Trellix
Trellix sells XDR and endpoint security, born from the McAfee Enterprise and FireEye merger.
On the record
Checkpoint: Federal and DoD renewal decisions following the May 2026 source-code breach disclosure
The call
Trellix is a mid-pack XDR vendor with fading share, a fresh executive team, and an unresolved breach, standing in a market three bigger rivals already control.
Trellix makes software that helps security teams sort through computer attack warnings and automate responses. The problem: CrowdStrike, Palo Alto Networks, and Microsoft already do this better and sell to more customers, and all three are building AI helpers that do the sorting automatically, which makes Trellix's core job less valuable. The company's only real advantage left is old relationships with the U.S. government and military and 25 years of data on computer threats, but those edges are getting smaller. Watch whether government customers stay loyal after a May 2026 hack of Trellix's own source code and whether the company's leadership overhaul (most executives replaced in 18 months) slows the slide.
Why
01
AI pressure: CrowdStrike Charlotte AI, Microsoft Security Copilot, SentinelOne Purple AI. These agents automate the alert triage and SOC playbook work Trellix sells, at lower cost and tighter integration. Could AI do the core job? Yes, likely.
02
Bigger players: CrowdStrike, Palo Alto Networks (Cortex XDR), Microsoft Defender. These three hold 50 to 60 percent of XDR share while Trellix's EPP mindshare slipped from 3.9 to 3.4 percent. Could a giant copy it? Yes, easily.
03
What protects it. Long-standing FedGov and DoD contracts plus 25 years of threat telemetry, though both are thinner than rivals' and now clouded by an unresolved breach.
What would change this call
Publication of a completed forensic report on the May 2026 RansomHouse source-code breach. Shows whether Trellix can close out the incident credibly or leaves trust unresolved.
Federal/DoD contract renewals or losses reported over the next 2-3 quarters. Shows whether the breach and leadership churn are eroding Trellix's government base.
Any STG banker hire, refinancing, or strategic-review leak regarding Trellix. Would indicate a private equity exit or fire-sale rather than continued independent investment.
Federal/DoD contract renewals or losses reported over the next 2-3 quarters. Shows whether the breach and leadership churn are eroding Trellix's government base.
Any STG banker hire, refinancing, or strategic-review leak regarding Trellix. Would indicate a private equity exit or fire-sale rather than continued independent investment.
Key numbers
- EPP mindshare fell 3.9% to 3.4% YoY
- Trellix XDR share sits at 0.8% vs CrowdStrike's 9.3%
- Job postings down 63% YoY
Named risks
- Unresolved source-code breach with no published forensic close as of June 2026.
- Near-total C-suite turnover within 18 months (CEO, CTO, CPO, CHRO, CRO).
- Sub-1% XDR mindshare and declining EPP mindshare against dominant CrowdStrike, Palo Alto, Microsoft.
- PE ownership since 2022 with no disclosed refinancing or exit path, raising sale/fire-sale uncertainty.
- Vendor-only, unverified efficiency claims for Trellix Wise versus independently benchmarked rivals.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| CrowdStrike | losing to | CrowdStrike Falcon holds 9.3% XDR mindshare vs Trellix's 0.8% as of June 2026, per PeerSpot |
| Palo Alto Networks (Cortex XDR) | losing to | Cortex XDR holds 4.6% mindshare vs Trellix's 0.8% as of June 2026, per PeerSpot |
| Microsoft Defender/Security Copilot | losing to | Bundled free with E5 licensing, giving Microsoft distribution advantage Trellix lacks |
| SentinelOne | contesting | Purple AI competes directly with Trellix Wise for AI-driven SOC automation as of April 2026 |
| CrowdStrike (overall market) | gaining on | CrowdStrike's own mindshare fell from 16.7% to 9.3% YoY through June 2026, narrowing gap slightly |
Questions people ask
- Is Trellix profitable in 2026?
- Trellix is privately held by Symphony Technology Group and files no public financials, so profitability is unknown. Third-party revenue estimates range widely from $1.1B (Growjo) to $1.8-1.9B (ZoomInfo) as of June 2026, but these are unaudited estimates, not confirmed figures.
- Could AI replace Trellix's core product?
- Trellix's core value, alert triage and SOC automation, is exactly what agentic AI tools like CrowdStrike's Charlotte AI and SentinelOne's Purple AI target. Trellix's own Trellix Wise (launched May 2, 2024) competes in the same space but sits on a smaller commercial mindshare base than rivals.
- Who owns Trellix?
- Trellix is owned by private equity firm Symphony Technology Group (STG), which formed it in January 2022 by merging McAfee Enterprise (bought for $4B in July 2021) with FireEye's products business (bought for $1.2B in June 2021).
- How does Trellix compare to CrowdStrike?
- As of July 2026, PeerSpot data shows CrowdStrike Falcon holds 9.3% XDR mindshare (down from 16.7% YoY) versus Trellix XDR's 0.8% (up from 0.2% YoY). Trellix's endpoint (EPP) mindshare fell from 3.9% to 3.4% YoY as of May 2026, per PeerSpot.
- What happened with the Trellix data breach?
- Trellix confirmed unauthorized access to a source code repository in late April or early May 2026; ransomware group RansomHouse claimed credit on May 7, 2026, and posted alleged screenshots of appliance-management access. As of early-to-mid June 2026, no full forensic report had been published.
- Why did Trellix lose so many executives?
- Vishal Rao became CEO in January 2025, succeeding Bryan Palma, while also continuing to run sister company Skyhigh Security. Between March and May 2026, Trellix announced a new CTO (Joe Chen), CPO (Alex Au Yeung), CHRO (Zach Nelson), and CRO (Natalie Polson), a near-complete leadership overhaul within about 18 months.
Timeline
- 2026-06-29PeerSpot reports Trellix XDR mindshare at 0.8%, up from 0.2% YoY, versus CrowdStrike Falcon at 9.3%
- 2026-05-26PeerSpot reports Trellix EPP mindshare at 3.4%, down from 3.9% YoY
- 2026-05-24Breach report describes Trellix as serving over 53,000 customers across 185 countries
- 2026-05-18Trellix appoints Natalie Polson as Chief Revenue Officer
- 2026-05-08Trellix confirms source-code repository breach; RansomHouse claimed credit May 7, 2026
- 2026-03-02Trellix announces new CTO, CPO, CHRO and touts 50,000+ customers
- 2025-01-01Vishal Rao becomes Trellix CEO, succeeding Bryan Palma
- 2024-05-02Trellix Wise GenAI hyper-automation layer launches
- 2022-01-01Trellix formed from merger of McAfee Enterprise and FireEye product business
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Trellix (2026-07-12)
- Trellix Strengthens Executive Leadership Team to Accelerate Cyber Resilience Vision (2026-03-02)
- Trellix Source Code Breached by RansomHouse (2026-05-24)
- Trellix - Overview, News & Similar companies (2026-06-28)
- Revenue, Competitors, Alternatives
- How many employees work at Trellix? (2025-11-30)
- Leadership at Trellix: How Are the Managers at Trellix? 2026 (2026-05-19)
- Trellix Welcomes New CEO to Lead Next Phase of Growth (2026-04-07)
- Trellix Wise Delivers GenAI Powered Hyper Automation for Threat Detection and Response (2024-05-02)
- Trellix Accelerates Growth in First 100 Days (2026-05-18)
- Palo Alto Networks (US), Microsoft (US), CrowdStrike (US), SentinelOne (US) and Trend Micro (Japan)
- CrowdStrike Falcon vs Trellix XDR (2026) (2026-06-29)