How four AI search engines, ChatGPT, Gemini, Google AI Overview and Google AI Mode, answer buyer-intent questions about enterprise SIEM and security operations platforms across the United States, Canada, India and Germany.
A multi-engine benchmark of how four AI search engines answer buyer-intent questions about enterprise security information and event management (SIEM). Covers 160,000 analysed responses to 10,000 buyer-intent queries across ChatGPT, Gemini, Google AI Overview and Google AI Mode in the United States, Canada, India and Germany, together with 954,000 cited sources classified by source type, 921,000 brand mentions across 100 brand entries and 121 distinct product entries. Reports vendor share of voice, first-mention position, cross-engine cited-source overlap measured by Jaccard similarity, market-by-market variance, and link reachability.
Microsoft is the most-mentioned brand in every engine and every market, with 161,000 of 921,000 brand mentions, and Microsoft Sentinel leads the product entries. The engines agree on the shortlist but not on the evidence: no pair shares more than 0.29 of its cited domains, and the vendor-site share of citations runs from 94.9% in ChatGPT to 30.5% in Google AI Overview. A visibility programme measured on one engine does not generalise to another, and the report quantifies that gap for SIEM vendors.
The opening pages of the PDF, reproduced here: study scale, abstract, table of contents and introduction. Download the full report for the results, discussion and appendices.
Responses recorded and sources cited, per engine.
| AI engine | Responses | Cited sources | Markets |
|---|---|---|---|
| ChatGPT | 40,000 | 216,000 | 4 |
| Gemini | 40,000 | 124,000 | 4 |
| Google AI Overview | 40,000 | 393,000 | 4 |
| Google AI Mode | 40,000 | 221,000 | 4 |
| Total | 160,000 | 954,000 | 4 |
Enterprise security buyers increasingly meet their first vendor shortlist inside an AI-generated response, so the vendors an AI engine names now shape the consideration set before any vendor is contacted. This study measures how four commercial AI search engines answer buyer-intent questions about enterprise security information and event management (SIEM). A set of 10,000 buyer-intent queries, built from five core buyer questions and reworded variants of each, was issued to ChatGPT, Gemini, Google AI Overview and Google AI Mode in the United States, Canada, India and Germany during October 2026. The 160,000 AI engine responses carried 954,000 cited sources. For every response the study recorded length, citations, cited domains, source reachability, hedging, recency anchoring, truncation, and each brand and product mention with its ordinal position. Microsoft is the most-mentioned brand in every engine and every market, with 161,000 of 921,000 brand mentions, and Microsoft Sentinel is the most-mentioned product entry at 118,000 mentions. The engines agree far less on evidence than on vendors: no pair of engines shares more than 0.29 of its cited domains, measured by the Jaccard coefficient. Citation behaviour diverges sharply, from 0.6 citations per 100 words in Gemini to 4.6 in Google AI Overview, and from a 94.9% vendor-site share of ChatGPT citations to 30.5% for Google AI Overview. The results show a stable shortlist produced from largely separate evidence bases, which means a measurement taken on one engine does not describe the others.
An AI search engine does not return a list of documents for the reader to rank. It returns a composed response that names a small number of vendors, places them in an order and attaches a reason to each. For a high-consideration enterprise security purchase, that single response performs work a buyer once spread across analyst notes, peer conversations and many search results. It sets the category boundary, states the evaluation criteria and nominates the candidates.
The consequence for a vendor is structural rather than competitive. A vendor absent from the returned shortlist is not losing on price, capability or references. It is simply not present when the consideration set forms. Conventional search metrics do not detect this condition: a vendor can rank well for its category terms and still be missing from the responses that increasingly come before a click.
Security information and event management is a suitable instrument for four reasons. First, the vendor set is mature and heavily documented: the engines in this study named 100 distinct brand entries, and a group of 20 brands appears in all four engines. Second, the evaluation criteria are stable and publicly articulated. The engine responses recorded here repeatedly organise the category around the same capabilities: detection mapped to MITRE ATT&CK, user and entity behaviour analytics (UEBA), threat intelligence integration, built-in security orchestration, automation and response (SOAR), and the cost of log ingestion and retention. That shared vocabulary makes responses comparable across engines, markets and phrasings.
Third, the buying process is research-heavy: the core questions used here describe replacing a legacy SIEM, equipping a small security operations centre (SOC), and consolidating alerts from many tools. Fourth, a SIEM sits at the centre of security operations and is costly to replace, so omission from an early shortlist is hard to recover from later in the cycle.
This study contributes a directly measured, cross-engine baseline for a single enterprise security category. It reports brand visibility and ordinal position separately rather than merging them into one share-of-voice figure. It quantifies how far the engines draw on shared or separate evidence, which determines whether a measurement on one engine generalises to another. It records length, citation density, source type and cited-source reachability as properties of the category's AI search layer. Finally, it tests whether the leading vendors hold their position when the buyer question changes.
Research questions, methodology, results, discussion and appendices.
Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.
7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.
