Microsoft Security: 211/288 (73.3%; 95% interval 67.9–78.0%). CrowdStrike: 171/288 (59.4%; 95% interval 53.6–64.9%).
TECH & B2B
Cybersecurity Index 2.0: Microsoft Security Leads
Published June 28, 2026 · Updated November 9, 2026
AI answers analyzed across ChatGPT, Claude, Gemini and Perplexity
of answers named Microsoft Security, the most-named (211 of 288)
tracked vendors named at least once (of 42)
of Google searches showed an AI Overview (57 of 57)
Version 2. This version replaces the first version of this study, first published August 15, 2026. It uses measured counts, so the two versions are not comparable. Version 2 asks 24 questions three times each on ChatGPT, Claude, Gemini and Perplexity (288 answers) and adds Google AI Overviews. Every rate comes with its count and a 95% interval.
What the data shows
Microsoft Security
56/288 (19.4%)
56/288 (19.4%)
57/57 (100%)
38/57 (66.7%)
133/288 (46.2%)
Appearance rate across 288 four-engine answers. The bar is the 95% confidence interval; overlapping bars cannot be told apart at this sample size.
Which brands AI engines name
| # | Name | Named in | Appearance rate | 95% interval |
|---|---|---|---|---|
| 1 | Microsoft Security | 211/288 | 73.3% | 67.9–78.0% |
| 2 | CrowdStrike | 171/288 | 59.4% | 53.6–64.9% |
| 3 | Palo Alto Networks | 162/288 | 56.3% | 50.5–61.9% |
| 4 | SentinelOne | 90/288 | 31.3% | 26.2–36.8% |
| 5 | Cisco | 77/288 | 26.7% | 22.0–32.1% |
| 6 | Check Point | 62/288 | 21.5% | 17.2–26.6% |
| 7 | Fortinet | 59/288 | 20.5% | 16.2–25.5% |
| 8 | Okta | 54/288 | 18.8% | 14.7–23.7% |
| 9 | Zscaler | 51/288 | 17.7% | 13.7–22.5% |
| 10 | Sophos | 43/288 | 14.9% | 11.3–19.5% |
| 11 | Wiz | 43/288 | 14.9% | 11.3–19.5% |
| 12 | Rapid7 | 40/288 | 13.9% | 10.4–18.4% |
| 13 | CyberArk | 39/288 | 13.5% | 10.1–18.0% |
| 14 | IBM Security | 39/288 | 13.5% | 10.1–18.0% |
| 15 | Mandiant | 37/288 | 12.8% | 9.5–17.2% |
The full list
Own-domain citation is the share of 288 grounded answers that cited the tracked name's own domains (subdomains included). Citation share is of all 2,453 citations.
| # | Brand | Named in | Appearance rate | 95% interval | First mention | Own-domain citation | Citation share |
|---|---|---|---|---|---|---|---|
