Which managed service providers are strongest on cybersecurity?
Managed IT for Cybersecurity: The Providers The Shortlist Report Finds
Arctic Wolf appeared in 45.0% of 269 AI responses to this question, ahead of everyone else.
Arctic Wolf leads
Arctic Wolf comes up more than any other firm on this question, by a clear margin.
Arctic Wolf121 of 269
Provides managed detection and response and security operations services to mid-market and enterprise clients.
eSentire100 of 269
24/7 SOC, managed detection and response, threat hunting, and incident response for enterprises.
Sophos94 of 269
Offers managed detection and response with 24/7 threat monitoring and response capabilities for SMBs and mid-market organizations already using Sophos security products.
IBM81 of 269
Manages enterprise infrastructure, hybrid cloud operations, security, and IT modernization for large organizations with complex environments.
Red Canary70 of 269
Provides detection engineering, threat hunting, and 24/7 managed threat response to security-focused organizations.
+5 more namedin the table
Based on 269 ChatGPT responses to this question, collected August 8, 2026–October 1, 2026. Firms are counted once per response. How we measure.
The ranking
| Firm | Responses | Share | |
|---|---|---|---|
| Tier 1 stands alone | |||
| Arctic Wolfarcticwolf.comProvides managed detection and response and security operations services to mid-market and enterprise clients. | 121 of 269 | 45.0% | |
| Tier 2 2 firms, 34.9–37.2% | |||
| eSentireesentire.com24/7 SOC, managed detection and response, threat hunting, and incident response for enterprises. | 100 of 269 | 37.2% | |
| Sophossophos.comOffers managed detection and response with 24/7 threat monitoring and response capabilities for SMBs and mid-market organizations already using Sophos security products. | 94 of 269 | 34.9% | |
| Tier 3 4 firms, 24.2–30.1% | |||
| IBMManages enterprise infrastructure, hybrid cloud operations, security, and IT modernization for large organizations with complex environments. | 81 of 269 | 30.1% | |
| Red Canaryredcanary.comProvides detection engineering, threat hunting, and 24/7 managed threat response to security-focused organizations. | 70 of 269 | 26.0% | |
| Secureworkssecureworks.comProvides managed detection and response and threat intelligence services for enterprise security operations. | 69 of 269 | 25.7% | |
| Expelexpel.comProvides SOC/MDR services with analyst-driven alert investigation and response for organizations needing 24/7 threat detection. | 65 of 269 | 24.2% | |
| Tier 4 3 firms, 20.4–23.0% | |||
| LevelBluelevelblue.comProvides managed security services, threat intelligence, and SOC capabilities to large enterprises globally. | 62 of 269 | 23.0% | |
| NTTProvides global managed security, networks, cloud, and data center services for large multinational enterprises. | 61 of 269 | 22.7% | |
| Rapid7rapid7.comOffers managed detection and response, vulnerability management, and security operations services. | 55 of 269 | 20.4% | |
Key findings
- Arctic Wolf leads this sample alone, named in 121 of 269 ChatGPT responses (45.0%) to the question “Which managed service providers are strongest on cybersecurity?”, collected August 8, 2026–October 1, 2026.
- 10 firms cleared the reporting threshold on “Which managed service providers are strongest on cybersecurity?” in ChatGPT as of October 1, 2026; the full table with response counts is below.
- IBM appears in 4 of the 16 managed IT service providers reports published by The Shortlist Report, the widest coverage of any firm named on this page.
- No firm paid to appear in this ranking; placement cannot be bought, and the counts come from ChatGPT responses rather than from submissions.
Why the tiers fall where they do
Tier 1 holds Arctic Wolf, named in 121 of 269 ChatGPT responses (45.0%). No other firm in this sample comes close enough to be grouped with it.
Tier 2 holds eSentire and Sophos, named in 94 to 100 of 269 responses (34.9–37.2%). The sample does separate these firms from the tier above: the difference from the leading group is larger than the margin of error, which is what puts them in a tier of their own.
Tier 3 holds IBM, Red Canary, Secureworks and Expel, named in 65 to 81 of 269 responses (24.2–30.1%). The sample does separate these firms from the tier above: the difference from the leading group is larger than the margin of error, which is what puts them in a tier of their own.
Tier 4 holds LevelBlue, NTT and Rapid7, named in 55 to 62 of 269 responses (20.4–23.0%). The sample does separate these firms from the tier above: the difference from the leading group is larger than the margin of error, which is what puts them in a tier of their own.
The test is McNemar’s at 95%, applied against the same 269 responses for every firm. The full reasoning, and what happened when we ranked one-to-N instead.
What the sample shows
Arctic Wolf leads on its own, named in 121 of the 269 responses to this question (45.0%).
421 firms were named at least once across the sample. 10 of them cleared the threshold of 2 responses and appear above; the rest were named once and are inside the noise.
How to read this
Firms are grouped into tiers, not ranked one to fifteen. A tier holds every firm whose 95% confidence interval overlaps the leader's, which is a long way of saying the sample cannot tell them apart. Order within a tier is arbitrary — read the counts, not the position.
Share is the percentage of responses that named the firm — not a quality score. A firm scoring low here may be excellent and simply under-written about online, which is a finding about its visibility rather than its work.
The same question was asked repeatedly because AI assistants do not answer identically twice. A single response would tell you almost nothing.
What this measurement does not tell you
- It is not a quality ranking. Share reflects how much has been written about a firm online, which is what an AI assistant reads. A capable firm nobody writes about scores low here.
- It is a reading from a date range, not a permanent standing. This sample was collected August 8, 2026–October 1, 2026; models change and so do their answers.
- It covers ChatGPT only. Other assistants answer differently, and we do not extrapolate across engines we have not measured.
- Order within a tier is arbitrary. Read the counts, not the position. Why we use tiers.
Cite this report
The Shortlist Report. (2026). Managed IT for Cybersecurity: The Providers The Shortlist Report Finds. The Shortlist Report. https://www.shortlistreport.com/article/best-msp-cybersecurity
Underlying counts: CSV · JSON. Every answer they were counted from: plain text · JSON. All reusable under CC BY 4.0 with attribution.