AI Engines Agree Vanta Leads Compliance Automation. They Cite Almost None of the Same Sources.

Compliance buyers now open an AI engine before they open a vendor site. The shortlist that engine returns shapes the evaluation before anyone fills in a contact form, so we wanted to know what the engines actually say in one category, measured at scale rather than inferred from a handful of prompts.

Key Takeaways

• Vanta recorded 139,000 mentions and Drata 123,000, together 24.1% of every vendor mention in the study. 14 vendors were named by all six engines.
• Mention volume and ordinal position move independently. LogicGate ranks 9 of 30 on mentions, yet opens Microsoft Copilot's answers.
• Cross-engine cited-source overlap averaged 0.12 and peaked at 0.34, between two engines run by the same parent.
• 19.7% of all cited URLs were unreachable, ranging from 10.5% to 23.2% by engine.
• Vanta took first position in all four markets, in a category whose subject matter is jurisdictional.

What We Analyzed and How

We issued 10,000 enterprise buyer-intent queries about compliance automation, GRC software and integrated risk management to six AI engines: ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview, and Google AI Mode. Every query ran in four markets (United States, Canada, India, Germany), producing 40,000 responses per engine and 240,000 in total during August 2026.

For every response we recorded length, cited sources, whether each cited URL still resolved, each vendor named, and the ordinal position of that vendor's first appearance. The corpus contained 3,231,000 cited sources and 117 distinct product entries across 82 brand attributions. If you want to run this count on your own brand, the step-by-step version is in how to measure AI share of voice across engines.

Two limits are worth stating up front. The engines are commercial services without pinned model versions, so a repeat run would not reproduce identical responses. And the query set is purposive rather than randomly sampled, so we report descriptive statistics only and make no claims of statistical significance. Full methodology and validity limits are in the complete benchmark report.

Which Vendors Do AI Engines Name Most in Compliance Automation?

Vanta led the category with 139,000 mentions, followed by Drata at 123,000 and MetricStream at 89,000. The ten most-mentioned vendors accounted for 767,000 mentions between them. 14 vendors were named by all six engines: Vanta, Drata, MetricStream, ServiceNow, Secureframe, Sprinto, IBM, LogicGate, OneTrust, Archer, AuditBoard, Diligent, Compliancy Group and Hyperproof.

The distribution is steep. Vanta and Drata alone took 24.1% of every vendor mention recorded, and the 13 vendors at 37,000 mentions or more took 81.1%. That leaves 17 brands to divide the rest, and at product level 89 of 117 entries recorded fewer than ten mentions. It is the same shape we found in data security posture management, where the engines picked the same three DSPM vendors — that study ran seven engines rather than six.

The category's two buying motions sit side by side in that list rather than separating. Compliance automation platforms (Vanta, Drata, Secureframe, Sprinto) and enterprise risk suites (ServiceNow, MetricStream, Archer, IBM OpenPages) interleave through the leading positions rather than separating into distinct tiers. The engines do draw the distinction, but not consistently: the first-mention slot splits between an automation platform and a risk suite depending on which engine you ask.

Do the Engines Agree Because They Read the Same Sources?

No. They agree on names while reading almost entirely different evidence.

We measured overlap between each pair of engines using the Jaccard coefficient on their cited domains, where 0 means no shared domains and 1 means identical sets. The mean across all 15 engine pairs was 0.12. The highest single value was 0.34, between Google AI Mode and Google AI Overview — two surfaces operated by the same parent, and even they shared only about a third of their domains. The lowest was 0.03.

Microsoft Copilot was the most isolated engine in the study: its strongest overlap with any other engine was 0.08. It also cited the fewest sources, 152,000 against ChatGPT's 1,680,000, and drew on 43 distinct domains against ChatGPT's 218. The mechanics behind that split, which sources each engine is built to prefer, are in how the major AI engines choose which sources to cite.

Our finding: six engines reading substantially different parts of the web arrived at substantially the same list of names. Earning a citation on a domain one engine reads does not place you in front of the other five.

What the engines cite also differs in kind. Vendor-operated sites were the largest classified source category at 19.2% of all cited sources, concentrated in ChatGPT and the two Google surfaces. Microsoft Copilot leaned instead on a much narrower mix, drawing on 43 domains in total, including third-party statistics sites and low-recognition domains that rarely surface elsewhere.

How Reliable Are the Sources AI Engines Cite?

19.7% of every URL the engines cited was unreachable when we tested it — 634,900 dead links out of 3,231,000 cited sources.

The spread runs from 10.5% at Microsoft Copilot to 23.2% at ChatGPT, a factor of 2.2. Because ChatGPT also cites the most sources by a wide margin, it accounts for 390,000 of the dead links on its own, or 61.4% of every unreachable URL in the study.

There is a practical consequence for anyone maintaining vendor content. A citation pointing at a URL you have moved or retired is spent: the engine still holds the reference, and the reader who follows it arrives nowhere. Retiring a page without a redirect quietly removes a live citation from whichever engines were holding it. The first step is knowing which of your URLs the engines cite at all; the per-engine workflow is in tracking AI citations, mentions and sources.