| 1 | Microsoft Security | 211/288 | 73.3% | 67.9–78% | 2.8 | 4.9% (14/288) | 0.6% |
| 2 | CrowdStrike | 171/288 | 59.4% | 53.6–64.9% | 2.6 | 13.2% (38/288) | 1.9% |
| 3 | Palo Alto Networks | 162/288 | 56.3% | 50.5–61.9% | 2.7 | 19.4% (56/288) | 2.4% |
| 4 | SentinelOne | 90/288 | 31.3% | 26.2–36.8% | 4.6 | 14.2% (41/288) | 1.8% |
| 5 | Cisco | 77/288 | 26.7% | 22–32.1% | 5.1 | 1.7% (5/288) | 0.2% |
| 6 | Check Point | 62/288 | 21.5% | 17.2–26.6% | 6 | 9.7% (28/288) | 1.1% |
| 7 | Fortinet | 59/288 | 20.5% | 16.2–25.5% | 4.5 | 6.3% (18/288) | 0.7% |
| 8 | Okta | 54/288 | 18.8% | 14.7–23.7% | 3.9 | 3.8% (11/288) | 0.4% |
| 9 | Zscaler | 51/288 | 17.7% | 13.7–22.5% | 4.5 | 1.7% (5/288) | 0.2% |
| 10 | Sophos | 43/288 | 14.9% | 11.3–19.5% | 4.9 | 3.1% (9/288) | 0.4% |
| 11 | Wiz | 43/288 | 14.9% | 11.3–19.5% | 3.5 | 2.8% (8/288) | 0.4% |
| 12 | Rapid7 | 40/288 | 13.9% | 10.4–18.4% | 3.5 | 4.5% (13/288) | 0.5% |
| 13 | CyberArk | 39/288 | 13.5% | 10.1–18% | 5 | 0% (0/288) | 0% |
| 14 | IBM Security | 39/288 | 13.5% | 10.1–18% | 6.1 | 0% (0/288) | 0% |
| 15 | Mandiant | 37/288 | 12.8% | 9.5–17.2% | 3.6 | 0% (0/288) | 0% |
| 16 | Cloudflare | 35/288 | 12.2% | 8.9–16.4% | 6.2 | 1% (3/288) | 0.1% |
| 17 | Trend Micro | 28/288 | 9.7% | 6.8–13.7% | 6.8 | 2.1% (6/288) | 0.2% |
| 18 | Proofpoint | 27/288 | 9.4% | 6.5–13.3% | 2.7 | 1.7% (5/288) | 0.2% |
| 19 | SailPoint | 27/288 | 9.4% | 6.5–13.3% | 4.3 | 0.7% (2/288) | 0.1% |
| 20 | Splunk | 27/288 | 9.4% | 6.5–13.3% | 5.5 | 0.7% (2/288) | 0.1% |
| 21 | Orca Security | 26/288 | 9% | 6.2–12.9% | 3.5 | 3.1% (9/288) | 0.4% |
| 22 | Netskope | 25/288 | 8.7% | 5.9–12.5% | 4.2 | 1% (3/288) | 0.1% |
| 23 | Abnormal Security | 24/288 | 8.3% | 5.7–12.1% | 2.9 | 0% (0/288) | 0% |
| 24 | Ping Idtracked name | 24/288 | 8.3% | 5.7–12.1% | 3 | 1.7% (5/288) | 0.2% |
| 25 | Arctic Wolf | 22/288 | 7.6% | 5.1–11.3% | 5.4 | 0% (0/288) | 0% |
| 26 | Mimecast | 21/288 | 7.3% | 4.8–10.9% | 3.6 | 0.7% (2/288) | 0.1% |
| 27 | Google Security Operations | 20/288 | 6.9% | 4.5–10.5% | 2.4 | 1% (3/288) | 0.1% |
| 28 | Tenable | 19/288 | 6.6% | 4.3–10.1% | 3.3 | 0.7% (2/288) | 0.1% |
The full list (continued)
None means no own site is tracked for that name.
