A multi-engine, multi-market benchmark study of how six AI search engines — ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview and Google AI Mode — answer buyer-intent questions about enterprise password management, credential vaulting and workforce secrets across the United States, Canada, India and Germany.
A multi-engine benchmark of how six AI search engines answer buyer-intent questions about enterprise password management. Covers 240,000 AI engine responses drawn from 10,000 queries across ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview and Google AI Mode in four markets, together with 4,592,000 cited sources classified by source type and 31 distinct product entries. Reports vendor share of voice, first-mention position against mean ordinal position, cross-engine cited-source overlap measured by Jaccard similarity, the vendor-site share of each engine's evidence, market-by-market variance, and link reachability.
The most-mentioned vendor is not the vendor the engines name first: Bitwarden leads on mentions while 1Password opens the response in four of six engines, and one engine disagrees with itself on the two measures. The report separates mention volume, first-mention position and mean position, shows the engines reaching the same shortlist from evidence bases that overlap by 0.14, and finds that vendor sites carry 59% of all citations while dead links are under 1%.
The opening pages of the PDF, reproduced here: study scale, abstract, table of contents and introduction. Download the full report for the results, discussion and appendices.
Responses recorded and sources cited, per engine.
| AI engine | Responses | Cited sources | Markets |
|---|---|---|---|
| ChatGPT | 40,000 | 2,730,000 | 4 |
| Microsoft Copilot | 40,000 | 171,000 | 4 |
| Gemini | 40,000 | 147,000 | 4 |
| Google AI Mode | 40,000 | 691,000 | 4 |
| Google AI Overview | 40,000 | 471,000 | 4 |
| Perplexity | 40,000 | 382,000 | 4 |
| Total | 240,000 | 4,592,000 | 4 |
Enterprise buyers now begin a password-management evaluation inside a generated response, so the vendor set an AI engine returns forms the consideration set before any vendor is contacted. This study measures how six commercial AI search engines answer buyer-intent questions about enterprise password management. Each engine received 10,000 enterprise buyer-intent queries in each of four markets during a single collection window in August 2026, producing 240,000 responses that contained 4,592,000 cited sources and covered 31 distinct product entries. For every response the study recorded length, cited pages and their source type, page reachability, hedging, recency anchoring, truncation, refusal, and each brand mention with its ordinal position. The engines converge on a narrow vendor set: 7 of 33 brand strings were named by all six engines. The three leading brands took 61.5% of all mentions, led by Bitwarden at 235,000, Keeper at 218,000 and 1Password at 214,000. The brand named most often is not the brand named first: 1Password holds the first-mention position in 4 of the six engines, and Keeper holds it in none. The engines cite largely separate domains, with a mean pairwise overlap of 0.14, yet 58.9% of everything they cite sits on a vendor's own site. Dead links are rare, at 0.9% of cited pages, and the same three brands lead all four markets in the same order.
An enterprise buyer selecting a password manager now begins inside a generated response. The buyer asks an AI search engine which products support single sign-on, directory provisioning and audit reporting for a workforce of several hundred people. The engine returns a short ordered list of named vendors with a paragraph of justification for each. That list is not a ranking of the market. It is the output of one system reading one collection of web sources at one moment, and it arrives before the buyer has opened a single vendor site.
The structural consequence is narrow. A vendor absent from the returned list is not ranked low; it is not present. A generated response has no second page, so the buyer has no mechanism equivalent to scrolling further. Where a search results page offered ten positions and a set of related queries, a generated response typically names between three and six vendors and closes. Visibility in this setting is closer to inclusion than to ranking, and the difference between being inside and outside the returned set is discontinuous.
The measurement problem that follows is that no single engine describes the market. Engines differ in the sources they read, the length at which they answer, and the order in which they name vendors. A vendor that measures its position in one engine learns about that engine. This study measures six at once, in four markets, over one collection window, so that agreement and divergence between them can be separated from the behaviour of any one system.
Enterprise password management is a suitable instrument for this measurement. The vendor set is mature and bounded: the engines in this study named a small core of established vaulting vendors, and 7 of the 33 brand strings recorded were named by every engine. A category with a settled vendor population isolates engine behaviour from genuine market churn.
The evaluation criteria are stable and technical. Across the corpus the engines returned the same selection factors: SOC 2 attestation, HIPAA alignment, role-based access control, SCIM provisioning, SAML single sign-on, audit logging and passkey support. To those they add the choice between a self-hosted deployment and a vendor-hosted one. These criteria are specific enough that responses can be compared to each other rather than to a general description of security software.
Buying behaviour in the category is research-heavy and the cost of invisibility is high. The product is chosen by security and IT teams who shortlist before contacting vendors, and the chosen vault holds every other credential the organisation owns. A vendor omitted from the generated shortlist loses the opportunity at the earliest stage of the cycle, before any conversation in which the omission could be corrected.
This study provides four things a single-engine measurement does not. It establishes how far six engines agree on the vendor set in one category, separating the shared core from the tail each engine holds alone. It measures the overlap between the engines' evidence bases directly, as a pairwise coefficient over cited domains, and classifies every cited page by source type, so that agreement on vendors can be set against what the engines actually read. It reports mention volume, first-mention position and mean ordinal position as three separate quantities, which allows them to be shown moving independently. And it tests the vendor set across four markets in the same window, which distinguishes market-specific results from a set the engines return everywhere. All four rest on a single corpus of 240,000 responses collected under one design.
Research questions, methodology, results, discussion and appendices.
Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.
7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.
