How can cyber security companies get recommended in AI search?

Explain exactly which security work you deliver, for which buyer and with what evidence, on your own website and on the directories and other websites AI reads. Then check the specific briefs you want to win, not just “penetration testing” or “cyber security”. In our research, when the buyer’s brief changed from a financial-services firm to a software company needing SOC 2 evidence on a budget, ChatGPT replaced its entire shortlist.

Avouch’s free scan shows which companies AI recommends in your market.

This guide is for cyber security firms. See also our guides for tech companies and IT support companies.

What our research shows for cyber security

• The buyer’s brief changes the shortlist. Two questions both asked for UK penetration testing. The first described a mid-sized financial-services firm. The second described a software company needing SOC 2 evidence on a budget. ChatGPT kept none of its first shortlist, Gemini 22% and Claude 20%. See how AI shortlists differ between buying briefs.
• Directories decide a lot, and each AI tool leans on different ones. In our cyber security answers, Claude cited the CREST Marketplace, a directory of accredited providers, in 10 of 11 answers. ChatGPT leaned on CREST and the National Cyber Security Centre. Gemini’s most-cited website was a security supplier’s own comparison of UK providers. See the websites behind repeated AI recommendations.
• AI Overviews appear on most cyber buying questions: 76% of UK and 90% of US results pages for the data protection and cyber security questions we track.

1. Collect your buyers’ own words

Cyber security is full of people talking, and most of them are not buying. In our voice harvest for a data protection and cyber security market, only 40% of the posts first marked as buyers were buyers after a second check. 38% came from practitioners, and 6% from people affected by a data breach.

So start with the sources closest to the buyer: sales and discovery calls, lost deals, questionnaires and procurement requests from prospects, and reviews of you and your competitors on Clutch, G2 and Trustpilot. In our harvest, review sites were 85% to 100% buyers. Reddit was 20%. Read public forums too, but check who is speaking first. Our tech companies guide shows the full results.

For each buyer comment, record what triggered the need (an audit, a customer’s security questionnaire, an incident, a new contract), the job to be done, their limits, what they fear, and their exact words with the source and date. Keep confidential findings and identifying details out of anything you publish.

2. List the briefs you want to win

Write down each buying brief you serve, for example:

• a penetration test for a software company that needs SOC 2 or ISO 27001 evidence;
• Cyber Essentials or Cyber Essentials Plus certification for a small business;
• an ongoing managed security service for a firm with no security team;
• incident response, before or after an incident;
• security for a regulated sector, such as finance or healthcare.

Each brief can bring a different AI shortlist, so check them separately. Give a brief its own page or section when the answer is different.

3. Show the evidence buyers check

Security buyers check evidence before they shortlist. Fill this worksheet from your actual service:

Have someone who delivers the service check every entry. Do not let marketing turn a defined service into a promise that a business is safe from every incident.

4. Find out what else AI searches for

For “a penetration test for SOC 2 on a budget”, AI tools may also search for what SOC 2 requires, typical costs, how long a test takes and what the report includes. This is query fan-out. Our guides show how to see these searches in Google and ChatGPT. Keep the searches you actually see separate from your own ideas.

5. Check the directories and other websites AI relies on

Choose the buyer questions to track, ask them in each AI tool, and open the pages each answer cites. For cyber security these are often:

• accreditation directories, such as the CREST Marketplace and the NCSC’s lists of assured services;
• government and official guidance, such as the National Cyber Security Centre;
• comparison pages and best-of lists, including suppliers’ own (see comparison pages on your own website and comparison sites);
• review sites such as Clutch and G2.

Make sure your directory listings are complete, current and match your website. Our guide to why AI recommends your competitors shows how to find the gaps.

6. Make sure AI can read your pages, and measure

Explain your services in public text, not only in a brochure behind a form. Ask whoever runs your website to check that your service pages are indexed and that robots.txt and your firewall let search and AI crawlers in (see AI crawlers). Security firms often run strict bot rules that block these crawlers by mistake. Add a short AI information page.

Then track each brief separately every week: how often AI names you, recommends you and cites your pages. Ask new customers how they found you. Our guides to AI visibility metrics and measuring the return explain how.

How Avouch can help

We start from your buyers’ words and the briefs you want to win, then agree the work that fits: clear service pages, content that answers buying questions, complete directory listings, reviews and industry profiles and PR and industry coverage. Your technical team checks every claim about your service. Where it is part of an agreed engagement, we track your Recommendation Rate™ each week, with scope and price agreed before we start.

Want to know where you stand?

Start with the free scan. For a fuller review and a written plan, choose the paid Recommendation Index™ assessment.