TL;DR
- Gartner named Expel a Representative Vendor for the eighth consecutive time in the 2026 Gartner® Market Guide for Managed Detection and Response.
- The Gartner Market Guide predicts that by 2029, 90% of initial MDR findings will be handled with AI support and no human action.
- We feel that Gartner still draws a hard line: MDR is a human-led service, and AI MDR offerings aren’t the same thing.
- SaaS coverage is now something Gartner says belongs on your evaluation criteria.
- You can read the full report here.
The opening introduction of the Gartner MDR report of MDR picked up two words this year: MDR services now provide customers with “remotely delivered, AI-augmented, human-led, turnkey, modern SOC functions, ultimately delivering cyberattack disruption and containment.”¹
This year’s description specifies MDR is AI-augmented and human-led, and the rest of the report spends 22 pages working out what that combination actually has to look like in practice.
The 2029 number we think everyone’s going to quote
“By 2029, 90% of initial findings from MDR providers will be processed and addressed with the support of AI models without any human action, up from 30% today.”²
Read that next to the definition and you get the tension every MDR buyer is about to spend a year sorting out. Machines will do more of the processing, but humans still own the service. In our opinion, Gartner puts it plainly in a callout: “MDR must be people-focused, human-led, AI-augmented and anchored in the evidence of the successes and outcomes it delivers.”³
We’ve been building toward exactly that since before it was a market requirement. Ruxie™, our AI SOC manager, triages and enriches alerts before an analyst touches them, runs investigative steps, and documents outcomes. Our analysts make the calls that carry consequences. That’s AI in the human loop, and the 14-minute mean time to remediate (MTTR) on fully automated high and critical incidents is what it buys you.
The mandatory feature list got longer
This year’s required features make a useful checklist when you’re comparing providers side by side. Gartner now includes:
- A provider-hosted and provider-operated shared technology stack that “enables and coordinates real-time threat detection, investigation and active mitigating response.”⁴
- “24/7 staffing that recognises customer-specific cyber-risk-based use cases, engages daily with individual customer data, and has skills and expertise in threat monitoring, detection and hunting, threat intelligence (TI) and remote response.”⁵
- Immediate remote mitigative response, investigation, and containment “beyond alerting and notification, delivered and coordinated by service providers’ staff and preapproved by end users.”⁶
- “Triaging, investigating and managing responses to all discovered threats, regardless of priority… There must be no limitations on volumes or time dedicated to the discovery and investigation process.”⁷
That last one is new, and it’s the one worth asking hard questions about. Plenty of providers cap what they’ll investigate, either explicitly in the contract or quietly through tiering. We don’t. Our analysts work 2,450+ proprietary detections across nine attack surfaces and 160+ coverage options, and you can see every one of those actions in Expel Workbench™.
SaaS coverage moved onto the evaluation checklist
We think Gartner is direct about this one: “SaaS coverage in particular is now a key differentiator for MDR services and should be added to MDR buyers’ evaluation criteria.”⁸ The reasoning is that buyers run payroll, HR, ERP, and collaboration through SaaS, and understanding how attackers operate in those environments is complex, time-consuming work that’s a good candidate to hand off.
If your provider’s SaaS story stops at “we ingest the logs,” that’s worth probing before you renew.
Gartner insights on AI MDR
This is the part we’d point every buyer to:
“Offerings entering the marketspace in 2026 already include some solutions that position themselves as AI MDR; however, Gartner maintains that MDR is a human-led service that engages daily with individual customer data, and has skills and expertise in threat monitoring… Throughout this process, consumers should demand clarity regarding which services are AI-augmented and which continue to rely on the insights of cyberthreat analysts.”⁹
Download the full report and use it to ask better questions of everyone on your shortlist.
¹ Gartner, Market Guide for Managed Detection and Response, Andrew Davies, Angel Berrios, Eric Ahlm, Darren Livingstone, Craig Lawson, 9 September 2026.
² ibid., p. 2
³ ibid., p. 10
⁴ ibid., p. 3
⁵ ibid., p. 3
⁶ ibid., p. 3
⁷ ibid., p. 4
⁸ ibid., p. 8
⁹ ibid., p. 12
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Frequently asked questions
What did Gartner change in its MDR definition for 2026?
Gartner added “AI-augmented” to its definition of MDR, which now describes MDR as providing remotely delivered, AI-augmented, human-led, turnkey, modern SOC functions.
How many times has Expel been named a Representative Vendor by Gartner?
Eight consecutive times, as of the 2026 Gartner® Market Guide for Managed Detection and Response.
Does Gartner endorse specific MDR vendors?
No. Gartner explicitly states it does not endorse any vendor, product, or service depicted in its research, and doesn’t advise buyers to select vendors based solely on designations like “Representative Vendor.”
Does Gartner categorize AI MDR the same as traditional MDR?
No. Gartner maintains that MDR is fundamentally a human-led service and cautions buyers to demand clarity about which parts of a service are AI-augmented and which rely on human analysts.
