A multi-engine, multi-market benchmark study of how six AI search engines — ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview and Google AI Mode — answer buyer-intent questions about compliance automation, governance, risk and compliance software and integrated risk management across the United States, Canada, India and Germany.
A multi-engine benchmark of how six AI search engines answer buyer-intent questions about compliance automation, governance-risk-and-compliance software and integrated risk management. Covers 240,000 AI engine responses drawn from 10,000 queries across ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview and Google AI Mode in four markets, together with 3,464,000 cited sources classified by source type and 99 distinct product entries. Reports vendor share of voice, first-mention position, cross-engine cited-source overlap measured by Jaccard similarity, market-by-market variance, and the share of cited pages that sit on vendors' own sites.
Six engines converge on Vanta and Drata while citing largely separate evidence: cited-domain overlap averages a Jaccard coefficient of 0.11 and the highest pair reaches 0.27, between two Google surfaces, so a visibility programme measured on one engine does not transfer to another. The report separates mention volume from ordinal position, shows MetricStream read earlier than Vanta in four of six engines, and finds 41.7% of cited pages on vendors' own sites with only 1.6% dead.
The opening pages of the PDF, reproduced here: study scale, abstract, table of contents and introduction. Download the full report for the results, discussion and appendices.
Responses recorded and sources cited, per engine.
| AI engine | Responses | Cited sources | Markets |
|---|---|---|---|
| ChatGPT | 40,000 | 1,690,000 | 4 |
| Microsoft Copilot | 40,000 | 152,000 | 4 |
| Gemini | 40,000 | 124,000 | 4 |
| Google AI Mode | 40,000 | 735,000 | 4 |
| Google AI Overview | 40,000 | 438,000 | 4 |
| Perplexity | 40,000 | 325,000 | 4 |
| Total | 240,000 | 3,464,000 | 4 |
Enterprise compliance buyers now begin an evaluation inside a generated response, so the vendor set an AI engine returns forms the consideration set before any vendor is contacted. This study measures how six commercial AI search engines answer buyer-intent questions about enterprise compliance automation, governance, risk and compliance software and integrated risk management. Each engine received 10,000 enterprise buyer-intent queries in each of four markets during a single collection window in August 2026, producing 240,000 responses that contained 3,464,000 cited sources and covered 99 distinct product entries. For every response the study recorded length, cited pages and their source type, page reachability, hedging, recency anchoring, truncation, refusal, and each brand mention with its ordinal position. The engines converge on a core: 13 of 99 brand strings were named by all six engines, led by Vanta at 139,000 mentions and Drata at 123,000. Below that core visibility is thin, with 60 brand strings named by a single engine. The brand named most often opens the response in only 3 of the six engines, and MetricStream is read earlier on average in 4 of them. The engines cite largely separate domains, with a mean pairwise overlap of 0.11, and 41.7% of everything they cite sits on a vendor's own site, a lower share than one engine alone would suggest: ChatGPT contributes 48.8% of all citations and draws 59.2% of them from vendor domains. Dead links are rare, at 1.6% of cited pages. The same two brands lead every market in the same order.
An enterprise buyer evaluating compliance software now begins inside a generated response. The buyer asks an AI search engine which platforms automate evidence collection for SOC 2 and ISO 27001, which map one control set across several frameworks, or which integrated risk management suite fits an organisation already running a workflow platform. The engine returns a short ordered list of named vendors with a paragraph of justification for each. That list is not a ranking of the market. It is the output of one system reading one collection of web sources at one moment, and it arrives before the buyer has opened a single vendor site.
The structural consequence is narrow. A vendor absent from the returned list is not ranked low; it is not present. A generated response has no second page, so the buyer has no mechanism equivalent to scrolling further. Where a search results page offered ten positions and a set of related queries, a generated response typically names between three and six vendors and closes. Visibility in this setting is closer to inclusion than to ranking, and the difference between being inside and outside the returned set is discontinuous.
The measurement problem that follows is that no single engine describes the market. Engines differ in the sources they read, the length at which they answer, and the order in which they name vendors. A vendor that measures its position in one engine learns about that engine. This study measures six at once, in four markets, over one collection window, so that agreement and divergence between them can be separated from the behaviour of any one system.
Enterprise compliance automation is a suitable instrument for this measurement. The evaluation criteria are stable and externally defined, because the frameworks that structure the category — SOC 2, ISO 27001, GDPR, PCI DSS and HIPAA — are published standards rather than vendor constructs, and 13 of the 99 brand strings recorded were named by every engine. A category with a settled core isolates engine behaviour from genuine market churn.
The category also spans two buying motions that one query set can separate. Compliance automation platforms address framework readiness and continuous evidence collection; integrated risk management suites address enterprise risk workflow at a different price and implementation scale. Across the corpus the engines returned both in answer to overlapping questions, grouping Vanta, Drata, Secureframe and Sprinto for multi-framework coverage and ServiceNow, MetricStream, Archer, IBM and LogicGate for large configurable programmes, which lets the study observe whether the engines distinguish between the two.
Buying behaviour in the category is research-intensive. Purchases are preceded by framework scoping, auditor selection and readiness assessment, and much of that research is now conducted through generated answers. The cost of omission from an early shortlist is correspondingly high: a platform absent from the generated shortlist is absent from the readiness conversation that precedes the purchase.
This study provides four things a single-engine measurement does not. It establishes how far six engines agree on the vendor set in one category, separating the shared core from the long tail each engine holds alone. It measures the overlap between the engines' evidence bases directly, as a pairwise coefficient over cited domains, and classifies every cited page by source type, so that agreement on vendors can be set against what the engines actually read. It reports mention volume, first-mention position and mean ordinal position as three separate quantities, which allows them to be shown moving independently. And it tests the vendor set across four markets in the same window, which distinguishes market-specific results from a set the engines return everywhere. All four rest on a single corpus of 240,000 responses collected under one design.
Research questions, methodology, results, discussion and appendices.
Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.
7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.