| # | Brand | Named in | Appearance rate | 95% interval | First mention | Own-domain citation | Citation share |
|---|---|---|---|---|---|---|---|
| 29 | Huntress | 18/288 | 6.3% | 4–9.7% | 4.9 | 6.6% (19/288) | 1% |
| 30 | BeyondTrust | 17/288 | 5.9% | 3.7–9.2% | 3.8 | 1.4% (4/288) | 0.2% |
| 31 | Delinea | 17/288 | 5.9% | 3.7–9.2% | 3.4 | 2.1% (6/288) | 0.3% |
| 32 | Bitdefender | 15/288 | 5.2% | 3.2–8.4% | 5.5 | 1% (3/288) | 0.1% |
| 33 | Kroll | 15/288 | 5.2% | 3.2–8.4% | 4.7 | 1% (3/288) | 0.1% |
| 34 | Sysdig | 11/288 | 3.8% | 2.1–6.7% | 4.7 | 1% (3/288) | 0.1% |
| 35 | Trellix | 8/288 | 2.8% | 1.4–5.4% | 7.5 | 0% (0/288) | 0% |
| 36 | Cynet | 4/288 | 1.4% | 0.5–3.5% | 7.5 | 8% (23/288) | 0.9% |
| 37 | Exabeam | 4/288 | 1.4% | 0.5–3.5% | 4.5 | 2.1% (6/288) | 0.2% |
| 38 | Upwind | 4/288 | 1.4% | 0.5–3.5% | 5.8 | 3.1% (9/288) | 0.4% |
| 39 | ThreatLocker | 3/288 | 1% | 0.4–3% | 6.3 | 0% (0/288) | 0% |
| 40 | Halcyon | 2/288 | 0.7% | 0.2–2.5% | 7 | 0% (0/288) | 0% |
| 41 | Lacework | 2/288 | 0.7% | 0.2–2.5% | 5 | None | None |
| 42 | Securonix | 0/288 | 0% | 0–1.3% | – | 0% (0/288) | 0% |
The top eight, side by side
| # | Name | Appearance rate | Answers and interval | Other measures |
|---|---|---|---|---|
| 1 | Microsoft Security | 73.3% | 211/288 answers · 95% CI 67.9–78% | first-mention position: 2.8; owned-domain citation (14/288): 4.9%; citation share: 0.6% |
| 2 | CrowdStrike | 59.4% | 171/288 answers · 95% CI 53.6–64.9% | first-mention position: 2.6; owned-domain citation (38/288): 13.2%; citation share: 1.9% |
| 3 | Palo Alto Networks | 56.3% | 162/288 answers · 95% CI 50.5–61.9% | first-mention position: 2.7; owned-domain citation (56/288): 19.4%; citation share: 2.4% |
| 4 | SentinelOne | 31.3% | 90/288 answers · 95% CI 26.2–36.8% | first-mention position: 4.6; owned-domain citation (41/288): 14.2%; citation share: 1.8% |
| 5 | Cisco | 26.7% | 77/288 answers · 95% CI 22–32.1% | first-mention position: 5.1; owned-domain citation (5/288): 1.7%; citation share: 0.2% |
| 6 | Check Point | 21.5% | 62/288 answers · 95% CI 17.2–26.6% | first-mention position: 6; owned-domain citation (28/288): 9.7%; citation share: 1.1% |
| 7 | Fortinet | 20.5% | 59/288 answers · 95% CI 16.2–25.5% | first-mention position: 4.5; owned-domain citation (18/288): 6.3%; citation share: 0.7% |
| 8 | Okta | 18.8% | 54/288 answers · 95% CI 14.7–23.7% | first-mention position: 3.9; owned-domain citation (11/288): 3.8%; citation share: 0.4% |
The four engines named the leading names at similar rates.
ChatGPT
72 asked · 72 returned · 72 grounded
Same questions, different answers
Claude
72 asked · 72 returned · 72 grounded
Gemini
72 asked · 72 returned · 72 grounded
Perplexity
72 asked · 72 returned · 72 grounded
Google AI Overviews were captured through 57 U.S. desktop searches and scored only where an overview appeared, so five-engine figures use 288 + 57 = 345 answers.
The fifth engine
Trigger rate: 57 of 57 searches
Google AI Overviews appeared on 57 of 57 searches (100%, CI 93.7–100%). The other 0 searches showed no overview. Within the 57 overviews, Microsoft Security was named in 38 (66.7%), CrowdStrike was named in 31 (54.4%), Palo Alto Networks was named in 26 (45.6%), Okta was named in 16 (28.1%). reddit.com was the most-cited source, with 14 citations and an appearance in 13 of 57 overviews.
