as in our client measurement runs; Copilot answers that assumed a buyer abroad are excluded |
| Sources | Cited sources come from Gemini, Copilot, Google AI Mode and Google AI Overviews. ChatGPT's answers in this run came back without a machine-readable source list, so ChatGPT is not in the source tables |
| Firm extraction | One language model call per answer listed the firms the answer named as providers, excluding directories, publications, citation labels and tools. Names were normalised and aliases merged. A hand check of 20 answers across the study is reported on the hub page |
| Not measured | Location personalisation for the chat engines, logged-in or personalised sessions, run-to-run variation (this is a single run, and the same question asked again can return different firms), and model versions, which change without notice |
All 12 buyer questions
- Best managed detection and response providers for mid-size companies
- Which MDR provider should a 500-employee company choose?
- Top MDR services for companies without an in-house security team
- We are replacing our MSSP. Which managed detection and response provider should we switch to?
- Best affordable MDR provider for a small business
- Which managed SOC providers offer the best 24/7 monitoring for mid-market companies?
- Recommend an MDR provider for a healthcare organization
- Best MDR services for Microsoft 365 and Azure environments
- Top managed detection and response companies for manufacturing companies
- Which MDR vendors have the fastest response times?
- Best MDR provider that also offers incident response retainer
- What are the top-rated managed detection and response providers in the US?
Cite this research
Journalists, analysts and writers are welcome to quote, chart and republish the figures on this page. Please credit SourceRank AI and link to this page as the source. For the underlying data, a comment from Frederik Jakobsen or a category we have not covered, see the press page.
Suggested citation
SourceRank AI (2026). Which managed detection and response providers do ChatGPT, Gemini and Google AI recommend? Measured 10 October 2026. https://sourcerankai.com/research/who-ai-recommends/managed-detection-and-response-providers/
Link to copy
<a href="https://sourcerankai.com/research/who-ai-recommends/managed-detection-and-response-providers/">Which managed detection and response providers do ChatGPT, Gemini and Google AI recommend? (SourceRank AI, October 2026)</a>Where to go next
All 22 category studies
Who AI recommends across 22 B2B categories, with the cross-category findings and the full method.
What AI engines cite by industry
The source mix behind AI answers in ten industries, from our September 2026 measurement runs.
AEO for this industry
What we do for firms in this space, and the questions their buyers ask AI.
Common questions
Which managed detection and response providers does ChatGPT recommend?
In this October 2026 run ChatGPT named Arctic Wolf most often, in 10 of its 12 answers. Across all five engines the most named were Arctic Wolf (46 of 56 answers), Sophos (43) and CrowdStrike (41).
Do ChatGPT, Gemini and Google AI recommend the same managed detection and response providers?
Partly. Arctic Wolf was named by 5 of the 5 engines, and in 10 of the 12 questions at least two engines named the same firm first. Below the top few names the lists diverge: 22 of the 42 firms were named in only one answer.
How was this measured?
12 buyer questions asking for managed detection and response providers were put once to ChatGPT, Gemini, Microsoft Copilot, Google AI Mode and Google AI Overviews on 10 October 2026, from a US English context. 56 answers were measured, and the firms each answer named as providers were extracted and counted once per answer. It is a single run, and the same question asked again can return different firms.