AI search visibility study · 20 cybersecurity brands Mentioned or Missing
Your rankings held. Your AI visibility score looks fine. And pipeline is going the other way. We pulled twenty cybersecurity brands apart to find out who AI actually names when a buyer is deciding what to buy — and why. It isn't tactics. It's focus.
- Brands
- 20
- Categories
- 5
- AI engines
- 4
- Prompts analyzed
- 9,477
ChatGPT, Gemini, Google AI Overviews and Google AI Mode. US data, 2026. By Kerry Guard, MKG Marketing.
The short version
Five things we found
- 1
The AI visibility score points the wrong way.
Across 15 brands, the higher the Semrush score, the smaller the share of mentions that were buying conversations (r = −0.55).
See the data → - 2
Fame isn't the same as being bought.
61.7% of what AI says about the highest-scoring brand is stocks, jobs and news. 109 of every 1,000 mentions are buying conversations. EDR B, a challenger: 377.
See the data → - 3
Brands serving one buyer show up in more buying conversations.
One buyer: 44.0% of mentions are buying conversations. Two or more: 35.2%. Across all twenty brands, r = −0.58.
See the data → - 4
Specific questions are far more winnable than category questions.
Questions about a specific instance name 6.7 brands on average. Category questions name 13.1.
See the data → - 5
Ranking helps, but it isn't the gate.
Brands ranking in Google's top 10 were named 58% of the time, against 32% for those that didn't. But so few ranked that 46 of the 60 named brands got there without it.
See the data →
Read this before the numbers
- We don't name the brands. There are marketers behind every one of them doing their best, and the point is the pattern, not a scoreboard. Brands appear as their category plus a letter. The letters are labels, not rankings.
- AI search is new. Nobody, us included, has years of data. This is twenty brands in one industry, not a law of nature.
- Every brand-level number comes from one tool: Semrush's AI Visibility data, pulled through our own account. The few outside figures and hand-run tests are labelled where they appear.
- AI answers move fast. Citations especially. Treat every figure here as a photograph of something moving.
- We got things wrong along the way, and we kept the list. It's near the bottom. A report with only what worked is a report you can't check.
What we read
16,407 AI answers. In the US, about one in four was a buyer.
We didn't stop at the score. We pulled every AI answer Semrush would export that named one of the twenty brands: 16,407 of them, 13,868 in the US. Then we sorted the US answers by what the person was actually asking. Nearly a third had nothing to do with cybersecurity. We set those aside, which left 9,477 prompts about cybersecurity. Those are the ones we paid attention to.
What 13,868 US answers were actually about
- 36.9% general cybersecurity. How things work, definitions, news about the space.
- 26.1% buying conversations. Best-of, comparisons, alternatives, pricing, vendor shortlists.
- 3.9% careers and corporate. Jobs, salaries, funding, earnings, who runs the company.
- 1.4% product support. Install, configure, fix.
- 31.7% not about cybersecurity at all. Stock lists, sponsorships, name collisions: answers that never touch security. We set these aside.
That's the quality problem nobody shows you. A visibility score counts all of it. The stock tip, the job hunt, the person who shares your name — each one counts the same as a buyer building a shortlist.
For the question-level analysis we went one step further: we stripped out every question that already named a brand and removed duplicates. That left 3,767 unique questions a buyer might ask before they know who you are.
01 · The problem
“Our branded search fell off a cliff in the last eight months.”
A marketing leader at a top-three player in their category told me that.
I have some version of that conversation most weeks now. It's never “we need more leads.” It's something stranger. Impressions are up. The brand turns up in AI answers. Pipeline is going the other way.
Buyers stopped coming to your site to research. They do that long before you know they exist — in AI answers, on Reddit, on YouTube, in a peer's DMs. By the time they land on you, the shortlist is built. They're there to confirm it, or they're gone.
So we took twenty brands we have no relationship with, in a category where we could check every claim, and asked one question:
When a buyer asks AI what to buy, who gets named?
