AI search visibility study · 20 cybersecurity brands Mentioned or Missing

A marketing leader told me that a few months ago. Their company is a top-three player in its category.

I hear some version of it most weeks now.

It's never “we need more leads.” It's something stranger. Impressions are up. The brand shows up in AI answers. And pipeline is going the other way.

Here's what changed. Buyers do their research before they ever reach you. In ChatGPT. On Reddit. In a peer's DMs.

By the time they land on your site, the shortlist is built.

So I wanted to know one thing:

When a buyer asks AI what to buy, who gets named? And why?

We picked twenty cybersecurity brands across five categories. Then we pulled every AI answer we could get about them.

We pulled every AI answer Semrush would give us that named one of the twenty brands. 16,407 of them. 13,868 in the US.

Then we sorted the US answers by what the person was actually asking.

Nearly a third had nothing to do with cybersecurity. Stock tips. Sponsorships. People who happen to share a brand's name.

We set those aside. That left 9,477 answers about cybersecurity. That's what this report is built on.

Here's the part no tool shows you.

A visibility score counts all of it. The stock tip counts the same as a buyer building a shortlist.

For the question work later on, we went one step further. We dropped every question that already named a brand, and every duplicate. That left 3,767 questions a buyer asks before they know who you are.

Every brand here has an AI visibility score. It's the number that ends up in the board deck.

We put it next to a different number. Out of every time AI named a brand in a cybersecurity conversation, how often was someone deciding what to buy?

We call that the evaluation rate. Not how often you show up. Which room you show up in.

Look at the top-left. That's where you want to be.

Three brands. Scores of 39, 36 and 25. The lowest in their categories. And the most likely in their categories to be named when someone is buying.

Now the bottom-right. EDR C has the highest score in the study. 76.

Every 1,000 times AI names EDR C, 109 are buying conversations. For EDR B, scoring 39, it's 377.

Semrush writes the same note under both of them: “Occasionally mentioned in LLM outputs, but Visibility can improve.”

The tool isn't broken. It's answering a different question. It tells you how much of the conversation you're in. Not which room.

Now notice who's in that top-left corner. All three are scale-ups.

Across the fifteen, scale-ups averaged a 44.3% evaluation rate. Enterprise brands averaged 35.6%. The scale-ups did it with lower scores. In three of the four categories, they won outright.

But size isn't the whole story. The highest-scoring AppSec scale-up has the lowest rate in its category. Something else is going on. More on that in a minute.

Semrush shows which questions each brand gets cited for. So we read them.

Here are two EDR brands. Same week.

Here's what surprised me. In the answers we pulled, EDR C and EDR B had about the same number of mentions. Roughly a thousand each.

EDR B turned them into about three times as many buying conversations.

More mentions isn't more. The right ones are.

61.7% of what AI says about EDR C has nothing to do with buying security.

That isn't being invisible. It's being everywhere except the room that matters.

And it's harder to fix, because you can't see it in the score.

Cited isn't named. One EDR challenger gets cited about ten times for every time it's actually named.

And the ladder is real. The biggest platform brand in the study shows up in 315 statements AI made about these brands. In two of them, AI describes it in its own words.

A small email challenger shows up in 32. AI describes it in its own words in 13.

Fame gets you named. Agreement gets you described.

One catch. Described cuts both ways. “Notoriously expensive” is a description too.

The top rung means AI has an opinion about you. Whether it's a good one depends on whether your customers agree with your marketing.

We went in with a hunch.

AI names you when you're clear about who you serve, clear about the problem you solve, and your customers say the same thing back.

We were mostly right. And wrong in an interesting place.

Both are true. Only 24 of 168 brand-and-question pairs ranked in the top 10. 14 of those got named.

The other 144 didn't rank. 46 got named anyway.

Why? Probably because AI breaks one long question into several short searches you never see.

Your website is still the most-cited source for 15 of the 18 brands we checked. But it's only 2.3% to 8.5% of the citations in an answer.

Structure, schema and speed matter. They decide whether AI can read you. They can't decide what it thinks you're for.

Try this. Ask ChatGPT and Gemini the question your buyer would ask. Once with the web off. Once with it on.

We did it for “SIEM solutions for small business.”

EDR B was the top pick in one screen. Missing from two.

Turning search on saved it in Gemini. And erased it in ChatGPT.

ChatGPT with search told the buyer to find “a managed SIEM/MDR provider.” That's EDR B's exact buyer. Its exact pitch. And it named no one.

The category got recommended. The brand got left out.

In August 2026, Reddit citations in ChatGPT dropped about 73% in six days. That's from Otterly.ai's tracking. The other engines barely moved.

That's the layer everyone is selling. “We'll get you cited.” It moves that fast.

What AI already knows you're for moves slower. And differently in each model.

So the work that looks slowest is the work that compounds.

One buyer. One problem. Said the same way everywhere. Fix what you have before you add anything new.

More is not more.