Trustwave
Managed security and compliance services provider, now a brand inside LevelBlue.
On the record
Checkpoint: LevelBlue ships an AI-agentic MDR product and Q4 2026 headcount numbers land
The call
Trustwave has real government credentials but sits inside a PE-owned rollup that has cut headcount nearly in half while AI-native rivals and cloud giants close in on its core business.
Trustwave watches for cyber attacks and responds to security alerts for customers, but now operates inside LevelBlue, a private equity-owned bundle of security companies. The company is hard to replace because it has real certifications (FedRAMP, StateRAMP) and partnerships with Microsoft, but it faces three big problems: Microsoft, CrowdStrike, and Sophos already offer similar watching services built into their own software; new AI companies are automating the alert-checking work that used to require human analysts and made money for Trustwave; and a lawsuit is testing whether Trustwave can be sued if it misses security alerts. The one thing that could turn this around is if LevelBlue builds AI tools that do the alert-checking better and cheaper than pure automation alone, and can actually sell those tools at a price that makes money.
Why
01
AI pressure: AI-native agentic MDR entrants like Daylight AI. These startups automate tier-1 alert triage, the human labor hours Trustwave bills for, threatening its pricing model directly. Could AI do the core job? Yes, likely.
02
Bigger players: Microsoft (MXDR/Defender/Sentinel) and CrowdStrike (Falcon Complete). Microsoft and CrowdStrike ship native managed detection bundled into platforms customers already own, undercutting standalone MDR vendors like Trustwave. Could a giant copy it? Yes, easily.
03
What protects it. FedRAMP and StateRAMP authorizations plus SpiderLabs threat research give government and regulated clients a reason to stay.
What would change this call
LevelBlue headcount figures for Q4 2026 (Revelio Labs or similar). Further cuts beyond the 44% (2023-2025) drop would show integration turmoil, not stabilization.
Whether Ace American/Chubb refiles or amends its dismissed subrogation suit against Trustwave. A refiled suit would signal real legal exposure for MSSP alert mis-classification liability.
Whether LevelBlue ships a named AI-agentic MDR product with published pricing within 12 months. Would show it can compete with Microsoft MXDR on cost per analyst-hour.
Whether Ace American/Chubb refiles or amends its dismissed subrogation suit against Trustwave. A refiled suit would signal real legal exposure for MSSP alert mis-classification liability.
Whether LevelBlue ships a named AI-agentic MDR product with published pricing within 12 months. Would show it can compete with Microsoft MXDR on cost per analyst-hour.
Key numbers
- Headcount fell 44.4% from 2023 to Dec 2025
- LevelBlue completed Trustwave acquisition Aug 19, 2025
- First pure-play MDR firm with FedRAMP, Feb 2025
Named risks
- Chubb/Ace American subrogation suit dismissed without prejudice, could be re-filed against Trustwave.
- Headcount fell 44.4% from 2023 to Dec 2025, signaling unfinished integration or continued cost extraction.
- AI-native agentic MDR entrants automating tier-1 triage threaten core billed labor model.
- Rapid MDR sector consolidation (Sophos/Secureworks, Zscaler/Red Canary) compresses standalone differentiation.
- Brand absorption risk: Trustwave could be folded fully into LevelBlue identity.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Microsoft (MXDR) | losing to | Microsoft ships native MXDR while Trustwave resells the same platform as of 2025 |
| CrowdStrike (Falcon Complete) | contesting | Direct managed-service competitor targeting same commodity MDR labor market, 2025 |
| Sophos (Secureworks Taegis) | gaining on | Sophos acquired Secureworks Taegis February 2025, consolidating MDR share |
| Zscaler (Red Canary) | gaining on | Zscaler acquired Red Canary August 2025, entering managed detection directly |
| Daylight AI and AI-native MDR entrants | gaining on | AI-agentic SOC tools automating tier-1 triage as of June 2026, per daylight.ai |
Questions people ask
- Is Trustwave still an independent company?
- No. Trustwave was acquired by LevelBlue, with the deal signed July 1, 2025 and closing August 19, 2025. It now operates as 'Trustwave, A LevelBlue Company,' a wholly-owned brand inside the PE-backed LevelBlue rollup, ending years as a standalone MSSP.
- Who owns Trustwave now?
- Trustwave is owned by LevelBlue, which itself is majority-owned by private equity firm WillJam Ventures with AT&T holding a minority stake and board seat since LevelBlue's May 2024 spinout from AT&T Cybersecurity. LevelBlue completed its Trustwave acquisition on August 19, 2025.
- Has Trustwave had layoffs or major headcount cuts?
- Yes. Per Revelio Labs workforce data, Trustwave's employee count fell from 1,377 in 2023 to 1,299 in 2024 to 868 by December 2025, a 44.4% decline over two years, coinciding with the Cybereason merger and LevelBlue acquisition.
- Could AI replace Trustwave's security analysts?
- Tier-1 alert triage and log correlation, the bulk of Trustwave's billed MDR labor, is exactly what AI-native agentic SOC entrants like Daylight AI are automating as of mid-2026, threatening to compress the human-analyst-hours pricing model Trustwave relies on.
- Is Trustwave a safe company to join right now?
- Trustwave has changed owners four times in five years (Singtel, MC2/Chertoff in Jan 2024, Cybereason merger Nov 2024, LevelBlue Aug 2025) alongside a 44.4% headcount drop by December 2025, signaling ongoing restructuring rather than stability.
- Who are Trustwave's biggest competitors?
- Trustwave/LevelBlue competes against Microsoft MXDR, CrowdStrike Falcon Complete, Sophos (which acquired Secureworks Taegis in February 2025), and Zscaler (which acquired Red Canary in August 2025), all of which have shipped competing managed detection services.
Timeline
- 2026-06-24Court dismisses most Chubb/Ace American claims against Trustwave without prejudice
- 2025-08-19LevelBlue completes acquisition of Trustwave
- 2025-07-01LevelBlue signs definitive agreement to acquire Trustwave
- 2025-02-20Trustwave becomes first pure-play MDR provider with FedRAMP authorization
- 2024-11-12Trustwave and Cybereason merge to expand MDR/EDR capabilities
- 2024-08-01Trustwave attains StateRAMP authorization
- 2024-01-08Chertoff Group's MC2 Security Fund completes $205M acquisition of Trustwave
- 2021-10-01Trustwave sells PCI-compliance business to Sysnet for $80M
- 2015-04-01Singtel acquires ~98% of Trustwave for $810M
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- LevelBlue Completes Acquisition of Trustwave... (2025-08-19)
- Trustwave, Cybereason Merge to form MDR Security Stalwart (2024-11-12)
- Trustwave Enters Next Phase of Growth... (2024-01-05)
- Trustwave Becomes First Pure-Play MDR Provider to Attain FedRAMP Certification (2025-02-20)
- Trustwave Holdings Number of Employees 2026
- Trustwave Stock Price, Funding, Valuation & Financial Statements
- Trustwave Holdings
- AT&T Cybersecurity becomes a separate business, rebranded as LevelBlue (2024-05-05)
- OPINION filed... (2026-06-24)
- LevelBlue Buys Trustwave to become the largest independent MSSP, CEO says exclusive (2025)
- Trustwave Named a Leader in Frost & Sullivan MDR Radar Report (2024-03-11)
- LevelBlue President On Agentic AI and Standing Out on Its Own Threat Detection Managed Security Merits (2025)