A multi-engine, multi-market benchmark study of how six AI search engines — ChatGPT, Perplexity, Gemini, Microsoft Copilot, Google AI Overview and Google AI Mode — answer buyer-intent questions about enterprise third-party risk management, vendor risk monitoring and questionnaire automation across the United States, Canada, Germany, India and Australia.
A multi-engine benchmark of how six AI search engines answer buyer-intent questions about enterprise third-party risk management, vendor risk monitoring and questionnaire automation. Covers 300,000 AI engine responses drawn from 10,000 queries across ChatGPT, Microsoft Copilot, Gemini, Google AI Mode, Google AI Overview and Perplexity in five markets, together with 1,551,000 cited sources classified by source type and 127 distinct product entries. Reports vendor share of voice, first-mention position against mention volume, cross-engine cited-source overlap measured by Jaccard similarity, market-by-market leading brands, and the share of cited pages that sit on vendors' own sites.
OneTrust is the most-mentioned brand across 300,000 responses and the first-mention vendor in none of the six engines, while Bitsight holds that position in three: mention volume and ordinal position identify different leaders. The engines agree on nine of 72 brand strings but share a mean of only 0.19 of their cited domains, and 52.2% of everything they cite sits on vendors' own sites, with only 0.2% dead. The report separates the three measures and gives the per-engine and per-market tables behind them.
The opening pages of the PDF, reproduced here: study scale, abstract, table of contents and introduction. Download the full report for the results, discussion and appendices.
Responses recorded and sources cited, per engine.
| AI engine | Responses | Cited sources | Markets |
|---|---|---|---|
| ChatGPT | 50,000 | 567,000 | 5 |
| Microsoft Copilot | 50,000 | 213,000 | 5 |
| Gemini | 50,000 | 119,000 | 5 |
| Google AI Mode | 50,000 | 170,000 | 5 |
| Google AI Overview | 50,000 | 449,000 | 5 |
| Perplexity | 50,000 | 33,000 | 5 |
| Total | 300,000 | 1,551,000 | 5 |
A buyer assembling a third-party risk management shortlist now begins inside a generated response, so the vendor set an AI engine returns forms the consideration set before any vendor is contacted. This study measures how six commercial AI search engines answer buyer-intent questions about enterprise third-party risk management. Each engine received 10,000 enterprise buyer-intent queries in each of five markets during a single collection window in August 2026, producing 300,000 responses that contained 1,551,000 cited sources and covered 127 distinct product entries. For every response the study recorded length, cited pages and their source type, page reachability, hedging, recency anchoring, truncation, refusal, and each brand mention with its ordinal position. The engines converge on a broad core: 9 of 72 brand strings were named by all six engines, led by OneTrust at 205,000 mentions, UpGuard at 165,000 and Bitsight at 161,000. The brand named most often is the brand named first in none of the six engines; Bitsight opens three, and OneTrust averages the third or fourth position in every engine. The engines cite largely separate domains, with a mean pairwise overlap of 0.19, and no two engines share a most-cited domain, yet 52.2% of everything they cite sits on a vendor's own site. Dead links are rare, at 0.2% of cited pages. OneTrust leads every one of the five markets; only the second and third positions move.
An enterprise buyer evaluating third-party risk management now begins inside a generated response. The buyer asks an AI search engine which platforms monitor suppliers continuously, automate the security questionnaire, and connect to the ticketing and procurement systems already in place. The engine returns a short ordered list of named vendors with a paragraph of justification for each. That list is not a ranking of the market. It is the output of one system reading one collection of web sources at one moment, and it arrives before the buyer has opened a single vendor site.
The structural consequence is narrow. A vendor absent from the returned list is not ranked low; it is not present. A generated response has no second page, so the buyer has no mechanism equivalent to scrolling further. Where a search results page offered ten positions and a set of related queries, a generated response typically names between three and seven vendors and closes. Visibility in this setting is closer to inclusion than to ranking, and the difference between being inside and outside the returned set is discontinuous.
A second consequence follows for vendors that are inside the set. A generated response is read in order, and the first name it gives carries a weight the fourth does not. Being named is one result; being named first is another; being named early on average is a third. This study records all three separately because, as §4.7 shows, the category's most-mentioned vendor holds the first of them and neither of the others.
Enterprise third-party risk management is a suitable instrument for this measurement. The vendor set is mature and well documented, so the engines have abundant published material to draw on, and 9 of the 72 brand strings recorded were named by every engine. A category with a settled core isolates engine behaviour from genuine market churn.
The category also has a stable and publicly articulated capability vocabulary. Across the corpus the engines returned the same selection factors: continuous external monitoring through security ratings, automated questionnaire and evidence workflows, and integration with service-management and procurement systems. These criteria are specific enough that responses can be compared to each other rather than to a general description of governance software.
Buying behaviour in the category is procurement-led and the cycles are long, so the cost of omission from an early shortlist is high and difficult to reverse. A vendor omitted from the generated shortlist loses the opportunity at the earliest stage, before any conversation in which the omission could be corrected.
This study provides four things a single-engine measurement does not. It establishes how far six engines agree on the vendor set in one category, separating the shared core from the tail each engine holds alone. It measures the overlap between the engines' evidence bases directly, as a pairwise coefficient over cited domains, and classifies every cited page by source type, so that agreement on vendors can be set against what the engines actually read. It reports mention volume, first-mention position and mean ordinal position as three separate quantities, which allows them to be shown moving independently. And it tests the vendor set across five markets in the same window, which distinguishes market-specific results from a set the engines return everywhere. All four rest on a single corpus of 300,000 responses collected under one design.
Research questions, methodology, results, discussion and appendices.
Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.
7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.