| Five-engine rank | Name | Five-engine rate | Four-engine rank |
|---|---|---|---|
| 1 | Microsoft Security | 72.2% | 1 |
| 2 | CrowdStrike | 58.6% | 2 |
| 3 | Palo Alto Networks | 54.5% | 3 |
| 4 | SentinelOne | 30.4% | 4 |
| 5 | Cisco | 25.8% | 5 |
| 6 | Check Point | 21.4% | 6 |
| 7 | Fortinet | 21.2% | 7 |
| 8 | Okta | 20.3% | 8 |
| 9 | Zscaler | 17.4% | 9 |
| 10 | Wiz | 15.4% | 11 |
Who each question surfaces first
Six questions from the set. Each tile uses that question's own four-engine answers as the denominator.
| Question | Leader | Next | AI Overview |
|---|---|---|---|
| Q01 · 12 answers | Palo Alto Networks 100.0% | Microsoft Security 100.0%; CrowdStrike 100.0% | AI Overview shown on 3 of 3 searches |
| Q02 · 12 answers | CrowdStrike 100.0% | SentinelOne 100.0%; Sophos 100.0% | AI Overview shown on 2 of 2 searches |
| Q03 · 12 answers | CrowdStrike 100.0% | Microsoft Security 100.0%; SentinelOne 100.0% | AI Overview shown on 1 of 1 searches |
| Q04 · 12 answers | Palo Alto Networks 100.0% | CrowdStrike 100.0%; Fortinet 100.0% | AI Overview shown on 2 of 2 searches |
| Q05 · 12 answers | Palo Alto Networks 100.0% | Zscaler 100.0%; Microsoft Security 100.0% | AI Overview shown on 3 of 3 searches |
| Q06 · 12 answers | Microsoft Security 100.0% | Rapid7 91.7%; Splunk 58.3% | AI Overview shown on 3 of 3 searches |
The four engines produced 2,453 citations in total. gartner.com was cited most often, with 153 citations (6.2%) across 133 answers. Next came expertinsights.com (75), paloaltonetworks.com (53), crowdstrike.com (45), sentinelone.com (44), g2.com (35).
Four AI engines · share of 288 grounded answers
Most-cited domains
Google AI Overviews · share of 57 overviews
Citation share by source type
Share of all citations by the type of site cited.
| Source type | Four AI engines (of 2,453 citations) | Google AI Overviews (of 152 citations) |
|---|---|---|
| Company / brand sites | 844 (34.4%) | 41 (27%) |
| Other / unclassified | 828 (33.8%) | 57 (37.5%) |
| Research / data providers | 226 (9.2%) | 10 (6.6%) |
| Trade / specialist press | 195 (7.9%) | 1 (0.7%) |
| Review / comparison publishers | 152 (6.2%) | 1 (0.7%) |
| Directories / rankings | 107 (4.4%) | 7 (4.6%) |
| Community / social | 63 (2.6%) | 32 (21.1%) |
| General news / business press | 15 (0.6%) | 1 (0.7%) |
| Reference | 14 (0.6%) | 0 (0%) |
| Official / government | 6 (0.2%) | 2 (1.3%) |
| Institutions / trade bodies | 3 (0.1%) | 0 (0%) |
How can brands improve their AI visibility?
These steps follow from the measured results above. They describe what the engines cited in this study and are not a guarantee of results.
| Step | What this study measured |
|---|---|
| Put your facts on your own domain. | Palo Alto Networks' own domains were cited in 19.4% of grounded answers, SentinelOne's in 14.2% and CrowdStrike's in 13.2%. |
| Keep your facts accurate on the sites engines cite. | The most-cited sites other than the tracked names' own were gartner.com (in 46.2% of grounded answers), expertinsights.com (24.3%), forrester.com (10.1%), g2.com (9.7%) and cybersecuritynews.com (9.7%). Research and data providers supplied 9.2% of citations and trade and specialist press 7.9%. |
| Check each engine separately. | Claude named CrowdStrike in 66.7% of answers against 51.4% on Perplexity. ChatGPT named IBM Security in 19.4% of answers against 4.2% on Gemini. |
| Watch names outside the tracked list. | Microsoft Corporation (50 answers), Wiz (23 answers), Rubrik Security Cloud (12 answers) were named often but were not tracked. |
| Re-run the same questions every month. | Compare counts and intervals, not ranks. The 24 questions are in the appendix. |
What AI answers
Which names lead these AI answers?