The first thing we found was that the industry is measuring the wrong thing. Not slightly. Backwards.
02 · The scoreboard is broken
The AI visibility score you're paying for points the wrong way.
Every brand in this study has an AI Visibility score. It's the number the tools sell, the number that goes in the board deck.
We put it next to a different number: of all the times AI named this brand in a cybersecurity conversation, what share were people actually deciding what to buy? We call that the evaluation rate. Not how often you show up. What room you show up in.
Look at the top-left. Three brands scoring 39, 36 and 25 out of 100. The lowest scores in their categories, and the three brands in those categories most likely to be named when somebody is deciding what to buy.
Now the bottom-right. EDR C scores 76, the best in the study.
Every 1,000 times AI names EDR C, that top-scoring brand, 109 are a buying conversation. For EDR B, a challenger scoring 39, it's 377.
Semrush writes the same sentence under both of them: “Occasionally mentioned in LLM outputs, but Visibility can improve.” Same note to the brand winning and the brand losing.
The tool isn't broken. It's answering a different question. It measures how much of the AI conversation you're in. It can't tell you which room.
03 · What you're famous for
Fame gets you into every conversation except the one that buys.
Semrush shows which prompts each brand gets cited for. So we read them. Same category, same week, two brands.
- “top companies hiring for SDR, BDR, ADR roles”
- “best companies hiring for PCI DSS careers”
- “top 50 stocks to watch right now”
- “companies hiring remote document writers”
- “companies that support remote work on islands”
Corporate-fame noise
61.7%
of its AI mentions are about stocks, jobs, news and sponsorships, not buying security.
Corporate-fame noise against buying conversations, 15 brands
61.7% of everything AI says about the highest-scoring brand in the study isn't about buying security. The biggest platform brand: 55.5%. That isn't invisibility. It's presence that converts to nothing — a harder problem to see, and a harder one to fix.
04 · Three rungs
Cited. Mentioned. Described.
Most of the industry sells you the first rung. Here's why that matters.
Cited
Your page turned up as a footnote under the answer. Nobody reads footnotes.
How it's earned
Write the page, structure it, wait. This is the rung that's for sale.
Mentioned
Your name is in the answer. Usually in a list with a dozen others.
How it's earned
Be big enough to belong in the list, or narrow enough that the list is short.
Described
The model tells the buyer what you're for. That's a point of view, not a list entry.
How it's earned
What you say about yourself and what your customers say about you are the same thing.
Being cited isn't being named. One EDR challenger in the study gets cited about ten times for every time it's actually named in an answer.
Proof it's a real ladder: the biggest platform brand in the study appears in 315 model statements across our data. In two of them the model describes it in its own terms. A small email security challenger appears in 32 — and is described in its own terms in 13.
Fame gets you named. Agreement gets you described.
One catch: described can go either way. A model can describe you as “notoriously expensive.” That's a description too. The third rung means the model has an opinion about you. Whether it's a good one depends on whether your customers agree with your marketing.
05 · What actually works
It's not tactics. It's focus.
We went in with a theory: AI recommends you when you're specific about who you serve, specific about the problem you solve, and your customers say the same thing about you that you do. We were mostly right, and wrong in an interesting place.
1. Serve one buyer
Not one product. One signatory. How many different people, with different budgets, have to sign for your product line? One cloud brand in the study merchandises a dozen acronyms, all sold to the same cloud security budget: one buyer. One platform brand has five top-level lines and five different people signing five different POs.
Buyers served, against evaluation rate
Select a bar to see the brands in it.
The honest bit: One identity brand serves one buyer and has the second-worst evaluation rate in the study. Focus is necessary. It isn't sufficient. Anyone who tells you otherwise is selling something.
2. Answer the question only you can answer
Not your category. Not “best practices.” A specific thing that happened to a specific person.
