AI search
Does a bigger marketing budget buy visibility in AI answers?
We tracked 68 cybersecurity vendors and 82,814 AI citations. Marketing budget barely predicts who AI cites; search footprint does, at a correlation of 0.90.
If AI assistants simply cited whoever spends the most, the strategy would be easy: outspend the competition. Our research into the cybersecurity market shows it doesn’t work that way. We tracked 68 global cybersecurity vendors, 17 of them publicly listed, and 82,814 citations of their websites across six AI assistants in September 2026: ChatGPT, Perplexity, Gemini, Copilot, Google AI Overviews and Google AI Mode.
The pattern is consistent. The size of a company’s marketing budget says little about how often AI cites it. The size of its search footprint says a great deal.
- 68
- cybersecurity vendors, 17 of them publicly listed
- 82,814
- citations across six AI assistants
- 23×
- spread in marketing spend per citation
- 0.90
- correlation between top-three rankings and citations
Market share doesn’t carry over into AI answers
Being the market leader does not make you the leader in AI answers. Among the 17 public vendors, Palo Alto Networks earns 24.0% of the group’s revenue but receives only 8.1% of its AI citations. Cloudflare is the mirror image: 4.5% of revenue and 34.0% of citations.
| Company | Share of revenue | Share of AI citations |
|---|---|---|
| Palo Alto Networks | 24.0% | 8.1% |
| Cloudflare | 4.5% | 34.0% |
Both shares are calculated within the 17 public companies, with revenue taken from each company’s last full financial year. The reports most leadership teams read (revenue, traffic, rankings) don’t show this gap at all.
Marketing spend per citation varies 23-fold
Divide a company’s annual sales and marketing spend by its AI citations and the result ranges from about $55,000 at Cloudflare to $1.26 million at Zscaler. The median across the 17 public companies is $531,000, and the distance between the two extremes is 23-fold.
This is a ratio, not a price: nobody buys citations at that rate. What it shows is how differently the same money performs. The lower the figure, the more citations a company gets for the same budget. Cloudflare, SentinelOne and Akamai stay under $200,000 per citation; at Zscaler, F5 and SailPoint the figure is above $1 million.
What actually predicts AI citations: the search footprint
The strongest predictor of AI citations is how visible a company already is in search. We ranked all 68 vendors by citations and by each signal, then measured how closely the two orders match using Spearman’s rank correlation, where 1 means the order is identical and 0 means there is no link.
The number of search phrases where a site ranks in the top three correlates with citations at 0.90, total ranking keywords at 0.89 and organic search traffic at 0.88. Revenue (0.69) and marketing budget (0.68) sit well below, and backlinks come last at 0.48.
What moves in step with AI citations
Spearman rank correlation with AI citations · 68 vendors (revenue and budget: 17 public companies)
- Search footprint
- Company size and spend
- Links and recognition
Sources: Ahrefs, SEC EDGAR, Wikimedia · September 2026
Does money add anything once search is accounted for?
Very little. Large companies tend to be strong at everything, so a high correlation on its own doesn’t prove that a signal matters by itself. To separate the effects, we removed the part of each vendor’s citations that its keyword count explains and tested what was left against every other signal.
Only one signal stayed statistically significant: paid search spend, at 0.31. Marketing budget (0.17) and revenue (0.15) added nothing significant, and neither did domain rating, Wikipedia views or referring domains. Even the paid search link probably reflects general activity: companies that invest in search ads are usually visible in organic results too.
Traffic counts only if AI cites the pages it reaches
A large volume of search traffic isn’t enough if it lands on pages AI doesn’t cite. Among the 65 vendors with at least 10,000 search visits a month, UpGuard earns 25.9 citations per 1,000 search visits, while Okta and HackerOne earn 0.8 each. The median is 5.5.
Okta is third by search traffic but only sixteenth by AI citations, and HackerOne drops from 14th to 50th. The cost of falling behind is also high, because citations are concentrated: the top ten vendors take 62% of all citations, while 32 of the 68 get less than 0.5% each.
What this means for a business in Montenegro
The study covers global cybersecurity vendors, not Montenegrin companies, so it tells you nothing about local numbers or local competitors. What carries over is the mechanism: AI assistants cite pages that already rank, so visibility in search comes before visibility in AI answers, whatever the size of the budget.
Four practical steps follow from it:
- Measure your search footprint before you raise spend. Count the phrases where your pages rank in the top three, not just total traffic.
- Remove technical barriers first. A page search engines can’t crawl or index can’t rank, and in our data citations track rankings more closely than anything else.
- Judge pages by the citations they earn, not the visits they get. In our data, traffic to pages AI doesn’t cite did nothing for visibility in answers.
- Don’t use market share or ad spend as a stand-in for measurement. Track visibility in AI answers directly, alongside your search rankings.
The full data and methodology are in our white paper on cybersecurity vendors in AI answers. If you want to know where your own site stands, our technical SEO service sets the foundation, and the AI search strategy programme turns it into a plan your team can measure.