Microsoft Security leads this measured set. Microsoft Security: 211/288 (73.3%; 95% interval 67.9–78.0%). CrowdStrike: 171/288 (59.4%; 95% interval 53.6–64.9%).
Which vendor is named first most often?
CrowdStrike was the first vendor named in 56 of 288 answers, with an average first position of 2.6.
How often do Google AI Overviews appear for these questions?
An overview appeared on 57 of 57 searches (100%, CI 93.7–100%). Within those 57 overviews, Microsoft Security was named most often, in 38 (66.7%).
Which sources do the engines cite?
Across 2,453 four-engine citations, gartner.com was cited most (153 citations, in 133 of 288 grounded answers), followed by expertinsights.com (75 citations).
Do the four engines agree?
Largely. No tracked name differed by more than 12 points between engines.
How this study was measured
24 questions × 3 runs each × 4 AI engines = 288 answers + 57 Google searches · 57 AI Overviews
24 questions asked three times on each of ChatGPT, Claude, Gemini and Perplexity, measured November 3, 2026. United States, English; Google retrieval uses desktop results. Models: gpt-5-mini, claude-sonnet-5-5, gemini-3.6-flash only, sonar-pro. Google AI Overviews come from DataForSEO, not inferred chat answers. Appearance counts returned text, including ungrounded answers; citation rates use grounded answers. Longer overlapping names suppress shorter ones; First mention is the earliest eligible name order. Own-domain rates include declared domains and subdomains; shared parent scopes may count for multiple names and cannot be summed as unique citations.
| Engine | Model IDs called | Asked | Returned | Grounded |
|---|---|---|---|---|
| ChatGPT | gpt-5-mini | 72 | 72 | 72 |
| Claude | claude-sonnet-5-5 | 72 | 72 | 72 |
| Gemini | gemini-3.6-flash | 72 | 72 | 72 |
| Perplexity | sonar-pro | 72 | 72 | 72 |
| Google AI Overviews | DataForSEO Google SERP (live, advanced) | 57 | 57 shown | 57 |
Own-domain citations count a domain plus all its subdomains, with the same rule in every table.
Definitions
- Appearance rate: answers naming the tracked name ÷ answers returned, with Wilson 95% intervals.
- First mention: average order in which the tracked name first appears (1 = first).
- Own-domain citation: grounded answers citing the tracked name's domains ÷ grounded answers.
- Citation share: citations to the tracked name's domains ÷ all citations.
Limits
- Only 42 tracked vendors are ranked; results are not an exhaustive market ranking.
- Only the tracked vendors were scored. Untracked names that appeared often were not scored, including Microsoft Corporation (50 answers), Wiz (23 answers), Rubrik Security Cloud (12 answers).
- 345 of 360 planned results were returned. 15 AI Overview lookups were excluded after at most three total attempts.
- 57 successful Google searches: 57 overviews shown; 0 without an overview. Failures are excluded, not scored as zero.
- All returned chat answers had search sources.
- Question 11 names CrowdStrike and SentinelOne, so both counts include up to 12 answers to that question.
- Removing 1 Core question naming tracked subjects leaves 276 eligible answers. The top two are Microsoft Security (209/276) and Palo Alto Networks (162/276); their order changes.
- Names with no tracked own site are shown as None. Source types use Company / brand sites only for verified official organisations; other unresolved sites are Other / unclassified.
- Wilson 95% intervals are descriptive; overlapping leading intervals do not establish a sole leader. Measurements do not endorse medical, legal, financial or product claims.
