AirMDR has grown quickly over the past 18 months: ARR is up 373%, our customer base is up 186%, and seven of our eight most recent customers switched from another MDR provider. Our NPS is 69, based on responses from 84% of customers since April. See our recent press release for more (link to AirMDR Momentum Press Release).
The numbers are impressive, and the pattern behind them is even more interesting.
Security teams are asking harder questions about what they actually get from MDR. They want faster investigations, of course. They also want to know whether the investigation was good, whether the conclusion is supported by evidence, how much of the work was really done by AI, and what role the MDR provider’s people played.
That is a big change in MDR buyer expectations.
A year or two ago, simply saying “AI-powered” could make an MDR provider sound different. That bar is moving quickly.
The recently published 2026 Gartner Market Guide for Managed Detection and Response expects AI to take on a much larger share of MDR investigation and response work, while human expertise remains an integral part of the service. It also puts agentic processes directly into the MDR evaluation conversation, advising buyers to look at how automation and AI improve the results they receive.
That fits what we are seeing in the market.
Security teams are becoming less interested in whether a provider uses AI somewhere behind the scenes. They care more about what the AI actually accomplishes. Did it investigate the alert? Did it gather the right evidence? Did it reach a sound conclusion? Did it reduce or even eliminate the work the customer has to do once they get the write-up?
It is a much higher standard than adding an AI assistant to an MDR that’s still mostly run by human analysts.
A second recent Gartner report, AI Operational Measurement Is Essential to MDR Outcome-Based Pricing Models, goes deeper on how MDR performance should be measured. It argues that speed will become less differentiating as AI spreads, while quality, coverage, autonomy, and impact become more important ways to judge the service.
That lines up with AirMDR service investments: broader coverage across the security stack, better detection-and-response outcomes, and more transparency into how the service performs. One area we’ve pushed especially hard on is investigation quality.
Yes, we measure how quickly investigations are completed, but we also want to know whether the investigation itself was complete, clear, well-supported, and actionable.
That thinking led us to build SOC Grader, an open-source tool that evaluates investigation write-ups against a published rubric covering the investigation plan, evidence, context, rationale, and next steps.
The goal is simple: make investigation quality something security teams can actually examine and measure.
For years, MDR customers have been implicitly asked by MDR providers to trust the process. An alert comes in, then a case comes back. But the customer has limited visibility into what happened between the two.
AI gives MDR providers the opportunity to change that. The investigation can preserve the evidence gathered, the reasoning applied, the actions taken, and the basis for the conclusion.
AirMDR’s approach has been to make that work visible. Our cases show the evidence behind the investigation and the reasoning that led to the verdict and recommended actions. Our free FAST tool gives security teams a way to test that experience on their own alerts before becoming a customer.
And there is another level of transparency beyond the individual case: how well is the MDR service itself performing?
As AI takes on more work, customers should increasingly be able to see things like:
Recent analyst research points in this direction as well, particularly for AI-first MDR providers that can turn internal AI performance data into metrics customers can actually see and use.
For AirMDR, that presents an opportunity to extend “shows you its work” from the individual investigation to the performance of the service as a whole.
Customers switching to AirMDR are giving us a consistent signal.
They want AI to do more of the operational work. They still want humans involved where expertise, judgment, and accountability matter. They want broader visibility across their security stack. And they want evidence that the MDR service is delivering high-quality results. Momentum press release blog (Pu…
For us, that means continuing to invest in agentic monitoring, detection, investigation, and response; continuing to measure investigation quality; and finding better ways to show customers how the system is performing.
The next phase of MDR will be judged less by the AI claims a provider makes and more by the work its AI can show.