How many brands AI names, by the shape of the question
Watch the near-miss. “Best practices for setting up a DevSecOps CI/CD pipeline” is a problem question. It names 33 brands, because every vendor on earth can write that essay. “What are the best methods to remove the Trojan Linux Mozi botnet?” names one.
The test: could a competitor publish this exact piece? If yes, it can earn a citation. It won't earn a mention.
The boundary: cloud security doesn't follow this. Even its specific questions are as crowded as its category questions. Cloud is saturated at every level.
3. Say it the same way everywhere, and get others saying it back
This is the one we couldn't put a number on, and I'll tell you exactly where it fell down.
What we watched happen. We asked ChatGPT, with the web switched off, for SIEM tools for a small business. It recited a comparison article and the general tenor of user reviews from memory — “reviews tend to emphasize ease of deployment” — and used them to advise the buyer. Somebody wrote that content. Customers wrote those reviews. Both are now inside the model.
What we couldn't prove. We tried four different proxies for whether a brand and its customers say the same thing. All four came back flat. Then we coded 334 PeerSpot reviews across ten brands to test whether customers who echo a brand's own language predict buying conversations. That came back null too.
Our best guess, not a finding. Every brand in the study gets a similar share of its citations from practitioner channels like Reddit, YouTube, G2 and Gartner — 14.5% to 17%. So being talked about in those places doesn't separate anyone. What they're talking about might. The highest-scoring brand's mentions are full of jobs and salaries. We couldn't prove the topic matters more than the volume. We think it does.
And your own channels have to agree first. If your website, LinkedIn and review profiles describe you three different ways, there's nothing for anyone to say back.
06 · Does SEO still matter?
Ranking helps. It isn't the gate.
58%
When a brand ranked in Google's top 10 for a buying question, AI named it 58% of the time.
32%
When it didn't rank, AI still named it 32% of the time. Ranking roughly doubles your odds.
46 of 60
named brands didn't rank. So few brands ranked at all that most names came from somewhere else.
Both things are true at once. Of 168 brand-and-question pairs, only 24 ranked in the top 10, and 14 of those were named. The other 144 didn't rank, and 46 of them were named anyway. Ranking helps when you have it. Most brands don't, and AI names them regardless, likely because these models break one long prompt into several short searches we can't see, then assemble the answer.
Your own website is the single most-cited source for 15 of 18 brands we checked. It's also only 2.3% to 8.5% of the citations in an answer. Structure, schema and speed matter. They decide whether the machine can read you. They can't decide what it thinks you're for.
80 non-branded buying questions sampled, 41 with Google results; 168 brand-and-question pairs; Google US results 30 Sep 2026. Small sample, and bigger brands both rank and get named more.
07 · Four screens, four answers
Same buyer. Same question. Same day. Four different shortlists.
Ask ChatGPT and Gemini the buying question your customer would ask. Once with the web off, once with it on. Here's what happened for “SIEM solutions for small business.”
ChatGPT · From memory
Named
Top pick, five stars
Gemini · From memory
Absent
ChatGPT · With search
Absent
Recommends “a managed SIEM/MDR provider”, names no one
Gemini · With search
Named
Named first
EDR B is the top pick in one box and absent from two. Turning search on rescues it in Gemini and erases it in ChatGPT. And ChatGPT with search tells the buyer with no security staff to use “a managed SIEM/MDR provider” — EDR B's exact buyer, its exact pitch — and names no vendor at all.
The category gets recommended. The brand gets left out.
Try it on your brand
Ask the buying question your customer would ask. Tick the screens you appear in.
You're in 0 of 4. That's the number no tool will show you. It's where most brands start.
08 · What's at stake
Citations move in days. Being described moves on a slower clock.
In August 2026, Reddit citations in ChatGPT fell about 73% in two steps, six days apart, according to Otterly.ai's tracking. The other engines barely moved. Every citation number is a photograph of something moving.
That's the argument. The layer everyone is selling — citations, sources, “we'll get you cited” — moves that fast. The layer that already knows what you're for doesn't. It moves on a slower clock, and a different one in each model.