- Vendors from the earlier edition plus incident response firms the questions cover. Product names count toward their vendor. Status: Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026; CyberArk is tracked separately because answers name it as a brand. Google completed its acquisition of Wiz on March 11, 2026; Wiz keeps its brand. Splunk is part of Cisco and Mandiant part of Google Cloud; both are tracked under their own names. Being named is not an endorsement.
- Google Shopping links and unresolved google.com/goto redirect links are not counted as cited sources; original URLs remain in the evidence.
- Answers were collected through each engine's API using the model IDs listed in the methodology. The consumer ChatGPT, Claude, Gemini and Perplexity apps can answer differently.
The 24 questions
Questions marked "Core question" are the original study questions, asked word for word. The others are added neutral questions.
| # | Question | Group | Source |
|---|---|---|---|
| 01 | What are the best cybersecurity companies for a large enterprise? | Cybersecurity Index 2.0 | Core question |
| 02 | Which vendors offer the best ransomware protection? | Cybersecurity Index 2.0 | Core question |
| 03 | What is the best endpoint detection and response (EDR) platform? | Cybersecurity Index 2.0 | Core question |
| 04 | What are the most trusted enterprise cybersecurity firms? | Cybersecurity Index 2.0 | Core question |
| 05 | What are the best zero trust security platforms? | Cybersecurity Index 2.0 | Core question |
| 06 | What is the best SIEM platform for a mid-size company? | Cybersecurity Index 2.0 | Core question |
| 07 | Which cloud-native application protection platform (CNAPP) is best for multi-cloud? | Cybersecurity Index 2.0 | Core question |
| 08 | What is the best identity and access management platform for enterprises? | Cybersecurity Index 2.0 | Core question |
| 09 | What is the best privileged access management tool? | Cybersecurity Index 2.0 | Core question |
| 10 | What is the best email security solution for businesses? | Cybersecurity Index 2.0 | Core question |
| 11 | CrowdStrike vs SentinelOne: which EDR is better for enterprises? | Cybersecurity Index 2.0 | Core question |
| 12 | Which incident response firms should a company call after a breach? | Cybersecurity Index 2.0 | Core question |
| 13 | What are the leading XDR platforms? | Cybersecurity Index 2.0 | Added question |
| 14 | What is the best managed detection and response service? | Cybersecurity Index 2.0 | Added question |
| 15 | What are the best SASE vendors? | Cybersecurity Index 2.0 | Added question |
| 16 | What is the best cloud security posture management tool? | Cybersecurity Index 2.0 | Added question |
| 17 | What is the best single sign-on provider for large companies? | Cybersecurity Index 2.0 | Added question |
| 18 | What is the best identity governance platform? | Cybersecurity Index 2.0 | Added question |
| 19 | What is the best tool to protect against phishing emails? | Cybersecurity Index 2.0 | Added question |
| 20 | Which threat intelligence providers are most respected? | Cybersecurity Index 2.0 | Added question |
| 21 | What is the best security operations platform with AI? | Cybersecurity Index 2.0 | Added question |
| 22 | Which cybersecurity vendors offer the most complete platform? | Cybersecurity Index 2.0 | Added question |
| 23 | What is the best vulnerability management platform? | Cybersecurity Index 2.0 | Added question |
| 24 | What is the best ransomware recovery solution for enterprises? | Cybersecurity Index 2.0 | Added question |
About 5W
5W is an independent PR, creative and GEO agency founded in 2003, and we get you in the chatbox. All of our work is done in house, including media relations, site building and content. Learn more about our GEO practice or write to info@5wpr.com.
Full report
Read the PDF
Get in touch
Let's build your next chapter.
Tell us what you're working on. A senior strategist will respond within one business day.
- info@5wpr.com
- Phone
- 212.999.5585
- Offices
- Miami · HQ100 SE 2nd Street, Floor 38
Miami, FL 33131Tampa110 South 12th Street
Tampa, FL 33602New York469 7th Avenue, Floor 8
New York, NY 10018




