What it covers
A multi-engine benchmark of how four AI search engines answer buyer-intent questions about enterprise passwordless authentication. Covers 160,000 analysed responses to 10,000 buyer-intent queries across ChatGPT, Gemini, Google AI Overview and Google AI Mode in the United States, Canada, India and Germany, together with 1,018,000 cited sources classified by source type, 72 brand entities and 153 distinct product entries. Reports vendor share of voice, first-mention position, cross-engine cited-source overlap measured by Jaccard similarity, market-by-market variance, and link reachability.
Why essential
Microsoft records the most brand mentions in every engine and Microsoft Entra ID opens the response in three of the four, yet below that leader visibility fragments across 153 product entries and 28 of 72 brands appear in only one engine. The highest cross-engine source overlap is a Jaccard coefficient of 0.30 and cited-source volume differs by a factor of 4.1 between engines, so a single-engine measurement does not describe the category. The report quantifies that gap for passwordless authentication vendors.
What the full report contains
The opening pages of the PDF, reproduced here: study scale, abstract, table of contents and introduction. Download the full report for the results, discussion and appendices.
- 10,000 Buyer-intent queries
- 160,000 AI engine responses
- 4 AI engines
- 4 Markets
- 1,018,000 Cited sources
- 153 Distinct product entries
- Published
- October 2026
- Research period
- October 2026
- Category
- Enterprise passwordless authentication (FIDO2 and WebAuthn passkeys, phishing-resistant MFA, device-bound credentials)
- Prepared by
- GrackerAI · AI Search Visibility Benchmark Series
Table 1. Study scale by AI engine
Responses recorded and sources cited, per engine.
| AI engine | Responses | Cited sources | Markets |
|---|---|---|---|
| ChatGPT | 40,000 | 284,000 | 4 |
| Gemini | 40,000 | 92,000 | 4 |
| Google AI Overview | 40,000 | 380,000 | 4 |
| Google AI Mode | 40,000 | 262,000 | 4 |
| Total | 160,000 | 1,018,000 | 4 |
Abstract
Enterprise buyers increasingly meet their first vendor shortlist inside an AI-generated response rather than on a page of search results, so the vendors an AI engine names now shape the consideration set before any vendor is contacted. This study measures how four commercial AI search engines respond to buyer-intent questions about enterprise passwordless authentication. A set of 10,000 buyer-intent queries was issued to ChatGPT, Gemini, Google AI Overview and Google AI Mode in the United States, Canada, India and Germany during October 2026, producing 160,000 analysed AI engine responses and 1,018,000 cited sources. For each response the study recorded length, citations, cited domains, link reachability, hedging, truncation, refusal, and every brand and product mention with its ordinal position. The engines agree on the leading vendor: Microsoft records 148,000 brand mentions, the highest count in every engine, and Microsoft Entra ID is the first-mention entity in three of the four engines. They diverge on evidence. The highest cross-engine source overlap is a Jaccard coefficient of 0.30, and cited-source volume differs by a factor of 4.1 between Google AI Overview and Gemini. Cited links are largely intact, with an aggregate dead-link rate of 1.0%. Visibility below the leading vendor is fragmented across 153 distinct product entries. The results indicate that vendor ordering is stable across engines and markets while the evidence base behind it is not shared, so a single-engine measurement does not describe the category.
Contents
- 1. Introduction
- 1.1 Background
- 1.2 Why this category
- 1.3 Contribution
- 2. Research Questions
- 3. Methodology
- 3.1 Study design
- 3.2 Engines under test
- 3.3 Markets
- 3.4 Query construction
- 3.5 Corpus and unit of analysis
- 3.6 Metric definitions
- 3.7 Data collection and processing
- 3.8 Scope exclusions
- 4. Results
- 4.1 Response characteristics by engine
- 4.2 Brand visibility and share of voice
- 4.3 Product-level results
- 4.4 Citation volume and source concentration
- 4.5 Source quality and link decay
- 4.6 Cross-engine source overlap
- 4.7 First-mention position
- 4.8 Geographic variance
- 4.9 Inter-engine disagreement on factual claims
- 5. Discussion
- 6. Threats to Validity
- 7. Limitations
- 8. Practical Implications
- 9. Conclusion
- 10. Reproducibility and Data Availability
- Disclosure
- How to cite this report
- Appendix A. Brand visibility by AI engine
- Appendix B. Source mix and most-cited domains
- Appendix C. Product entries
- Appendix D. Query set and markets
- Appendix E. Metric computation
1. Introduction
1.1 Background
An AI search engine does not return a ranked list of documents. It returns a composed response that names a small number of vendors, places them in an order, and attaches reasons to each. For an enterprise security purchase, that single response performs work a buyer once spread across analyst notes, review sites and vendor pages. It sets the category boundary, proposes evaluation criteria and nominates candidates.
The consequence for a vendor is structural. A vendor absent from the returned shortlist is not losing on price or capability. It is absent at the moment the consideration set forms. Conventional search metrics do not detect this condition, since a vendor can hold strong organic rankings and still be omitted from the responses that now precede a click.
Measuring the condition requires observing the engines directly. That means issuing the questions a buyer would ask, recording the responses as returned, and analysing which vendors appear, in what order, and on the strength of which cited evidence. This study applies that method to one category in one collection window.
1.2 Why this category
Enterprise passwordless authentication suits this kind of measurement for four reasons. First, the vendor set is mature and documented at length, so engines have substantial published material to draw on. Second, the evaluation vocabulary is stable. Engine responses in this corpus organise the category around FIDO2 and WebAuthn passkeys, phishing resistance, device-bound versus synced credentials, and integration with existing identity and single sign-on infrastructure. That shared vocabulary makes responses comparable across engines, markets and phrasings.
Third, buying is research-heavy. The core questions behind the query set range from a direct request for the best solutions in 2026 to a practitioner's description of users being phished through push notifications and one-time codes. Fourth, the cost of invisibility is high. An authentication decision touches every workforce login, and the responses recorded here weigh platform breadth against lock-in, hardware assurance against logistics, and overlay products against an additional policy surface. A vendor omitted early in that evaluation is difficult to reinstate later.
1.3 Contribution
This study contributes a directly observed, cross-engine baseline for one enterprise security category. It reports brand visibility, product visibility and ordinal position as separate measures rather than one share-of-voice figure. It quantifies how far the engines draw on shared or disjoint evidence, which determines whether a measurement taken on one engine transfers to another. It also records the construction of engine output itself, including response length, source variety and cited-link reachability, as properties of the category's AI search layer.
Research questions, methodology, results, discussion and appendices.
