A fully operationalized SOC — not an alerting layer — with incident response and digital forensics included as standard

IRVINE, Calif., Aug. 25, 2026 /PRNewswire/ — LMNTRIX, a global managed detection and response company, today announced that it has been positioned in the Major Players category in the IDC MarketScape: Worldwide MDR/MXDR for the Enterprise 2026 Vendor Assessment (Doc #US54792426, August 2026).

There have never been more security vendors, more tools or more money spent on defense. Breach volumes have not fallen in response. Attackers now operationalize intrusions in hours, while the operating model most managed security services run on has not materially changed in twenty-five years.

The recognition reflects a security operations model LMNTRIX has spent more than a decade building around a single question: if an attacker gets through the controls an organization already has, what does the operation need to find the intrusion, understand what happened and finish the job? Rather than treating alerts from the existing security stack as the limit of what can be detected, LMNTRIX deploys independent detection layers behind those controls and correlates evidence across endpoint, network, identity, cloud, email, mobile, operational technology, deception, threat intelligence and attack validation, allowing multiple sources to validate one another.

According to the IDC MarketScape, “LMNTRIX’s most differentiated capability is its systematic approach to surfacing true positives that customers’ existing endpoint, firewall, email, and web security tools have not identified.” Of that approach, the report states: “This directly addresses the structural problem that log-based detection can struggle with against real-world attacks.” In 2025, approximately 74% of confirmed LMNTRIX incidents were detected through the company’s own proprietary detections rather than alerts raised by a customer’s existing controls.

“The market does not need another service that watches the same controls, waits for those controls to produce an alert, and then forwards the alert to the customer. Visibility is useful, but visibility is not the same thing as finding an attacker. We built LMNTRIX around the opposite assumption: something will get through, it may already be inside, and our responsibility begins where the existing controls stop,” said Carlo Minassian, Founder and Chief Executive Officer of LMNTRIX.

Detecting What Existing Controls Miss

Logs remain important for audit, compliance, investigation and reconstruction, and LMNTRIX uses them. But the company’s architecture does not assume that the record produced by a security control is sufficient to find what that same control failed to identify. If a sensor is absent, disabled, bypassed or unable to observe a step in an attack, downstream analytics cannot recreate evidence that was never captured. Context is the second limit. A log records that an action occurred, not whether it should have. A legitimate administrator and an intruder using that administrator’s stolen credentials can produce the same log entry.

LMNTRIX therefore operationalizes defense in depth as a set of independent detection layers that work together as one system. Endpoint telemetry can be validated against network activity. Identity behavior can be correlated with cloud events. Automated threat hunts run hourly across covered customer environments, alongside analyst-driven, hypothesis-led hunting for dormant persistence and low-signal tradecraft that behavioral analytics alone may not surface. Deception can expose lateral movement that conventional controls did not flag. Threat intelligence and dark web sources can add external context, while automated attack validation continuously tests whether deployed controls can detect safely emulated attacker techniques.

The objective is not to replace every control a customer already owns. It is to create a detection architecture that does not depend entirely on those controls being right the first time. That cross-validation is what exposes the fragments of a multi-stage attack that are easy to miss when viewed separately.

One Platform. One Accountability.

LMNTRIX architected and developed its hyper-converged XDR platform organically rather than assembling it through acquisitions. Its 13 integrated modules operate through a common service, data and security-operations model. Every module is deployed, managed, patched and upgraded by LMNTRIX, removing the handoff gaps that emerge across fragmented multivendor security operations.

That architecture is designed to simplify a problem that has become increasingly complex for security teams: too many tools, too many consoles, too many isolated detections and too many points where responsibility can shift between vendors and teams. LMNTRIX can operate as an extension of an internal security team, as the operator that takes over and augments the tools a customer already owns, or as a complete SOC-as-a-service where there is no internal team to extend.

Agentic AI is used where it improves speed and consistency, but it is not treated as a substitute for judgment. LMNTRIX operates two purpose-built agents: Artemis, which correlates telemetry and automates investigation steps, and LISA, which reconstructs attack timelines and explains incidents in plain language. Human analysts are retained in the decision path for the work that requires context, validation and accountability.

“Every enterprise is going to need agentic MDR. The speed of AI-assisted attacks makes manual investigation alone unsustainable. But an agent is only as good as what it can see. Point agents — or autonomous SOCs — at the same telemetry that failed to reveal the intrusion, and they will miss it faster and with more confidence. The architecture has to find the threat first, and no agent replaces accountability when a real incident is unfolding,” Carlo Minassian said.

