How to Audit Your AI Citations: The 6-Step Method Security Marketers Use to Find Out Why AI Skips Their Brand
When a CISO asks ChatGPT for "best SSO solutions for mid-market," the answer names five vendors. This guide shows you exactly how to find out which sources put those five vendors there, and why you weren't one of them.
Four in ten B2B security buyers now start vendor research inside ChatGPT, Perplexity, or Claude. They don't get ten blue links. They get a shortlist.
Here's what most marketing teams miss: that shortlist isn't random. Every AI engine builds its answer from a specific set of citations, and those citations follow patterns you can map, measure, and change. If your brand keeps getting skipped, the reason is sitting in a handful of specific URLs. You just haven't audited them yet.
This guide gives you the full audit method. It takes a few hours to run manually. By the end, you'll know exactly which sources decide the shortlist in your category, whether your problem is presence or citability, and which one or two pages are carrying your competitors into every answer.
Prefer the 60-second version? See How AI Sees Your Brand. Sign up for a free trial and get your AI visibility score in about a minute.
First, understand the two filters your brand has to survive
When an AI engine answers "top SSO solutions," your brand gets filtered twice.
Filter 1: Retrieval and extraction. The engine searches the web and pulls roughly 10 sources. But it doesn't read full pages. It extracts snippets and chunks. If you're mentioned in paragraph 14 of a listicle, below the fold, outside any table or heading, you may not exist in what the model actually reads. The page cited you. The model never saw you.
Filter 2: Synthesis. From what survives extraction, the model decides who makes the answer. The biggest signal is cross-source consensus: a vendor appearing in 8 of 10 retrieved sources is the "agreed answer." A vendor appearing in 1 is noise. The model also favors brands it already recognizes from training data, brands described with the exact category language in the prompt, and brands framed strongly (comparison tables, "best overall" labels, dedicated sections) rather than mentioned in passing.
Every visibility problem lives in one of these two filters. The audit tells you which.
Step 1: Build a prompt set, not a single prompt
One prompt tells you almost nothing. Retrieval changes with phrasing, so you need 15 to 30 prompt variants written the way real security buyers actually ask:
"top SSO solutions" / "best SSO for mid-market" / "Okta alternatives for a 200-person company" / "SSO tools comparison 2026" / "which identity provider should a Series B startup use"
Don't invent these from a conference room. Pull them from your Google Search Console and Bing Webmaster data. The queries your real buyers type retrieve different sources than the queries marketers imagine, and the real ones are the only ones that matter for pipeline.
Step 2: Run every prompt across every engine and log the citations
Run each prompt on ChatGPT (with browsing), Perplexity, Gemini, Copilot, and Google AI Overviews. All of them expose their sources.
For every run, capture four things:
The cited URLs
The domain behind each URL
Which brands appeared in the answer
Where each brand appeared: first third of the response, middle, or tail
Position matters more than most teams realize. A brand named in the opening lines is the engine's confident pick. A brand squeezed into the last sentence is barely on the list.
One more rule: run each prompt 3 to 5 times across a few days. AI retrieval is non-deterministic. A source cited in 4 of 5 runs is load-bearing. A source cited once is noise. You cannot tell them apart from a single run.
Step 3: Build your citation frequency table
Now aggregate. Across all prompts, all engines, all runs: which domains get cited most in your category?
In cybersecurity categories the pattern is usually some mix of G2 and Gartner Peer Insights, Reddit threads (r/sysadmin, r/cybersecurity, r/netsec), a handful of "best X tools" listicles from security publications, vendor comparison pages, and occasionally Wikipedia or analyst summaries.
Your top 10 to 15 domains by citation frequency are the target surface. These specific pages decide who makes the shortlist. This single table is the most valuable output of the entire audit.
Want this table generated automatically, refreshed daily? Gracker's Top Citing Domains view does exactly this across all 6 engines. Start Your Free Trial.
Step 4: Diagnose presence vs. citability
Here's where the audit turns into an action plan. For each high-frequency source, check two things separately:
A. Are you mentioned on that page at all?
B. When that page gets cited, do you survive the answer?
These are completely different problems with completely different fixes:
What you find | Your problem | Your fix |
Not on the page | Presence | Earned media: get included in the listicle, comparison, or review site |
On the page, never in the answer | Citability | You're mentioned too late, outside tables and headings, or described with language that doesn't match buyer prompts |
On the page, sometimes in the answer | Weak consensus | You need presence on more of the top sources so the model sees agreement |
In the answer without strong citations | Brand prior | The model already knows you; protect this by keeping sources fresh |
Most security vendors assume they have a presence problem. The audit frequently reveals a citability problem instead: they're already on the right pages, buried in paragraph 12, described as "workforce access management" while every buyer prompt says "SSO."
Step 5: Trace your competitors' citation paths
For each competitor that consistently makes the shortlist, work backwards: which specific citations carried them in?
You'll usually find one or two kingmaker sources. A single well-structured comparison table on a high-authority domain often drives the majority of a competitor's inclusions across every engine.
Those kingmaker pages become your priority list. Two moves: get placed on the same page, or publish a stronger, better-structured asset that engines start pulling instead. Both work. The second one compounds.
Step 6: Re-run monthly and track the deltas
Citation sources rotate. A domain that engines stop citing is an early warning your visibility is about to drop, weeks before any score reflects it. A newly cited domain is a window: get placed while the source is fresh, before the shortlist calcifies around it.
Re-run the full audit monthly at minimum. Quarterly is too slow. The engines move faster than that.
The output: one matrix that tells you everything
When you're done, you have a simple grid. Prompts down the side. Top citing domains across the top. Each cell marked one of three ways: brand present on page, brand cited in answer, or neither.
That one matrix answers the question every security CMO is asking right now: is our gap a presence problem or a citability problem? Get that diagnosis wrong and you'll spend two quarters producing content when you needed placements, or chasing placements when your existing pages just needed restructuring.
Two things the manual audit will teach you fast
Engines behave differently, so never blend the data. Perplexity leans on recent high-authority pages and Reddit. ChatGPT browsing favors a smaller set of established domains. Google AI Overviews largely mirrors existing Google rankings. A blended visibility number hides which engine is actually costing you deals. Keep every metric per-engine.
Incumbents get a head start you have to out-cite. For brands the model already knows from training data, engines sometimes include them even on thin citation support. Challengers don't get that courtesy. If you're the newer vendor, you need overwhelming cross-source presence to displace a familiar name. That's not unfair. It's just the consensus math, and now you know how to work it.
Run it manually once. Then never again.
Do the manual audit at least once. Nothing builds conviction like watching a competitor ride one comparison table into every answer in your category.
But 25 prompts, 6 engines, 5 runs each, logged daily, with position tracking and source deltas? That's thousands of data points a month. It's exactly the work Gracker automates for security teams: daily prompt tracking across all 6 engines, per-engine citation frequency, position distribution from Hero to Tail, alerts when a source starts or stops being cited, and a recommendation engine that turns the gaps into a prioritized fix list.
Security teams using this approach typically see initial visibility improvements in 4 to 6 weeks and significant citation increases in 2 to 3 months.
See How AI Sees Your Brand. Free trial, score in about a minute. Trusted by 500+ security teams.