So the work that looks slowest is the only work that compounds. One buyer. One problem, said the same way everywhere. Questions only you can answer. Fix what you already have before you add anything new. More is not more.
09 · What we got wrong
Everything that broke, in public.
- We built a breadth measure on navigation counts. It rated a one-buyer cloud brand 2.4× broader than a five-buyer platform, which is commercially absurd. Withdrawn.
- We published buyer count at −0.69 on codes assigned by hand for a subset. We withdrew our own headline number, rebuilt it across all twenty brands with every code written down, and it came back at −0.58.
- We ran a language test against a data field cut off at 173 characters and reported a null result. The instrument was broken.
- We said turning search on narrows the field of brands. A paired test on the same engine said otherwise; we'd confused the engine with the search setting.
- We tried four separate proxies for whether a brand and its customers say the same thing, then a fifth with 334 coded reviews. None held up.
- Our mention counts can't tell a recommendation from a warning. A brand described as too expensive still counts as mentioned.
- The brands that won our small-business SIEM test barely appear in our 13,000-answer dataset. The tool we measured with is blind to some of the companies that are winning.
10 · How we did it
Methodology, definitions and questions
Why don't you name the brands? +
Because there are marketers behind every one of them, doing their best with the hand they were dealt. Naming them would turn a pattern into a scoreboard. Each brand appears as its category plus a letter (EDR A, Cloud B and so on). The letters are labels, not rankings, and they stay the same across every chart on this page.
Where does the data come from? +
Semrush's AI Visibility data for 20 cybersecurity brands across five categories (EDR, cloud, email, application security and identity), US, covering ChatGPT, Gemini, Google AI Overviews and Google AI Mode. Exports were captured between spring and early September 2026; the score comparison uses scores pulled 5 to 7 September 2026. Semrush caps each export at 1,000 prompts, so the largest brands' totals are minimums. One AppSec brand's export is small (138 mentions), so we left it out of the noise chart; without it the score correlation is −0.54 instead of −0.55.
What is the evaluation rate? +
Of all the AI answers that name a brand in a cybersecurity context, the share where the person was deciding what to buy: best-of, comparisons, alternatives, pricing, vendor and recommendation questions. We classify prompts with the same keyword rules for every brand, first for relevance to cybersecurity, then for intent. It's our measure. Semrush isn't trying to measure it.
What's the difference between cited, mentioned and described? +
Cited: your page is a source link under the answer. Mentioned: your brand name is in the answer. Described: the model says what you're for, in terms that match your positioning.
How did you count buyers? +
A distinct buyer is a different person, with a different budget, judged on a different success metric. A dozen product acronyms sold to one cloud security team is one buyer. Channel partners reselling to the same end buyer add none. Every brand's code is written down with a one-line reason, and we'll share it on request so you can argue with any of them.
Why do the per-1,000 numbers and the evaluation rates differ? +
The per-1,000 figures (109 and 377) are out of every mention, noise included. Evaluation rates are out of cybersecurity-relevant mentions only. Both point the same way.
Isn't this just big brands versus small brands? +
Partly, and we can't fully separate the two with twenty brands. Size explains some of the noise: famous companies get pulled into stock, jobs and news conversations. Some big brands still do well, some small ones don't, and one identity brand shows focus alone isn't enough.
Does this apply outside cybersecurity? +
We don't know yet. This study is one industry. We're extending it, and we'll publish what we find, including if it doesn't hold.
Are you affiliated with any of these brands or with Semrush? +
We have no client relationship with any of the twenty brands. We use Semrush as a paying customer; they had no input into this study.
Using a chart? Go ahead. Credit “MKG Marketing, Mentioned or Missing (2026)” and link back to this page.
Your brand, against this report
Are you mentioned, or missing?
We'll run your brand through the same lens. The questions your buyers actually ask. Which of the four screens you're in. What AI says you're for, and whether your own channels agree with each other.
It's yours to take and run with.