Which Vendor Gets Named First?

Three different vendors, depending on the engine.

Gemini, Google AI Mode and Google AI Overview all open with Vanta. ChatGPT and Perplexity open with ServiceNow. Microsoft Copilot opens with LogicGate.

That split does not follow mention volume. LogicGate ranks 9 of 30 brands on total mentions with 45,000, yet takes Microsoft Copilot's opening slot. Vanta holds the highest mention total in the study but sits later in the response than ServiceNow at five of the six engines. ServiceNow records 85,000 mentions, roughly 61.2% of Vanta's, while holding a mean position of 1.00 at ChatGPT and 1.00 at Perplexity.

Prominence and frequency are separate quantities here. A visibility score that reports only how often you are named describes half of what happened.

Response length varies just as widely. ChatGPT averages 542.9 words and Perplexity 132.4, a four-fold gap on identical queries. Perplexity also cut off mid-sentence in 42% of its responses against 0% at Microsoft Copilot, and Microsoft Copilot anchored 63% of its answers to an explicit date against 0% at Google AI Mode. No engine refused a single query.

Do AI Recommendations Change by Country?

Barely, and that is the surprise.

Vanta took first position in all four markets. The other two leading positions came from just three vendors: ServiceNow and MetricStream in the United States, India and Germany, and Drata second in Canada. Mean sentiment across markets stayed inside a band of 0.025 on a zero-to-one scale.

Compliance is jurisdictional by definition. GDPR applicability, data residency and sector regulation genuinely differ across those four markets, yet the returned vendor set did not. No market-specific vendor entered the leading positions anywhere. On this evidence, the engines treat compliance automation as a global software market rather than a regulated local one, and market-specific visibility work in this category is currently addressing a difference the engines are not making. Nor is it a compliance-specific quirk: our attack surface management study ran the identical protocol and found the same market stability.

Where Did the Engines Disagree?

On narrow capability claims, not on the shortlist.

The sharpest split was over single-control-set coverage — the claim that one platform's control set satisfies several frameworks without separate mapping work. Microsoft Copilot repeatedly named CATAAM as the only platform offering full cross-framework reuse. Perplexity named Strac Comply. ChatGPT named Drata or Vendorica. Three engines, three different answers, with no two agreeing.

The engines also split on HIPAA fit for small practices: Gemini favored Compliancy Group, while ChatGPT moved between Vanta and Medcurity depending on how the question was worded.

The vendors named in these divergences sit far down the mention distribution. CATAAM recorded 8,000 mentions across the whole study against 139,000 for Vanta. A plausible explanation is that broad positioning is stabilized by a wide base of writing, while a narrow capability claim is settled by whichever single page an engine happened to read. The study measures what the engines returned, not why, so this remains an interpretation rather than a finding.

What Should Vendors Do With This?

Treat the six engines as six channels. Mean cited-domain overlap was 0.12. Work that moves one engine will not move the others, and a program scoped to a single engine leaves five unmeasured.

Track position and volume separately. They order vendors differently, as the first-mention split shows. One combined score hides which of the two is moving.

Audit your own cited URLs. 19.7% of cited links across the study were dead. Any redirect you skipped is a citation you have already lost.

Write the framework-mapping claim in plain terms. State which frameworks you cover and how much control reuse is genuine. The engines disagree on exactly this point, and a clear statement gives them something to resolve it with. How to structure that so an engine can extract it is the subject of the GRC content strategy for AI search visibility.

Do not localize yet. The vendor set was effectively identical in all four markets.

Frequently Asked Questions

How many AI responses did this compliance automation study analyze?

240,000 responses, from 10,000 enterprise buyer-intent queries issued to six AI engines across four markets in August 2026. The corpus contained 3,231,000 cited sources and 117 distinct product entries.

Which compliance automation vendor has the highest AI search visibility?

Vanta, with 139,000 mentions across the study, ahead of Drata at 123,000. Both were named by all six engines tested, and Vanta led in all four markets.

Do all AI engines cite the same sources for compliance software recommendations?

No. Mean cited-domain overlap between engine pairs was 0.12 on a scale where 1 is identical. The highest overlap recorded anywhere was 0.34, between two surfaces run by the same parent.

What percentage of AI-cited sources are dead links?

19.7% across this study, ranging from 10.5% to 23.2% depending on the engine.

Does AI search visibility differ by country for compliance tools?

Not materially in this study. Vanta took first position in the United States, Canada, India and Germany, and the other leading positions came from just three vendors across all four markets.

Final Thoughts

The engines agree about vendors and disagree about evidence. 14 of 30 brands were named by all six, two of them took 24.1% of all mentions, and Vanta led every market — while the engines behind those answers shared an average of 0.12 of their cited domains.

For a vendor in this category the shape matters more than any single number. Visibility is concentrated into roughly a dozen names the engines reuse across markets and phrasings, and it is reached through six largely separate evidence bases. Entering that group is a different problem from improving a position inside it, and it has to be solved once per engine.

The full methodology, the per-engine tables and the validity limits are in the complete benchmark report.