An Alert Is Unfinished Work

LMNTRIX is built around another principle that distinguishes its operating model: detection is the beginning of the job, not the end of it. Customers receive analyst-validated incidents rather than untriaged alerts. The service then investigates, contains and documents those incidents, with remote incident response, digital forensics, malware analysis and threat hunting included as part of the standard service rather than activated only after a separate retainer or incident-based engagement.

Across confirmed incidents in 2025, LMNTRIX reported a mean time to detect of under one minute and resolution within 30 minutes for more than 90% of incidents. The company reports a 99% customer retention rate and multiyear renewals. These are company-reported figures and are not attributed to IDC.

“An alert is unfinished work. It is a question, not an answer, and we do not send our customers homework — not an alert to chase, not a dashboard to watch, not a report that leaves the answer to them. When a threat is real, we carry the incident through resolution, then show the customer what has to change. That is the difference between monitoring a queue and defending an environment,” said Hamlet Khodaverdian, Co-Founder and Vice President of LMNTRIX.

LMNTRIX describes this as extreme ownership: the provider, not the customer, carries the incident to the end. That closed-loop approach — detection, investigation, response and resilience — makes the service an extension of the customer’s security team rather than another source of tickets, and each incident informs the practical changes that strengthen the environment afterward.

Incident Response Included

The service is priced on a per-asset basis without analyst-hour or per-incident charges for included response activities. Incident response, DFIR and threat hunting are bundled into a fixed annual commitment, removing the risk of cost escalation at the moment a customer needs the provider most. Coverage is deployed in phases rather than all at once. Customers typically begin with the capability that closes their most urgent gap and extend across the remaining modules on the same platform and the same agreement.

The company is privately held, founder-led and has been built without venture capital or private equity investment. That structure has allowed LMNTRIX to take a long-term approach to platform development, investing in proprietary detection, multi-vector telemetry and response capabilities for more than a decade rather than relying on acquisition-led assembly or optimizing for short-term investor expectations.

A Fully Operationalized SOC, Not an Alerting Layer

LMNTRIX describes what it delivers as a fully operationalized security operations center rather than an alerting layer: 24×7 monitoring, hourly automated threat hunts, hypothesis-led threat hunting that continuously produces new detections, deception, attack validation, incident response and digital forensics, operated as a single service. LMNTRIX supports industrial control systems, extending the same detection and response model into the OT, SCADA and ICS environments that critical infrastructure operators run alongside their corporate networks. The service reaches enterprise, critical infrastructure and public-sector customers through a partner-led delivery model. In June 2026, CAI, an LMNTRIX partner, was awarded a statewide contract with the Virginia Information Technologies Agency to provide Security Operations Center services to eligible local government entities across the Commonwealth. CAI identified LMNTRIX as the MDR platform supporting continuous threat monitoring and rapid incident response within its delivery model.

“The IDC MarketScape placement validates the model, but customers do not buy category placement. They buy a provider that finds the threat their existing controls and logs did not reveal and takes ownership of the incident at 2 a.m. If the customer still has to finish the job, it was never truly managed,” Hamlet Khodaverdian said.

About the IDC MarketScape

IDC MarketScape vendor assessment model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market. The research utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each supplier’s position within a given market. IDC MarketScape provides a clear framework in which the product and service offerings, capabilities and strategies, and current and future market success factors of technology suppliers can be meaningfully compared. The framework also provides technology buyers with a 360-degree assessment of the strengths and weaknesses of current and prospective suppliers.

About LMNTRIX

LMNTRIX is a global cybersecurity company delivering MDR/MXDR services through its proprietary XDR platform, headquartered in Irvine, California. Built around an Active Defense and Assume Breach philosophy, the LMNTRIX platform combines 13 natively integrated security modules across endpoint, network, cloud, identity, email, mobile and operational technology environments. LMNTRIX validates, investigates, contains and remediates threats, with remote incident response and digital forensics included as standard. The company is privately held and founder-led. LMNTRIX maintains ISO/IEC 27001 certification, has validated its compliance with PCI DSS, and has completed a SOC 2 examination. For more information, visit www.lmntrix.com.

LMNTRIX: Be the Hunter, Not the Prey

Put your existing defenses to the test. Request a complimentary LMNTRIX evaluation: https://www.lmntrix.com
Follow us: Blog/Labs | LinkedIn

Media Inquiries

press@lmntrix.com
888-388-1879

View original content to download multimedia:https://www.prnewswire.com/news-releases/lmntrix-positioned-as-a-major-player-in-2026-idc-marketscape-for-worldwide-mdrmxdr-for-the-enterprise-302858070.html

SOURCE LMNTRIX