Which managed service providers are strongest on cybersecurity?
Managed IT for Cybersecurity: The Providers The Shortlist Report Finds
2 firms lead, appearing in 43.8–51.7% of 89 AI responses. The sample cannot separate them, so we do not pretend it can.
Two firms lead
Arctic Wolf and Expel come up most often here. They are close enough together that the order between them is not worth reading anything into.
Arctic Wolf46 of 89
Provides managed detection and response and security operations services to mid-market and enterprise clients.
Expel39 of 89
Provides SOC/MDR services with analyst-driven alert investigation and response for organizations needing 24/7 threat detection.
Based on 89 ChatGPT responses to this question, collected August 8, 2026–August 19, 2026. Firms are counted once per response. How we measure.
The ranking
| Firm | Responses | Share | |
|---|---|---|---|
| Tier 1 2 firms, 43.8–51.7% | |||
| Arctic Wolfarcticwolf.comProvides managed detection and response and security operations services to mid-market and enterprise clients. | 46 of 89 | 51.7% | |
| Expelexpel.comProvides SOC/MDR services with analyst-driven alert investigation and response for organizations needing 24/7 threat detection. | 39 of 89 | 43.8% | |
| Tier 2 2 firms, 37.1–42.7% | |||
| eSentireesentire.com24/7 SOC, managed detection and response, threat hunting, and incident response for enterprises. | 38 of 89 | 42.7% | |
| Red Canaryredcanary.comProvides detection engineering, threat hunting, and 24/7 managed threat response to security-focused organizations. | 33 of 89 | 37.1% | |
| Tier 3 6 firms, 18.0–30.3% | |||
| Sophossophos.comOffers managed detection and response with 24/7 threat monitoring and response capabilities for SMBs and mid-market organizations already using Sophos security products. | 27 of 89 | 30.3% | |
| IBMManages enterprise infrastructure, hybrid cloud operations, security, and IT modernization for large organizations with complex environments. | 23 of 89 | 25.8% | |
| SecureworksProvides managed detection and response and threat intelligence services for enterprise security operations. | 22 of 89 | 24.7% | |
| LevelBluelevelblue.comProvides managed security services, threat intelligence, and SOC capabilities to large enterprises globally. | 20 of 89 | 22.5% | |
| Vciso Groupvciso.center | 18 of 89 | 20.2% | |
| Accentureaccenture.comProvides managed IT, cloud, cybersecurity, and digital transformation services to large enterprises. | 16 of 89 | 18.0% | |
Key findings
- Arctic Wolf and Expel lead this sample, each named in 43.8–51.7% of 89 ChatGPT responses to the question “Which managed service providers are strongest on cybersecurity?”, collected August 8, 2026–August 19, 2026.
- The gaps between Arctic Wolf and Expel are inside the margin of error at 89 responses, so The Shortlist Report groups them in one tier rather than ranking them against each other.
- 10 firms cleared the reporting threshold on “Which managed service providers are strongest on cybersecurity?” in ChatGPT as of August 19, 2026; the full table with response counts is below.
- IBM appears in 4 of the 15 managed IT service providers reports published by The Shortlist Report, the widest coverage of any firm named on this page.
- No firm paid to appear in this ranking; placement cannot be bought, and the counts come from ChatGPT responses rather than from submissions.
Why the tiers fall where they do
Tier 1 holds Arctic Wolf and Expel, named in 39 to 46 of the 89 ChatGPT responses. They are grouped rather than ranked because the gaps between them are inside the margin of error at this sample size — one extra mention would reorder them, so an order would be reporting noise as a finding.
Tier 2 holds eSentire and Red Canary, named in 33 to 38 of 89 responses (37.1–42.7%). The sample does separate these firms from the tier above: the difference from the leading group is larger than the margin of error, which is what puts them in a tier of their own.
Tier 3 holds Sophos, IBM, Secureworks, LevelBlue, Vciso Group and Accenture, named in 16 to 27 of 89 responses (18.0–30.3%). The sample does separate these firms from the tier above: the difference from the leading group is larger than the margin of error, which is what puts them in a tier of their own.
The test is McNemar’s at 95%, applied against the same 89 responses for every firm. The full reasoning, and what happened when we ranked one-to-N instead.
What the sample shows
2 firms lead this question: Arctic Wolf and Expel. They appear in 43.8–51.7% of the 89 responses. The gaps between them are inside the margin of error at this sample size, so they are listed together rather than ranked against each other.
205 firms were named at least once across the sample. 10 of them cleared the threshold of 2 responses and appear above; the rest were named once and are inside the noise.
How to read this
Firms are grouped into tiers, not ranked one to fifteen. A tier holds every firm whose 95% confidence interval overlaps the leader's, which is a long way of saying the sample cannot tell them apart. Order within a tier is arbitrary — read the counts, not the position.
Share is the percentage of responses that named the firm — not a quality score. A firm scoring low here may be excellent and simply under-written about online, which is a finding about its visibility rather than its work.
The same question was asked repeatedly because AI assistants do not answer identically twice. A single response would tell you almost nothing.
What this measurement does not tell you
- It is not a quality ranking. Share reflects how much has been written about a firm online, which is what an AI assistant reads. A capable firm nobody writes about scores low here.
- It is a reading from a date range, not a permanent standing. This sample was collected August 8, 2026–August 19, 2026; models change and so do their answers.
- It covers ChatGPT only. Other assistants answer differently, and we do not extrapolate across engines we have not measured.
- Order within a tier is arbitrary. Read the counts, not the position. Why we use tiers.
Cite this report
The Shortlist Report. (2026). Managed IT for Cybersecurity: The Providers The Shortlist Report Finds. The Shortlist Report. https://www.shortlistreport.com/article/best-msp-cybersecurity
Underlying counts: CSV · JSON. Every answer they were counted from: plain text · JSON. All reusable under CC BY 4.0 with attribution.